Subject: Re: [spfbis] #13: RFC 4408: Best-Guess SPF

From: S Moonesamy <[email-masked]>
Date: Wed, 29 Feb 2012 09:32:59 -0800

At 20:02 16-02-2012, spfbis issue tracker wrote:
>#13: RFC 4408: Best-Guess SPF
>
>  Message posted by Murray Kucherawy on 26 Feb 2012:
>
>  I'd like to have a section, or at least an appendix, that talks about
>  best-guess SPF: What it is, why/when it is or isn't a good idea, etc.
>
>  http://www.ietf.org/mail-archive/web/spfbis/current/msg00398.html

[snip]

>Ticket URL: <http://trac.tools.ietf.org/wg/spfbis/trac/ticket/13>

I am going to classify Issue #13 as "Hold for document update".  If 
there are any objections, please post them to this mailing 
list.  BTW, the issue may be opened for discussion if an open issue 
is related to this issue.  Please let me know if it occurs.

Regards,
S. Moonesamy
SPFBIS WG co-chair

---

From: Scott Kitterman <[email-masked]>
Date: Wed, 29 Feb 2012 16:10:20 -0500

>is related to this issue.  Please let me know if it occurs.

This is not in RFC 4408, so it's only in scope if it's widely deployed. If we are going to consider it in scope, there should be some evidence of widespread use.

Personally, I think the most we should do is say MUST NOT (we can't stop people from doing so, but we can make it clear it's wrong to call a best guess result an SPF result). 

Scott K

---

From: "Murray S. Kucherawy" <[email-masked]>
Date: Wed, 29 Feb 2012 21:18:55 +0000

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On
> Behalf Of Scott Kitterman
> Sent: Wednesday, February 29, 2012 1:10 PM
> To: [email-masked]
> Subject: Re: [spfbis] #13: RFC 4408: Best-Guess SPF
> 
> This is not in RFC 4408, so it's only in scope if it's widely deployed.
> If we are going to consider it in scope, there should be some evidence
> of widespread use.

The question of "widely deployed" is as interesting as the question of whether something is "used" if only clients query for it.  Does Gmail doing Best Guess SPF count as widespread use because of the percentage of global email traffic they receive, or only count as a single implementation?

I agree with HFDU.  I haven't formed an opinion on what we should say about it yet, but I think we should say something about it either way.

-MSK

---

From: Scott Kitterman <[email-masked]>
Date: Wed, 29 Feb 2012 16:29:51 -0500

"Murray S. Kucherawy" <[email-masked]> wrote:

>The question of "widely deployed" is as interesting as the question of
>whether something is "used" if only clients query for it.  Does Gmail
>doing Best Guess SPF count as widespread use because of the percentage
>of global email traffic they receive, or only count as a single
>implementation?
>
>I agree with HFDU.  I haven't formed an opinion on what we should say
>about it yet, but I think we should say something about it either way.

Just FYI, it wasn't left out of RFC 4408 by accident. It was considered too crazy a concept for standardization. I'm not sure what that suggests for 4408bis.

Scott K

---

From: S Moonesamy <[email-masked]>
Date: Wed, 29 Feb 2012 13:26:34 -0800

Hello,

I opened this thread so that the WG can comment on the question of 
"widely deployed".

Regards,
S. Moonesamy
SPFBIS WG co-chair

---

From: "Murray S. Kucherawy" <[email-masked]>
Date: Wed, 29 Feb 2012 21:45:18 +0000

> Sent: Wednesday, February 29, 2012 1:30 PM
> To: [email-masked]
> Just FYI, it wasn't left out of RFC 4408 by accident. It was considered
> too crazy a concept for standardization. I'm not sure what that
> suggests for 4408bis.

Fair enough.

I think the charter allows addition of pedagogy based on experience.  There's this thing out there that's document in several places now (JFGI) which might leave some readers wondering if it's a good idea or not.  This is an opportunity to say something about it one way or another.  Unless we want to make a normative statement that it's a bad idea, an informative appendix that actually writes down what the pre-IETF people felt about it, along with some anecdotal experience from parties that tried, would be just fine with me.

