Subject: Re: [spfbis] #9: RFC 4408 SPF RR type

From: S Moonesamy <[email-masked]>
Date: Fri, 29 Jun 2012 09:29:12 -0700

Issue #9 is about the SPF RR Type and TXT RR.  After discussion on 
the mailing list and at the last meeting, the conclusion was to use the TXT RR.

The document editor can propose text to reflect that.  Please discuss 
the text change on this thread.

Regards,
S. Moonesamy

---

From: Scott Kitterman <[email-masked]>
Date: Fri, 29 Jun 2012 14:11:10 -0400

> the text change on this thread.

Yesterday I prepared a proposed change for this issue, and #25: RFC 4408: 
Section 4.4 Parallel Query, that'll be in the -02 I plan to post today (since 
msk promised to read the draft over the weekend).  For parallel query, I think 
it's essentially OBE since we aren't going to recommend doing lookups for both 
types.

My proposed diff for this is attached.  It'll look prettier in the rfcdiff once 
I publish -02.

Scott K

--- draft-ietf-spfbis-4408bis-01.txt	2012-06-27 01:13:36.595084337 -0400
+++ draft-ietf-spfbis-4408bis-02.txt	2012-06-29 13:48:48.496483502 -0400
@@ -654,36 +710,29 @@
 
 3.1.1.  DNS Resource Record Types
 
-   This document defines a new DNS RR of type SPF, code 99.  The format
-   of this type is identical to the TXT RR [RFC1035].  For either type,
-   the character content of the record is encoded as [US-ASCII].
+   [RFC4408] defined a new DNS RR of type SPF, code 99.  The format of
+   this type is identical to the TXT RR [RFC1035].  For either type, the
+   character content of the record is encoded as [US-ASCII].
 
-   It is recognized that the current practice (using a TXT record) is
-   not optimal, but it is necessary because there are a number of DNS
-   server and resolver implementations in common use that cannot handle
-   the new RR type.  The two-record-type scheme provides a forward path
-   to the better solution of using an RR type reserved for this purpose.
+   While it is recognized that the current practice (using a TXT record)
+   is not optimal, the transitional strategy to the new, dedicated RR
+   type failed to gain traction and has been abandoned for SPF Version
+   1.  Such use is deprecated for version 1, but should a need be
+   identified for an incompatible update to a later version, its use
+   might be appropriate.  The background for this is described in
+   Appendix A of [draft-ietf-spfbis-experiment].
 
-   An SPF-compliant domain name SHOULD have SPF records of both RR

-
-Kitterman               Expires December 29, 2012              [Page 12]
+Kitterman               Expires December 31, 2012              [Page 13]
 
 Internet-Draft        Sender Policy Framework (SPF)            June 2012

-   types.  A compliant domain name MUST have a record of at least one
-   type.  If a domain has records of both types, they MUST have
-   identical content.  For example, instead of publishing just one
-   record as in Section 3.1 above, it is better to publish:
-
-      example.com. IN TXT "v=spf1 +mx a:colo.example.com/28 -all"
-      example.com. IN SPF "v=spf1 +mx a:colo.example.com/28 -all"
-
-   Example RRs in this document are shown with the TXT record type;
-   however, they could be published with the SPF type or with both
-   types.
+   An SPF-compliant domain name MUST have SPF records of type TXT.  An
+   SPF-compliant domain name MUST NOT publish only records of type SPF.
+   If a domain has records of both types, they MUST have identical
+   content.
 
 3.1.2.  Multiple DNS Records
 
@@ -845,8 +901,9 @@
 
    In accordance with how the records are published (see Section 3.1
    above), a DNS query needs to be made for the <domain> name, querying
-   for either RR type TXT, SPF, or both.  If both SPF and TXT RRs are
-   looked up, the queries MAY be done in parallel.
+   for type TXT.  SPF Version 1 queries for records of type SPF SHOULD
+   NOT be done.  If both SPF and TXT RRs are looked up, the queries MAY
+   be done in parallel.
 
    If all DNS lookups that are made return a server failure (RCODE 2),
    or other error (RCODE other than 0 or 3), or time out, then
@@ -877,9 +934,6 @@
        record with a version section of "v=spf10" does not match and
        must be discarded.
 
-   2.  If any records of type SPF are in the set, then all records of
-       type TXT are discarded.
-
    After the above steps, there should be exactly one record remaining
    and evaluation can proceed.  If there are two or more records
    remaining, then check_host() exits immediately with the result of

---

From: Commerco WebMaster <[email-masked]>
Date: Fri, 29 Jun 2012 12:16:07 -0600

> My proposed diff for this is attached.  It'll look prettier in the rfcdiff once

+1

Alan M.

---

From: Alessandro Vesely <[email-masked]>
Date: Sat, 30 Jun 2012 12:24:51 +0200

> it's essentially OBE since we aren't going to recommend doing lookups for both 

-02:
 An SPF-compliant domain name MUST have SPF records of type TXT.  An
 SPF-compliant domain name MUST NOT publish only records of type SPF.
 If a domain has records of both types, they MUST have identical
 content.

I'd strike the second sentence, which merely repeats the first.  As
this is a change, it might be worth to anticipate the lookup change
from 4.4 instead, so as to convey the change more compactly:

NEW
 An SPF-compliant domain name MUST have SPF records of type TXT, and
 MAY have SPF records of type SPF.  If a domain has records of both
 types, they SHOULD have identical content.  However, SPF-compliant
 verifiers SHOULD query SPF records of type TXT only.

As for Section 4.4, I don't think it makes sense to specify
non-recommended behavior.  Let me try some minor tweaks as well:

-02:
 In accordance with how the records are published (see Section 3.1
 above), a DNS query needs to be made for the <domain> name, querying
 for type TXT.  SPF Version 1 queries for records of type SPF SHOULD
 NOT be done.  If both SPF and TXT RRs are looked up, the queries MAY
 be done in parallel.

