Subject: Re: [spfbis] draft-ietf-spfbis-experiment-01

From: "John R Levine" <[email-masked]>
Date: 13 Apr 2012 21:58:23 +0000

A few minor points:

In section 4, probably worth mentioning that SPF can be applied before 
DATA, which is the main reason it can be cheaper to use than S-ID.

In 5.1 item 6, in the second sentence I'd say "Further, few if 
any web-based DNS configuration tools support type 99 records." which is 
the truth. The most popular is Godaddy whose SPF wizard creates a type 16 
record.

Appendix A, beginning of 2nd pp: "At the time SPF was developed, ... " 
otherwise sounds like you mean at the time it was brought to the IETF.

In the penultimate paragraph of Appendix A, also say something about 
making it easier to add new types to provisioning tools.  Personally, I 
think that's a bigger hurdle than fixing the firewalls, since there's no 
incentive to fix the firewalls if nobody is using the types they 
mishandle.

Regards,
John Levine, [email-masked], Taughannock Networks, Trumansburg NY
"I dropped the toothpaste", said Tom, crestfallenly.

---

From: "Murray S. Kucherawy" <[email-masked]>
Date: Sat, 14 Apr 2012 06:55:28 +0000

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On Behalf Of John R Levine
> Sent: Friday, April 13, 2012 2:58 PM
> To: [email-masked]
> Subject: Re: [spfbis] draft-ietf-spfbis-experiment-01
> 
> A few minor points:
> [...]

Thanks, all incorporated for the next version.

-MSK

---

From: Dotzero <[email-masked]>
Date: Mon, 16 Apr 2012 14:44:13 -0400

> Thanks, all incorporated for the next version.

Reviewed http://www.ietf.org/id/draft-ietf-spfbis-experiment-02.txt
and I'm comfortable with it overall.

My only question is one of curiosity and does not need to be addressed
as far as I'm concerned:

Section 3.1 - For the 6,887 records that start with "spf2.0/", it
would have been useful to further break this down into how many
specify MFROM and how many specify PRA.

My only other comment is to restate that PRA can consistently be gamed
by abusers so as to gain a "neutral" outcome regardless of what the
domain in the Mail From asserts. This might appropriately be
documented.

Despite these two minor quibbles I agree with the document overall and
the reommendations to the IESG.

Mike

---

From: "Murray S. Kucherawy" <[email-masked]>
Date: Mon, 16 Apr 2012 21:09:37 +0000

> From: Dotzero [mailto:[email-masked]]
> Sent: Monday, April 16, 2012 11:44 AM
> To: Murray S. Kucherawy
> Cc: [email-masked]
> Section 3.1 - For the 6,887 records that start with "spf2.0/", it would
> have been useful to further break this down into how many specify MFROM
> and how many specify PRA.

I think I can add that; both Philip's survey and my own do contain that information.  If indeed it's easy to extract, I'll include it in -03.

> domain in the Mail From asserts. This might appropriately be

I think the reasons that people picked one over the other can't be measured without voluntary response to surveys that would take some time to craft and run.

This issue is undoubtedly on the list for some people, as might be IPR concerns.  But I believe it's enough for us to include data we can actually collect and reach conclusions based on that.  That is, we generally only need to observe what the community chose to use, not so much why.

> the reommendations to the IESG.

Thanks for the review!  I'll post a -03 and perhaps request a working group last call after one or two more.

-MSK

---

From: "Murray S. Kucherawy" <[email-masked]>
Date: Mon, 16 Apr 2012 23:00:45 +0000

> and how many specify PRA.

The breakdown from my data is:

6329 spf2.0/pra
213  spf2.0/pra,mfrom
211  spf2.0/mfrom (which is just SPF)
134  spf2.0/mfrom,pra

Is it worth including this breakdown in -03?  Almost 97% of spf2.0/* records requested PRA handling.

Philip's data contains similar numbers, certainly north of 90%.  His data are available at the previously-given URL if anyone wants to run the queries.

-MSK

---

From: Alessandro Vesely <[email-masked]>
Date: Tue, 17 Apr 2012 16:15:41 +0200

On Tue 17/Apr/2012 15:48:25 +0200 Murray S. Kucherawy wrote:
>> From: Dotzero

It is not just SPF.  To only validate MFROM one should set 2 records:

   v=spf1 [mechanisms omitted] -all

and

   spf2.0/pra ?all

> records requested PRA handling.

That seems to be consistent with the recommended settings of Microsoft's
wizard, see http://www.ietf.org/mail-archive/web/spfbis/current/msg00343.html