Re: [dmarc-ietf] Benjamin Kaduk's Discuss on draft-ietf-dmarc-rfc7601bis-04: (with DISCUSS and COMMENT)

["Murray S. Kucherawy" <[e-mail]>]

On Sun, Jan 6, 2019 at 12:27 PM Benjamin Kaduk <[e-mail]> wrote:

> > Section 2.3
> > >
> > >    body:  Information that was extracted from the body of the message.
> > > [...]
> > >       interest.  The "property" is an indication of where within the
> > >       message body the extracted content was found, and can indicate an
> > >       offset, identify a MIME part, etc.
> > >
> > > I'm not seeing where it's specified how the "property" gives an offset.
> > > I see other descriptions below about specific header fields and SMTP
> > > verbs and such, though.
> >
> >
> > That's text from the 2009 version of this work.  Those were speculative
> at
> > the time and haven't yet materialized, at least not in standardized use.
>
> Are you proposing to leave the text unchanged regardless?
>

I know the use case exists, because I wrote that text when I worked for a
company that was likely to make use of it, but it appears that hasn't
happened in the deployed universe.  So now we have a registry entry for the
"body" ptype which isn't deprecated, but possibly no live uses of it.  The
working group didn't discuss taking any action to either "fix" or bolster
this, as its focus was elsewhere (specifically the changes needed to
support the DMARC/ARC work).

I'm inclined to leave it as-is, possibly with a remark capturing what I
just said here.  If no uses of it appear before someone decides to revise
this again, we can formally deprecate it.

> Section 3
> > >
> > >    of the validity of the connection's identity using DNS.  It is
> > >    incumbent upon an agent making use of the reported "iprev" result to
> > >    understand what exactly that particular verifier is attempting to
> > >    report.
> > >
> > > Does that in practice constrain "iprev" usage to within a single ADMD?
> > >
> >
> > I would imagine so.
>
> This is just the COMMENT section, so do what you will, but I would consider
> mentioning this property of "iprev" more explicitly.
>

Actually, on second thought, it doesn't: ADMD #1 could attach an "iprev"
result that ADMD #2 could decide it trusts.  That is, sort of, the ARC
model -- you decide whose external results you're going to believe.

About to post the new version.

-MSK