Re: [secdir] [spfbis] SECDIR Review of draft-ietf-spfbis-4408bis-19

[Dave Crocker <[e-mail]>]

On 9/11/2013 6:22 AM, S Moonesamy wrote:
> I am commenting on the following paragraph only:
>
>> The Security Considerations section is adequate for the purpose except
>> that no mention is made anywhere in the specification about DKIM and
>> how a mail receiver should interpret presence of DKIM and SPF policy
>> at the same time. This is a legitimate concern since DKIM is already a
>> standards track proposal and SPF is only now being promoted to
>> Standards Track. Thus the SPF document should address the question of
>> dual use.
>
> There was a BoF at the last IETF meeting to discuss proposals about how
> to interpret the presence of DKIM and/or SPF policy at the same time (
> http://www.ietf.org/proceedings/87/minutes/minutes-87-dmarc ).  The dual
> use can be addressed as part of the DMARC effort.


At the level of a fully-integrated email anti-abuse system, concern 
about possible SPF and DKIM presence and interaction effects is, of 
course, essential.

However SPF is only a component technology.  It's specification is not 
the place for discussing higher-level interaction effects.

By way of example, imagine the specification for an automobile tire 
being expected to talk about design and operations issues when the tire 
is linked to 3 siblings and a suspension system, and a motor and... 
That's an important topic, but the tire spec is wrong venue.

d/


-- 
Dave Crocker
Brandenburg InternetWorking
bbiw.net