Subject: [spfbis] New issue section 6.2 - clarify what kind of SMTP response

From: Hector Santos <[email-masked]>
Date: Mon, 27 Aug 2012 21:20:48 -0400

There has been much discussion related to the intent of domains 
publishing -ALL records for receiver interpretation. It is been my 
experience and understanding this has long been understood. 
Unfortunately,  RFC4408 could of done a better job of making it even 
more clear to avoid what what we seeing today.

But maybe it did?

In section 6.2, it has clear illustrative examples of the type of 
explanation reason strings for -ALL policies:

      "Mail from example.com should only be sent by its own servers."
          -- a simple, constant message

       "%{i} is not one of %{d}'s designated mail servers."
          -- a message with a little more information, including the IP
             address that failed the check

       "See http://%{d}/why.html?s=%{S}&i=%{I}"
          -- a complicated example that constructs a URL with the
             arguments to check_host() so that a web page can be
             generated with detailed, custom instructions

The last one is not as clear at the first two.  Further, in the 
section 4th paragraph. it provide what is the intent of the string:

    Since the explanation string is intended for an SMTP response .....

I believe this provides the ample evidence what SPF was intending to 
provide domains for receivers to follow.

Two points about this:

1) In section 2.5.4, it refers to section 6.2 and usage of the exp 
directive, however, we should clarify in the above sentence whether 
the SMTP response is for a permanent or acceptance. Although it 
wouldn't make sense it if was a positive response to have such 
negative explanations.  I can see if it possible for an accept+mark 
situation:

    MAIL FROM:<test @ example.com>
    250-Mail from example.com should only be sent by its own servers.
    250 Mail will be accepted but held in user's spam folder

So I think we need a clarification here which pretty much means to add 
semantics so that the SMTP response can be for both rejection or 
acceptance transactions.

2) We should also note how this experience is carried over to the 
Received-SPF (and A-R  if it remains as part of SPFBIS).

-- 
HLS

---

From: Scott Kitterman <[email-masked]>
Date: Tue, 28 Aug 2012 00:03:44 -0400

> Received-SPF (and A-R  if it remains as part of SPFBIS).

All these are exemplary text.  I don't think anyone is arguing that SMTP time 
rejection was not considered as an option.  Of course it was, so I'm really 
confused about what point you are trying to make.

Section 6.2 covers the "exp" modifier.  It does not attempt to standardize the 
full SMTP session text and I don't think it should.  Here's an example of the 
default fail text from my implementation:

550 Message rejected due to: SPF fail - not authorized. Please see 
http://www.openspf.net/Why?s=mfrom;id=[email-masked];ip=72.81.252.19;r=[email-masked]

If you think writing different text in 4408bis is going to cause me to change 
this, you are mistaken.

Scott K

---

From: Hector Santos <[email-masked]>
Date: Tue, 28 Aug 2012 00:40:20 -0400

> confused about what point you are trying to make.

I'll try better below.

> full SMTP session text and I don't think it should.  

Never mention that, stated or implied it.

> Here's an example of the 

Huh? Dude, calm down.

I made a point in #1 that the reason was intended as a SMTP response 
and I am suggesting it should be expanded to clarify a rejection or 
acceptance response in order to be consistent with the rest of the 
changes in the rev.

I made a point in #2 on whether the reason should/can/may be part of 
the marking, i.e. not just the SMTP response.

-- 
HLS

---

From: Scott Kitterman <[email-masked]>
Date: Tue, 28 Aug 2012 00:38:25 -0500

>the marking, i.e. not just the SMTP response.

It's in Received-SPF, so yes it can.

Scott K