Subject: [saag] IETF 71: DKIM working group summary

From: Barry Leiba <[email-masked]>
Date: Tue, 11 Mar 2008 11:03:52 -0400

[Sorry; I mis-posted this to secdir; reposting to saag.]

IETF 71 DKIM meeting summary

The DKIM working group met on Monday, 10 March 2008, from 1740-1950 in the
Franklin 5 room.  The main goal of the meeting was to discuss and close issues on
the Author Signing Policy document and move toward WGLC on that document.

The meeting opened with a review of the informational documents, "DKIM Service
Overview"[1] and "DKIM Service Deployment"[2].  The former is mostly done, but
for some editorial comments.  WGLC on the content started at the close of the
meeting, and will end on 24 March.  The latter is still under development.  The
authors solicited reviews and contributions from those developing software for
DKIM, deploying it, or operating mail systems with it.  Ellen Siegel, who works
for an email marketing company, had comments about the timing of the documents,
and the importance of having some early advice on the deployment of signing
practices.  Tony Hansen met with a few people after the meeting.

The bulk of the meeting was then spent going through the open issues on the
signing practices document, now called "Author Signing Practices"[3] ("Author"
replacing "Sender", and there was some discussion on the name, with one WG chair
preferring "From Domain", shortened to "FroDo").  Jim Fenton discussed the
history of the recent changes (which involved a significant restructuring of the
document, a restructuring that resolved a number of issues), and then divided the
open issues into three groups, roughly "easy", "medium", and "hard" -- more
specifically, "We should close these," "These might be ready to close," and
"These probably need more discussion."

The result of the issue run-through and discussion related to the latest (-03)
draft was that, pending confirmation on the mailing list, we can close all but
two of the "easy" issues, all but two of the "medium" ones, and all but one of
the "hard" issues (but see below).

Most of the "hard" discussion was on issue 1519, user vs domain granularity of
signing practices.  Consensus was to leave it at domain granularity only, leaving
any extension to user granularity for a protocol extension.  We'll leave this
issue open for two weeks, to allow further discussion.

Some issues remaining open:
1519 - user vs domain granularity of signing practices
1535 - clarify need for domain existence check in the decision tree (step 2)
1543 - remove [FWS]; there's a significant move to keep it, just for consistency
with the base spec
1547 - require existence of MX records; leave open awaiting follow-up from Peter
Koch
1550 - the name of the document (remains open *briefly*); there's still
disagreement on "Author"

In addition, Phill Hallam-Baker agreed to review the security considerations and
add any appropriate text about security threats.  Peter Koch will post a message
to the list about his concerns about DNS queries (which may open a new issue).
And we will open a new issue to replace 1520, which will address only the *name*
of the "Discardable" feature -- there's significant dislike of the name, but it's
not clear that we'll find a better one.  This issue will be open for two weeks
only, to avoid having it turn into an interminable discussion.

---
[1] Slides at http://www3.ietf.org/proceedings/08mar/slides/dkim-1.pdf
    Document at http://tools.ietf.org/html/draft-ietf-dkim-overview

[2] Slides at http://www3.ietf.org/proceedings/08mar/slides/dkim-2.pdf
    Document at http://tools.ietf.org/html/draft-ietf-dkim-deployment

[3] Slides at http://www3.ietf.org/proceedings/08mar/slides/dkim-0.pdf
    Document at http://tools.ietf.org/html/draft-ietf-dkim-ssp

--
Barry Leiba, DKIM working group chair  ([email-masked])
http://www.research.ibm.com/people/l/leiba
http://www.research.ibm.com/spam