Re: [marf] Including Mail fields in IODEF

Alessandro Vesely <> Sun, 24 February 2013 13:56 UTC

Return-Path: <>
Received: from localhost (localhost []) by (Postfix) with ESMTP id C8BD321F8FF7; Sun, 24 Feb 2013 05:56:46 -0800 (PST)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: -4.529
X-Spam-Status: No, score=-4.529 tagged_above=-999 required=5 tests=[AWL=0.190, BAYES_00=-2.599, HELO_EQ_IT=0.635, HOST_EQ_IT=1.245, RCVD_IN_DNSWL_MED=-4]
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id CQJJ8rU5rhXf; Sun, 24 Feb 2013 05:56:46 -0800 (PST)
Received: from ( []) by (Postfix) with ESMTP id A588221F8FEC; Sun, 24 Feb 2013 05:56:45 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;; s=beta; t=1361714203; bh=VZw3M738BwZQh/SHY4AHA7G6ptV2LNHmaohutLVd80o=; l=768; h=Date:From:To:CC:References:In-Reply-To; b=eT59g/M2TeI0gZokgDbcK7TVuWpO9utCG9vRGYLL66uYs0GY0YKDGisYVFyC5HwRJ vK14cvAqWTpwROK7oT31Zr1Eusfiik9ZouFsfXsTru2/MEo2eKRRXWElRqZY4if02p ZN4qCscg6eb8qqRAnXdIhqzp3RxHtfQquWYQRPJ0=
Received: from [] (pcale.tana []) (AUTH: CRAM-MD5 uXDGrn@SYT0/k, TLS: TLSv1/SSLv3,256bits,AES256-SHA) by with ESMTPSA; Sun, 24 Feb 2013 14:56:43 +0100 id 00000000005DC039.00000000512A1C1B.00002764
Message-ID: <>
Date: Sun, 24 Feb 2013 14:56:43 +0100
From: Alessandro Vesely <>
User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:17.0) Gecko/20130215 Thunderbird/17.0.3
MIME-Version: 1.0
To: "Moriarty, Kathleen" <>
References: <>, <> <>
In-Reply-To: <>
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Cc: Managed Incident Lightweight Exchange IODEF extensions and RID exchanges <>, "" <>
Subject: Re: [marf] Including Mail fields in IODEF
X-Mailman-Version: 2.1.12
Precedence: list
List-Id: Message Abuse Report Format working group discussion list <>
List-Unsubscribe: <>, <>
List-Archive: <>
List-Post: <>
List-Help: <>
List-Subscribe: <>, <>
X-List-Received-Date: Sun, 24 Feb 2013 13:56:46 -0000

Hi Kathleen,

On Thu 21/Feb/2013 11:19:11 +0100 Moriarty, Kathleen wrote:
> Cross posting with MAIL and MARF - 

Hey, I never realized that meaning of pronouncing "mile", otherwise I
wouldn't have unsubscribed :-)

> There was a draft published last year (link included below) that
> includes MARF in an IODEF extension.

Yeah, that slavishly translated and ARF mail into XML.  Its only
practical trait is to represent header fields with a lowercase name,
for example:

 <arf:Field name="x-mailer">QUALCOMM Windows Eudora</arf:Field>

That kind of thing can be useful to get a value quickly; that is,
while parsing the XML.  If the alternative is to extract the whole
message (or header) and then parse that in turn, it might be worth to
have it.