NEW
 In accordance with how the records are published (see Section 3.1
 above), a DNS query needs to be made for the domain name, querying
 for type TXT.  SPF queries for SPF records of type SPF SHOULD NOT be
 done any more.

---

From: Scott Kitterman <[email-masked]>
Date: Sat, 30 Jun 2012 19:26:17 -0400

On Saturday, June 30, 2012 12:24:51 PM Alessandro Vesely wrote:
> > Section 4.4 Parallel Query, that'll be in the -02 I plan to post today
> > (since msk promised to read the draft over the weekend).  For parallel
> > query, I think it's essentially OBE since we aren't going to recommend
> > doing lookups for both types.
> 
> -02:

I agree that "MUST NOT publish only records of type SPF" is technically 
redundant, but I left it in because, since this is a change, I wanted to be 
clear about it (my feeling is that 4408, in the name of getting approved, 
somewhat disingenuously encouraged type SPF publication).  

"If a domain has records of both types, they MUST have identical content." is 
verbatim from RFC 4408 so it should be kept unchanged if we mention the topic 
at all.  Since we are ending the attempt to transition to Type SPF, I think 
MAY publish is far too encouraging.  How about:

   An SPF-compliant domain name MUST have SPF records of type TXT.
   It SHOULD NOT have SPF records of type SPF, but if a domain has 
   records of both types, they MUST have identical content.  
   SPF-compliant verifiers SHOULD query SPF records of type TXT only.

>  for type TXT.  SPF queries for SPF records of type SPF SHOULD NOT be

I'm fine with that, but I'd stop at done (remove any more).

Other opinions?

Scott K

---

From: Commerco WebMaster <[email-masked]>
Date: Sat, 30 Jun 2012 18:06:57 -0600

On 6/30/2012 5:26 PM, Scott Kitterman wrote:
>>   above), a DNS query needs to be made for the<domain>  name, querying

How about this -
-In accordance with how the records are published (see Section 3.1
-above), a DNS query needs to be made for the domain name, querying
-for type TXT.  SPF queries for SPF records of type SPF SHOULD NOT be
-done any more.

+In accordance with how the records are published (see Section 3.1
+above), SPF v1 DNS queries for domain names should only be performed 
+using DNS TXT RRs, while queries requesting DNS SPF RRs SHOULD NO 
LONGER be performed.

Best,

Alan M.

---

From: Scott Kitterman <[email-masked]>
Date: Sat, 30 Jun 2012 20:25:42 -0400

On Saturday, June 30, 2012 06:06:57 PM Commerco WebMaster wrote:
> > "If a domain has records of both types, they MUST have identical content."
> > is verbatim from RFC 4408 so it should be kept unchanged if we mention
> > the topic at all.  Since we are ending the attempt to transition to Type
> > SPF, I think> 

I agree that sounds better, but SHOULD NOT is RFC 2119, but SHOULD NO LONGER 
is not, so I'm not sure how to do it.  How about:

   In accordance with how the records are published (see Section 3.1
   above), a DNS query needs to be made for the domain name, querying
   for type TXT, but queries SHOULD NOT be done for Type SPF.

Scott K

---

From: John Leslie <[email-masked]>
Date: Sat, 30 Jun 2012 20:31:26 -0400

>>  verifiers SHOULD query SPF records of type TXT only.

   This looks right to me...

> the topic at all.

   I don't see it that way. Checking type SPF is outside 4408bis; thus
we have no reason to _require_ they be identical. (I would be willing
to not mention anything about what type SPF should contain: merely
state that they will not be checked by 4408bis-compliant systems.)

> Since we are ending the attempt to transition to Type SPF, I think 
> MAY publish is far too encouraging.

   Nonetheless, there will be legacy type SPF records. "May have" seems
fine to me. (We can't ask for a "flag day".)

> How about:

   For various reasons, removing type SPF records is likely to take a
while. Tools for changing them are likely to become buggy or disappear
entirely. While it would be "nice" if they disappeared, it's not
reasonable to require that any changes in the type TXT RR be copied
to the type SPF RR.

>    SPF-compliant verifiers SHOULD query SPF records of type TXT only.

   It might be good to add something like "If a type TXT record is
found its value MUST be used (in preference to any type SPF record).

--
John Leslie <[email-masked]>

---

From: Commerco WebMaster <[email-masked]>
Date: Sat, 30 Jun 2012 18:58:05 -0600

>     for type TXT, but queries SHOULD NOT be done for Type SPF.

I understand the issue, though one wonders, did RFC 2119 ever account 
for situations like this BIS exercise where one must go back and change 
what was to what is no longer?  Doh!

How about this...

In accordance with how the records are published (see Section 3.1
above), a DNS query MUST be made for the domain name using type TXT and 
SHOULD NOT be made for type SPF.

Alan M.

---

From: "Murray S. Kucherawy" <[email-masked]>
Date: Sat, 30 Jun 2012 21:58:51 -0700

> from 4.4 instead, so as to convey the change more compactly:

+1.

NEW
>  verifiers SHOULD query SPF records of type TXT only.

Given the conclusions of the experiment draft, why are we continuing to
even talk about the SPF RRTYPE?  I think 4408bis should drop it altogether.

-MSK

---

From: "Murray S. Kucherawy" <[email-masked]>
Date: Sat, 30 Jun 2012 22:02:36 -0700

>    for type TXT, but queries SHOULD NOT be done for Type SPF.

I suggest:

In accordance with how the records are published (see Section 3.1 above), a
DNS query needs to be made for the domain name, querying for type TXT.

-MSK