Subject: [spfbis] Experiment document

From: "Murray S. Kucherawy" <[email-masked]>
Date: Fri, 30 Mar 2012 10:24:43 +0000

While we wait for the tools team to sort out the datatracker problem, I'm going to continue revising the draft as an individual submission.

I'm going to add/update the results from my SPF survey first.  And I'll arrange for Scott to get access to my survey data so he can complete his secondary survey.

Dave proposed talking about which questions we'd like to see answered in the experiment document to send to the IESG.  From this, we can figure out if we can already answer those questions or if we need to design and run more surveys.  I propose we start coming up with those questions now.  I'll start by tossing these out, and people should alter/chop/augment these entries:

-          What is the relative deployment of SPF vs TXT records?

-          How many clients appear to be querying each record type?

-          What are counts on records that are specific to Sender-ID (i.e., spf2.0/pra) versus others?

-          How much do the Sender-ID results deviate from the SPF results in terms of pass/fail?

-          How often do the validated identifiers differ between SPF and Sender-ID?

-          How many implementations of each of the four RFCs are known to exist?  (This is anecdotal, not survey-based.)

And the following appendix topics:

-          What operational considerations were observed (e.g., firewalls, dropped packets for unknown types)?

-          The whole SPF vs. TXT evolution discussion

-          How often were non-SPF records found in TXT queries?

Please bash the list now.

I also need to add a paragraph that describes the surveys we've done.  I'll add that for mine; Philip, please send me a description of yours, on-list or off.

Thanks,
-MSK

---

From: "Rolf E. Sonneveld" <[email-masked]>
Date: Fri, 30 Mar 2012 23:32:38 +0200

Hi, Murray,

thanks for the excellent work to gather these data.

On 3/30/12 12:24 PM, Murray S. Kucherawy wrote:
>
> While we wait for the tools team to sort out the datatracker problem, 
> I'm going to continue revising the draft as an individual submission.
>
> I'm going to add/update the results from my SPF survey first.  And 
> I'll arrange for Scott to get access to my survey data so he can 
> complete his secondary survey.
>
> Dave proposed talking about which questions we'd like to see answered 
> in the experiment document to send to the IESG.  From this, we can 
> figure out if we can already answer those questions or if we need to 
> design and run more surveys.  I propose we start coming up with those 
> questions now.  I'll start by tossing these out, and people should 
> alter/chop/augment these entries:
>
> -What is the relative deployment of SPF vs TXT records?
>
> -How many clients appear to be querying each record type?
>
> -What are counts on records that are specific to Sender-ID (i.e., 
> spf2.0/pra) versus others?
>
> -How much do the Sender-ID results deviate from the SPF results in 
> terms of pass/fail?
>

Not sure I understand this correctly: the output of questions 1 and 3 
can be derived easily by some database queries, but am I correct that 
question 4 requires processing of IP addresses/ranges to see what the 
results are? If so, what is the test set to test with? How do you create 
test sets when include:, redirect: or macro's are used?

> -How often do the validated identifiers differ between SPF and Sender-ID?
>
> -How many implementations of each of the four RFCs are known to 
> exist?  (This is anecdotal, not survey-based.)
>

Add this one:

- distribution of number of DNS queries required to parse the SPF record.

> -What operational considerations were observed (e.g., firewalls, 
> dropped packets for unknown types)?
>
> -The whole SPF vs. TXT evolution discussion
>
> -How often were non-SPF records found in TXT queries?
>
> I also need to add a paragraph that describes the surveys we've done.  
> I'll add that for mine; Philip, please send me a description of yours, 
> on-list or off.
>

/rolf