[secdir] SecDir review of draft-ietf-dmarc-interoperability

Sean Turner <sean@sn3rd.com> Tue, 14 June 2016 20:42 UTC

Return-Path: <sean@sn3rd.com>
X-Original-To: secdir@ietfa.amsl.com
Delivered-To: secdir@ietfa.amsl.com
Received: from localhost (localhost []) by ietfa.amsl.com (Postfix) with ESMTP id 5B76A12D8CE for <secdir@ietfa.amsl.com>; Tue, 14 Jun 2016 13:42:52 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.701
X-Spam-Status: No, score=-2.701 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=unavailable autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=sn3rd.com
Received: from mail.ietf.org ([]) by localhost (ietfa.amsl.com []) (amavisd-new, port 10024) with ESMTP id V6saXDQ00Zrf for <secdir@ietfa.amsl.com>; Tue, 14 Jun 2016 13:42:51 -0700 (PDT)
Received: from mail-vk0-x22e.google.com (mail-vk0-x22e.google.com [IPv6:2607:f8b0:400c:c05::22e]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id DB0C612D9AC for <secdir@ietf.org>; Tue, 14 Jun 2016 13:42:15 -0700 (PDT)
Received: by mail-vk0-x22e.google.com with SMTP id j2so2746925vkg.2 for <secdir@ietf.org>; Tue, 14 Jun 2016 13:42:15 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sn3rd.com; s=google; h=from:content-transfer-encoding:subject:message-id:date:to :mime-version; bh=1qA4SUoAy0KnjUVjaW0/Gfr1A9Dp6tYrblNe+DPiaDM=; b=CITsni01SNCQCExxbftIY8AMSB+QgZ+Zgof9N7HBiPVLuODUuvEutV18MOk97QI7w5 DfaiHPYn0561ptr5fhCWVAcVLiy/9OOvQ0J88rZjDb0zlsOS6y3hSdfCite10vcS7Qfq Ev8qmKA8KgmGQGklUj2HvfkwktemQHajdSWsI=
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:from:content-transfer-encoding:subject :message-id:date:to:mime-version; bh=1qA4SUoAy0KnjUVjaW0/Gfr1A9Dp6tYrblNe+DPiaDM=; b=TfDSKwi2k7deV8M52vzKM7WY1H7u6wI2M0nONlS9zq4UIyDA7UXhK0m61IY9UnLxkG gnk0eGqYLmRIFOoW6LrJaeLa4SkW4LklrD2mR0QvHVohMQPJsZO+aaPFXsMLa/mOXJsj 5mmE7ouPPDu7UELrLDKjAGCYdG/aRytFFI3iUW2pfCayKJJo8EXold5UYFIEYryTaTQ8 mO+ctSmvxt11Gi0r5YdMOmdeifXo1xSeHAnbtECDemeK+SS8z6M9srexYRoj/5r6q0c1 YJ6z7aq9t6cJtq4b7bQq3ZWc/qpxal070uDVwAccO4s/KmIEAiIEh43b9Zd2DU45HCdA SYmQ==
X-Gm-Message-State: ALyK8tJ7b5z+g+bUHR4Wsv+2vsW8HuymMhDcWZW/Qs+KnF3Lp+81WVmNzVWb79VqgOYo+Q==
X-Received: by with SMTP id 18mr10336108uau.10.1465936934841; Tue, 14 Jun 2016 13:42:14 -0700 (PDT)
Received: from ?IPv6:2620::ce0:101:adcd:b2df:6f5e:d6b0? ([2620:0:ce0:101:adcd:b2df:6f5e:d6b0]) by smtp.gmail.com with ESMTPSA id d131sm4921142vka.24.2016. (version=TLS1 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Tue, 14 Jun 2016 13:42:14 -0700 (PDT)
From: Sean Turner <sean@sn3rd.com>
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: quoted-printable
Message-Id: <6C363094-12B7-4AB4-8E14-DFBC69A1335A@sn3rd.com>
Date: Tue, 14 Jun 2016 15:42:12 -0500
To: draft-ietf-dmarc-interoperability.all@ietf.org, The IESG <iesg@ietf.org>, secdir@ietf.org
Mime-Version: 1.0 (Mac OS X Mail 9.3 \(3124\))
X-Mailer: Apple Mail (2.3124)
Archived-At: <https://mailarchive.ietf.org/arch/msg/secdir/p77c-u86MmvRbhdfF27wk38Kjus>
Subject: [secdir] SecDir review of draft-ietf-dmarc-interoperability
X-BeenThere: secdir@ietf.org
X-Mailman-Version: 2.1.17
Precedence: list
List-Id: Security Area Directorate <secdir.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/secdir>, <mailto:secdir-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/secdir/>
List-Post: <mailto:secdir@ietf.org>
List-Help: <mailto:secdir-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/secdir>, <mailto:secdir-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 14 Jun 2016 20:42:52 -0000

I have reviewed this document as part of the security directorate's ongoing effort to review all IETF documents being processed by the IESG. These comments were written primarily for the benefit of the security area directors.  Document editors and WG chairs should treat these comments just like any other last call comments.

This informational draft describes interoperability issues between DMARC and indirect email flows as well as possible methods for addressing these interoperability issues.  Indirect email flows are messages that do not flow directly from the author's administrative domain to the final recipient(s).

Summary: I think it’s ready, but just wanted to check on one thing.  The difference between the following sentences in s1 and s4:

s1:  Note that some practices which are in use at the time of this document may or may not be "best practices", especially as future standards evolve.

s4: Note that these particular mechanisms may not be considered "best practices" and may, in some cases, violate various conventions or expectations.

made me wonder whether the two identified sections in the security considerations are the only sections that contain text that "violates various conventions or exceptions".  I don’t want wanting to grind the security axe on eMail, DKIM, SPF only on what’s changed.

Ramblings follow:


Appreciate that this wasn’t trying to be passed off as a BCP and that there’s no 2119-language.

Appreciate your examples using TLS1.2 and at-this-time-known-to-be-good algorithms.


s1 2nd para could probably be deleted.  It sounds a lot like marketing to me :)


I found some.  Peter found way more so look for his GenArt review.