Re: [secdir] [spfbis] SECDIR Review of draft-ietf-spfbis-4408bis-19

["Murray S. Kucherawy" <[e-mail]>]

On Wed, Sep 11, 2013 at 6:22 AM, S Moonesamy <[e-mail]> wrote:

> I am responding to the comment about DKIM only and wait for the SPFBIS WG
> to address the other issues.
>

Was the SecDir review for this draft posted to the spfbis list?  I haven't
seen it.


>
>  The Security Considerations section is adequate for the purpose except
>> that no mention is made anywhere in the specification about DKIM and how a
>> mail receiver should interpret presence of DKIM and SPF policy at the same
>> time. This is a legitimate concern since DKIM is already a standards track
>> proposal and SPF is only now being promoted to Standards Track. Thus the
>> SPF document should address the question of dual use.
>>
>
> There was a BoF at the last IETF meeting to discuss proposals about how to
> interpret the presence of DKIM and/or SPF policy at the same time (
> http://www.ietf.org/**proceedings/87/minutes/**minutes-87-dmarc<http://www.ietf.org/proceedings/87/minutes/minutes-87-dmarc>).  The dual use can be addressed as part of the DMARC effort.
>

DKIM has no intrinsic policy component.   Are we actually talking about
ADSP here?

Assuming we are, I think the best we could do is to note that it's possible
for ADSP and SPF to yield conflicting policy results; one could be a "pass"
while the other could be a "fail", meaning the receiving MTA now has one
"reject" instruction and one "accept" instruction.  The receiving ADMD will
have to make a decision about which one ought to get precedence.

-MSK