Re: [secdir] SECDIR Review of draft-ietf-spfbis-4408bis-19

[S Moonesamy <[e-mail]>]

Hi Phillip,

I am responding to the comment about DKIM only and wait for the 
SPFBIS WG to address the other issues.

At 05:07 11-09-2013, Phillip Hallam-Baker wrote:
>I have reviewed this document as part of the security directorate's
>ongoing effort to review all IETF documents being processed by the
>IESG.  Document editors and WG chairs should treat these comments just
>like any other last call comments.
>
>The document has been produced as part of a proposal to upgrade SPF 
>to standards track recognizing the state of deployment experience.
>
>Minor issues.
>
>1.1.3.  MAIL FROM Definition
>
>I found this section completely opaque and very confusing. It should 
>not be necessary to hunt through other specs to find a definition. 
>Particularly since the referenced specs do not give an explicit 
>definition for the term as used and the references point to the 
>whole spec rather than a particular section.

I am commenting on the following paragraph only:

>The Security Considerations section is adequate for the purpose 
>except that no mention is made anywhere in the specification about 
>DKIM and how a mail receiver should interpret presence of DKIM and 
>SPF policy at the same time. This is a legitimate concern since DKIM 
>is already a standards track proposal and SPF is only now being 
>promoted to Standards Track. Thus the SPF document should address 
>the question of dual use.

There was a BoF at the last IETF meeting to discuss proposals about 
how to interpret the presence of DKIM and/or SPF policy at the same 
time ( http://www.ietf.org/proceedings/87/minutes/minutes-87-dmarc 
).  The dual use can be addressed as part of the DMARC effort.

>8.7.  Permerror
>
>"
>
>This signals an error condition that
>
>    definitely requires operator intervention to be resolved."
>
>I cannot imagine a circumstance which definitely requires a human to 
>be involved in mail delivery.
>
>
>11.2.  SPF-Authorized Email May Contain Other False Identities
>
>    Do not construe the "MAIL FROM" and "HELO" identity authorizations to
>    provide more assurance than they do.
>
>Document has quasi normative language that should be worded as 
>statements of fact rather than as direction.
>
>--
>Website: http://hallambaker.com/