-MSK

---

From: "Murray S. Kucherawy" <[email-masked]>
Date: Wed, 29 Feb 2012 21:51:35 +0000

> From: [email-masked] [mailto:[email-masked]] On Behalf Of S Moonesamy
> Sent: Wednesday, February 29, 2012 1:27 PM
> To: [email-masked]
> Subject: [spfbis] Widely deployed (was: #13: RFC 4408: Best-Guess SPF)
> 

Both the "How many implementations?" and "How much exercise does it get?" are interesting.  It amounts to a depth vs. breadth argument in my view.  But I think sometimes it can be more general: Just look at how much input diversity there is, regardless of how many installations there are.

In the case of a domain authentication technology like SPF, I think the more salient question is "How many domains has it checked?"  I can't see much of a difference between, say, a thousand sites each evaluating a single domain versus one site that checks a thousand domains.

So even if only Gmail implements Best Guess SPF, I would call that widely deployed, because it sees enough of a diversity of inbound mail to make meaningful observations about its efficacy.

Also, Best Guess SPF is not itself a protocol; it's more of an applicability statement of SPF.

-MSK

---

From: Dave Crocker <[email-masked]>
Date: Wed, 29 Feb 2012 14:25:32 -0800

> This is not in RFC 4408, so it's only in scope if it's widely deployed.

This strikes me as an impressively dangerous feature.

At a minimum, we should see a specification for it, rather than discuss it 
merely as an idea.

My guess is that this has narrow application and currently very limited 
deployment, at best.

d/

-- 

   Dave Crocker
   Brandenburg InternetWorking
   bbiw.net

---

From: "Murray S. Kucherawy" <[email-masked]>
Date: Wed, 29 Feb 2012 22:27:26 +0000

> From: [email-masked] [mailto:[email-masked]] On Behalf Of Dave Crocker
> Sent: Wednesday, February 29, 2012 2:26 PM
> To: [email-masked]

I'd be fine with us saying just that if that's consensus.

> At a minimum, we should see a specification for it, rather than discuss
> it merely as an idea.

http://www.openspf.org/FAQ/Best_guess_record

We could also include that text or something similar, just so everyone knows what it is.

> My guess is that this has narrow application and currently very limited

What's that mean, exactly?  :-)

-MSK

---

From: Scott Kitterman <[email-masked]>
Date: Wed, 29 Feb 2012 17:46:56 -0500

"Murray S. Kucherawy" <[email-masked]> wrote:

>Behalf Of S Moonesamy
>Both the "How many implementations?" and "How much exercise does it
>get?" are interesting.  It amounts to a depth vs. breadth argument in
>my view.  But I think sometimes it can be more general: Just look at
>how much input diversity there is, regardless of how many installations
>there are.
>
>In the case of a domain authentication technology like SPF, I think the
>more salient question is "How many domains has it checked?"  I can't
>see much of a difference between, say, a thousand sites each evaluating
>a single domain versus one site that checks a thousand domains.
>
>So even if only Gmail implements Best Guess SPF, I would call that
>widely deployed, because it sees enough of a diversity of inbound mail
>to make meaningful observations about its efficacy.

I think that's reasonable.

To cover (once again) the open source implementations with which I'm familiar:

Mail::SPF - No best guess at all
pyspf - Not enabled by default
libspf2 - Not enabled by default

Scott K

---

From: "Murray S. Kucherawy" <[email-masked]>
Date: Wed, 29 Feb 2012 23:04:01 +0000

> From: [email-masked] [mailto:[email-masked]] On Behalf Of Scott Kitterman
> Sent: Wednesday, February 29, 2012 2:47 PM
> To: [email-masked]
> Subject: Re: [spfbis] Widely deployed (was: #13: RFC 4408: Best-Guess SPF)
> 

One more: The sid-milter package can do it, but it's off by default.

-MSK

---

From: Philip Gladstone <[email-masked]>
Date: Wed, 29 Feb 2012 18:24:06 -0500

> I agree with HFDU.  I haven't formed an opinion on what we should say about it yet, but I think we should say something about it either way.
I think that the result from the 'best guess SPF record' evaluation 
should not be a formal SPF result. However, an anti-spam system might 
well use the result of the evaluation of the best guess spf record as 
part of the input to its algorithm. I think that the concept is useful 
in that context.

