Re: [secdir] [spfbis] SECDIR Review of draft-ietf-spfbis-4408bis-19

[Dotzero <[e-mail]>]

On Wed, Sep 11, 2013 at 9:43 AM, Murray S. Kucherawy
<[e-mail]> wrote:
> On Wed, Sep 11, 2013 at 6:22 AM, S Moonesamy <[e-mail]> wrote:
>>
>> I am responding to the comment about DKIM only and wait for the SPFBIS WG
>> to address the other issues.
>
>
> Was the SecDir review for this draft posted to the spfbis list?  I haven't
> seen it.
>
>>
>>
>>> The Security Considerations section is adequate for the purpose except
>>> that no mention is made anywhere in the specification about DKIM and how a
>>> mail receiver should interpret presence of DKIM and SPF policy at the same
>>> time. This is a legitimate concern since DKIM is already a standards track
>>> proposal and SPF is only now being promoted to Standards Track. Thus the SPF
>>> document should address the question of dual use.
>>
>>
>> There was a BoF at the last IETF meeting to discuss proposals about how to
>> interpret the presence of DKIM and/or SPF policy at the same time (
>> http://www.ietf.org/proceedings/87/minutes/minutes-87-dmarc ).  The dual use
>> can be addressed as part of the DMARC effort.
>
>
> DKIM has no intrinsic policy component.   Are we actually talking about ADSP
> here?
>
> Assuming we are, I think the best we could do is to note that it's possible
> for ADSP and SPF to yield conflicting policy results; one could be a "pass"
> while the other could be a "fail", meaning the receiving MTA now has one
> "reject" instruction and one "accept" instruction.  The receiving ADMD will
> have to make a decision about which one ought to get precedence.
>
>

ADSP should be relegated to historical. Very little implementation on
the publishing side and even less validation on the receiving side. We
(all of the usual suspects in this space) made compromises to get it
out the door and we collectively got it wrong.

Having said that, I could live with some kind of note in the SPFbis
doc along the lines of what Murray suggests.

Mike