Re: [apps-discuss] Updating the status of SPF

[Frank Ellermann <[e-mail]>]

On 11 August 2011 19:59, Murray S. Kucherawy wrote:

> WFM so far.

Same here after figuring out that this means "works for me".  There used to
be a kind of consensus in the OpenSPF community, that any future version
(neither v=spf1 nor spf2.0/anything) shall use only DNS SPF RRs (not TXT),
and the WG should be free to say so in 4408bis if desired.

The WG should be also free to say that spf2.0/anything for "mfrom" is now
considered as obsolescete for the purposes of v=spf1, with more details
to be determined by the WG as desired.  I'd like to have it clear that
4408bis does not require or care about any spf2.0/mfrom records as noted
in RFC 4406 section 4.4 clause 3, and that 4408bis shall be interpreted
as specified in 4408bis, notably not as in RFC 4406 section 4.4 clause 4.

This issue is already covered in the RFC 4408 security considerations, and
in its IESG note at the begin, therefore 440bis should have this as clear
as possible.  An attempt to combine this proposal with Barry's concerns:

"The WG shall not try to update other RFCs, notably 4405, 4406, 4407, or
 5321/5322, but may address the spf2.0/mfrom or hypothetical spf2.0/helo
 scopes wrt 4408bis security considerations."

-Frank