[dmarc-ietf] Should we encourage the use of SPF "soft include" for common platforms?
"Kurt Andersen (b)" <kboth@drkurt.com> Sat, 23 February 2019 18:07 UTC
Return-Path: <kurta@drkurt.com>
X-Original-To: dmarc@ietfa.amsl.com
Delivered-To: dmarc@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6F80212F19D for <dmarc@ietfa.amsl.com>; Sat, 23 Feb 2019 10:07:56 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2
X-Spam-Level:
X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=unavailable autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=drkurt.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ToIU34bDNfPC for <dmarc@ietfa.amsl.com>; Sat, 23 Feb 2019 10:07:54 -0800 (PST)
Received: from mail-it1-x135.google.com (mail-it1-x135.google.com [IPv6:2607:f8b0:4864:20::135]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3A0BC130DC8 for <dmarc@ietf.org>; Sat, 23 Feb 2019 10:07:54 -0800 (PST)
Received: by mail-it1-x135.google.com with SMTP id z131so7554947itf.5 for <dmarc@ietf.org>; Sat, 23 Feb 2019 10:07:54 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=drkurt.com; s=20130612; h=mime-version:from:date:message-id:subject:to:cc; bh=OxrETRP9W0S7/ucM2//IinFG/6Tl9DIFogHtWfaBGt8=; b=RL8pERAvCXrhNeVqs+2oHJ575lLtzgnYagmS6K70zYmyO9KRIVVz0XnR03M7GdMkKK xppJiRRxOCvqM8xzjxCfiHzEC0rNL3VBey1Xr0VLGVccVkdYbVqyTXnmk+hM0TWz2uwY 1vD+HIKRjUxHUcOCGyU4BDl36vq1A29mxd23g=
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:from:date:message-id:subject:to:cc; bh=OxrETRP9W0S7/ucM2//IinFG/6Tl9DIFogHtWfaBGt8=; b=r3/0BvBuSjIzjQSqJXnYAMJ7cukTfgWSjPotJmt1vLA2lOD5x3iskS/BCjkDOUd4Ye e7ed53hefVCpB9jS+LR0FBFdG3fbH+0gRR6B/YfI84/djgtEZYMWMfEpbJdA12roHCzN t/uDf9+ivx+iTI7jcfa/t7tu+UZqQrjRMBCMuSnc/hneqOLIx3f+oRk9sZ+JkcCu58rO 9lbJ9WAOWj9SNV4Dsq0+FrsDbZ5DIf9uOcTX/VLAxb4Gz8iDFiOTSABEFPOp6tu3X9E2 u9CGSbIjrrXCoNQByXqonPWy5AcCtpub2vPCeFuoZCgaAIH2ojXix1gAHrvnDODhYn1X ue0w==
X-Gm-Message-State: AHQUAubVlMC+Lz7yPLidoo9kxahSG6ZxDFlLYczpuALlL5Mp5C6gvMFn URBNhMcpvLK3W6SnAsBlKUNB+B8bP0R1oUqS/mRJyLuK
X-Google-Smtp-Source: AHgI3IbJwDd/9Ex4/FjEuSFducVUs4L2KkSKQSMhQ803l6HszyVq8cqs2KUWi6yOBaHI5jPSOs8PcVqnvS6LG7elLps=
X-Received: by 2002:a24:3c05:: with SMTP id m5mr6037961ita.78.1550945272700; Sat, 23 Feb 2019 10:07:52 -0800 (PST)
MIME-Version: 1.0
From: "Kurt Andersen (b)" <kboth@drkurt.com>
Date: Sat, 23 Feb 2019 10:07:31 -0800
Message-ID: <CABuGu1oxZvM+kf_pvE9B5LFVwr1wOrZGJDxDoGEgUqhHW9x9gQ@mail.gmail.com>
To: "dmarc@ietf.org" <dmarc@ietf.org>
Cc: spfbis@ietf.org
Content-Type: multipart/alternative; boundary="0000000000000bbbb5058293963e"
Archived-At: <https://mailarchive.ietf.org/arch/msg/dmarc/fIAxMuOXEitwEunZ5l2YYO58RRg>
Subject: [dmarc-ietf] Should we encourage the use of SPF "soft include" for common platforms?
X-BeenThere: dmarc@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: "Domain-based Message Authentication, Reporting, and Compliance \(DMARC\)" <dmarc.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/dmarc>, <mailto:dmarc-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/dmarc/>
List-Post: <mailto:dmarc@ietf.org>
List-Help: <mailto:dmarc-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/dmarc>, <mailto:dmarc-request@ietf.org?subject=subscribe>
X-List-Received-Date: Sat, 23 Feb 2019 18:07:57 -0000
With the growth of huge platforms that emit mail from the same common set of IPs (such as GSuite, O365, or large ESPs), regular SPF "include" ends up granting a DMARC pass to a lot more potential authors than most organizations would necessarily choose to grant. Instead of using the standard "(+)include:" approach, if domain owners used "?include:" as their mechanism, then that would prevent the SPF result from granting a DMARC PASS result when traffic is coming from one of these massively included platforms. It would essentially force the DMARC result to be driven only by the DKIM evaluation. Thoughts? --Kurt Andersen (I'm copying the spfbis list too because there may be folks lurking there who are not on the DMARC list)
- [dmarc-ietf] Should we encourage the use of SPF "… Kurt Andersen (b)
- Re: [dmarc-ietf] Should we encourage the use of S… Tim Wicinski
- Re: [dmarc-ietf] Should we encourage the use of S… Hector Santos
- Re: [dmarc-ietf] Should we encourage the use of S… Vladimir Dubrovin
- Re: [dmarc-ietf] Should we encourage the use of S… Kurt Andersen (b)
- Re: [dmarc-ietf] Should we encourage the use of S… Dotzero
- Re: [dmarc-ietf] Should we encourage the use of S… Hector Santos
- Re: [dmarc-ietf] [spfbis] Should we encourage the… Alessandro Vesely
- Re: [dmarc-ietf] [spfbis] Should we encourage the… Brandon Long