Re: [dnsext] SPF, a cautionary tale

["Murray S. Kucherawy" <[e-mail]>]

On Sun, May 5, 2013 at 1:53 AM, <[e-mail]> wrote:

> > If you're saying that the author of RFC 6686 is lying about the data he
> > presents, including 400,000 domains that publish TXT SPF records and the
> > few thousand that publish type 99, I'll pass the message along.
>
>         I'm saying that your claim of millions of messages is flawed.
>         No as to the claims for RFC 6686, I'll be happy to take those
> numbers
>         at face value. (but, yeah, pass my concerns along)
>         402,000 domains using SPF is barely statistically relevent,
> considering
>         there are over 350 million domains in existance.  just over 1%.
>

Isn't "domains that appear to be sending mail" a more useful universe from
which to sample than "registered domains"?

        apparently no one in the spfbis wg bothered to read
> http://tools.ietf.org/html/rfc5507
>         and there is no time limit to the choice of a good idea v. a bad
> idea.
>         a bad idea can and should be questioned at any time - there is no
>         "its too late" arguemnt that should hold, particularly when there
> is
>         roughly 1% penetration of the service against the number of
> existing domains.
>

I'm an existence proof that your claim is false.  I've read RFC5507 and I'm
familiar with its contents.  I've already said that, were we writing this
anew, I think we'd likely be taking a different path here, one that would
make the members of dnsext much happier.  But since the former is false,
and there's a substantial deployed base much of which is unlikely to change
its behaviour for various reasons, we have to look at this a different way.


>
> > Despite what the fantasists in dnsext imagine, there is no chance
> > whatsoever of getting those hundreds of thousands of existing mail
> systems
> > to change the way they publish and check SPF data, particularly a change
> > that has less than no operational benefit.  (Don't argue unless you know
> > more people who run large mail systems than I do, and I meet pretty much
> > all of them at MAAWG meetings.)  The only recent changes I can think of
> > are that Yahoo used to check both TXT and type 99 and now only checks
> TXT,
> > and Micsosoft mail properties including Hotmail gave up on Sender ID and
> > just check SPF.
>
>         my what a pessemistic/fatalistic attitude you have there.
>         and again with your unsupported assertions.
>

His pessimism is founded in reality.  I have similar contact with the same
people, and I reach the same conclusion.

-MSK