Re: [dmarc-ietf] auth-res vs. dmarc

["Murray S. Kucherawy" <[e-mail]>]

On Wed, Dec 30, 2020 at 9:16 AM Michael Thomas <[e-mail]> wrote:

> Later? How much later? Looking at the open tickets it looks you have
> about 5 more years of "later". And I would say the chairs teeing up
> tickets would be a far more efficient means of driving the process than
> shutting down discussions that will become tickets. That other thread on
> privacy should have been closed out weeks ago.
>

The alternative is to have all of those discussions open at the same time.
It's not hard to imagine a way to ensure even less progress than we're
making now.

I believe there are several separate issues:
>
> [...]
>
> 2) Auth-res process-wise is an orphan with no means of discussing it in
> any working group even though it's standards track and has issues
> requiring coordination with this working group
>

I don't understand the basis for this assertion.

There are many standards track documents that are not historic but don't
currently have a working group developing them.  I don't think of them as
orphans.  If the IETF has work to do on one of them, we either spin up a
working group to do the work, or an AD can sponsor the work, or an existing
WG can negotiate to extend its charter to cover the work.

This WG already extended RFC 7601 to become RFC 8601.  It could, in theory,
do so again.

3) The fundamental question that Ned brought up which is whether
> Auth-res is a protocol at all. If it's really just a debugging tool to
> be use by humans, it should definitely just be informational, and
> probably historic. Either Auth-res is useful and supported or not and
> should be killed
>

This is the first time I've heard that it's not useful.  If that were the
case, I wonder why it's gone through four iterations (RFC 5451, then RFC
7001, then RFC 7601, and now RFC 8601).

4) Should DMARC require a normative Authentication-Results Requirements
> section? This process-wise would solve the problem of auth-res in (2)
> and shift the specification of that normative text back to the document
> that is affected by it, letting Auth-res just be a transport vehicle so
> that it doesn't require yet another working group-less update. That is
> what we should have done from the start, but auth-res is an accident of
> history.
>

Section 6.7 of RFC 7489 recommends use of A-R.  If the WG chooses to change
that to a MUST, that seems reasonable to me.

-MSK