Re: [secdir] SecDir review of draft-ietf-dmarc-interoperability

[Kurt Andersen <[e-mail]>]

On Tue, Jun 14, 2016 at 4:42 PM, Sean Turner <[e-mail]> wrote:

> Summary: I think it’s ready, but just wanted to check on one thing.  The
> difference between the following sentences in s1 and s4:
>
> s1:  Note that some practices which are in use at the time of this
> document may or may not be "best practices", especially as future standards
> evolve.
>
> s4: Note that these particular mechanisms may not be considered "best
> practices" and may, in some cases, violate various conventions or
> expectations.
>
> made me wonder whether the two identified sections in the security
> considerations are the only sections that contain text that "violates
> various conventions or exceptions".  I don’t want wanting to grind the
> security axe on eMail, DKIM, SPF only on what’s changed.
>

The intent in s1 is to warn that, in general, some of the approaches have
various degrees of controversy associated with them at this time.

s4 is more oriented toward the "experimental" nature of some of the
mitigation strategies which are mentioned - without wanting to call out
particular approaches as being more or less controversial. s4 falls into
the scope of the explicit "possible mitigations" section of the document,
so we thought it important to re-iterate the caution which was initially
raised in s1.

--Kurt