Philip

-- 
Philip Gladstone
Distinguished Engineer
Product Development
[email-masked]
Phone: +1 978-ZEN-TOAD (+1 978 936 8623)
Google: +1 978 800 1010
Ham radio: N1DQ

---

From: Hector Santos <[email-masked]>
Date: Wed, 29 Feb 2012 18:54:25 -0500

> I opened this thread so that the WG can comment on the question of 

Dog with fleas, ticks, worms...

I side with all three of Dave Crocker's input and advice.

-- 
Hector Santos, CTO
http://www.santronics.com
http://santronics.blogspot.com

---

From: Hector Santos <[email-masked]>
Date: Wed, 29 Feb 2012 19:46:24 -0500

My Opinion.

Widely deployed doesn't correlate to the idea of success if its 
purpose has shown to be of low value, shown to have little to no 
payoff, perhaps complex, expensive to implement, comes with with list 
of other compliancy dependencies, etc. It could just be a marketing 
value at this point. Some may validly suggest Widely Deployed is good 
because it has a trickle down effect and realized benefit for all once 
others begin to "follow the leaders."  Some may argue DKIM falls in 
that category where high investments has yet to materialize or trickle 
down with a payoff.

I prefer to see worth, show the What it is, how it works and why this 
Best Guess has a value to be considered as a new SPF consideration.

I can see it perhaps as just another test data point factor (i.e, 
Sender and purported MX Receiver live in the same ADMD or computer 
box) as input to some external antispam evaluator or algorithm, but 
don't see that an enforcible concept since there is no SMTP 
requirement for the sender and receivers be part of the same ADMD or 
computer box.

As it relates to Google, in lieu of any information in how they use 
it, I can clearly see it as part of Google's BI to see what the 
patterns of sender/receivers operations and network connectivity 
associations are - the "Google World Mail Connectivity Map" perhaps. 
I would consider it strategic business intelligence data banking.

But then again, it could be another AVS secret formula.  Explain it.

I personally don't think it should included in SPF-BIF, but like to 
know more above the Sender/Receiver, same box/owner network data point.

Murray S. Kucherawy wrote:
> _______________________________________________
> spfbis mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/spfbis
> 
>

---

From: "John Levine" <[email-masked]>
Date: 1 Mar 2012 00:59:49 -0000

>Personally, I think the most we should do is say MUST NOT (we can't stop people from doing so,
>but we can make it clear it's wrong to call a best guess result an SPF result). 

I wouldn't disagree.  Also, if we do an AS, discussion of it might better
go in there.

R's,
John

---

From: "John Levine" <[email-masked]>
Date: 1 Mar 2012 01:22:31 -0000

>part of the input to its algorithm. I think that the concept is useful 

It might be useful, but it's not SPF.

Another possibility would be a separate informational document
called something like heuristic mail sender validation.

R's,
John

---

From: "Murray S. Kucherawy" <[email-masked]>
Date: Thu, 1 Mar 2012 03:55:42 +0000

> From: [email-masked] [mailto:[email-masked]] On Behalf Of John Levine
> Sent: Wednesday, February 29, 2012 5:00 PM
> To: [email-masked]
> Cc: [email-masked]
> >Personally, I think the most we should do is say MUST NOT (we can't
> >stop people from doing so, but we can make it clear it's wrong to call
> a best guess result an SPF result).
> 
> I wouldn't disagree.  Also, if we do an AS, discussion of it might
> better go in there.

That's outside the current charter, but I'd be amenable to working on that if others are (whether a post-rechartering project or an individual submission).

-MSK

---

From: Dave Crocker <[email-masked]>
Date: Wed, 29 Feb 2012 10:33:54 -0800

[snip]

>Ticket URL: <http://trac.tools.ietf.org/wg/spfbis/trac/ticket/13>;

Regards,
S. Moonesamy
SPFBIS WG co-chair 

_____________________________________________

spfbis mailing list
[email-masked]

wtf?

please at leat define it.

d/

---

From: S Moonesamy <[email-masked]>
Date: Wed, 29 Feb 2012 23:14:34 -0800

Hi Dave,
>please at leat define it.

I have been asked what "Hold for document update" means.  The working 
group does not have any WG draft up for discussion yet.  When there 
is a WG draft, the working group can discuss about the exact text 
that goes into it.

Regards,
S. Moonesamy
SPFBIS WG co-chair