Subject: Re: [spfbis] Authentication-Result (Issue 10?)

From: Arthur Thisell <[email-masked]>
Date: Thu, 30 Aug 2012 04:00:30 -0700 (PDT)

> Murray Kucherawy pointed out that RFC4408 contained no protections against spoofed Received-SPF attacks.

RFC 4408 says:

 The Received-SPF header field is a trace field (see [RFC2822] Section
   3.6.7) and SHOULD be prepended to the existing header, above the
   Received: field that is generated by the SMTP receiver.  It MUST
   appear above all other Received-SPF fields in the message.

This text is still in 4408bis.

RFC 5322 makes no mentioned about forged received headers, nor does it say anything in its security section.   Why would RFC 4408 need to say anything more?

---

From: Hector Santos <[email-masked]>
Date: Thu, 30 Aug 2012 07:21:30 -0400

+1

-- 
HLS

---

From: "Murray S. Kucherawy" <[email-masked]>
Date: Thu, 30 Aug 2012 06:52:11 -0700

> RFC 5322 makes no mentioned about forged received headers, nor does it say anything in its security section.   Why would RFC 4408 need to say anything more?

Received fields are not explicitly carrying security information,
merely trace data, so RFC5322 didn't need to point this out in
Security Considerations.  However, Received-SPF and
Authentication-Results are very clearly carrying authentication
information which, if falsified, can cause end users to be deceived.

Depending on header field ordering to infer security details is
historically problematic.  One has to imagine crazy things could
happen at each hop, such as the entire header being sorted
alphabetically or even randomized.  I tried the same approach as
RFC4408 did with RFC5451 and it was deemed insufficient, which is why
the authserv-id and cleaning rules were added.  That stuff also
enables external filters to communicate results inbound in a
meaningful way.

It's also possible that a contributing factor for the above is that
many MTA implementations at the time lacked the capability to prepend
header fields apart from Received, as it was the only trace field in
use.

-MSK