Subject: Re: [secdir] [spfbis] SECDIR Review of draft-ietf-spfbis-4408bis-19
From: "Murray S. Kucherawy" <[email-masked]>
To: S Moonesamy <[email-masked]>
Cc: "[email-masked]" <[email-masked]>, [email-masked], The IESG <[email-masked]>, "[email-masked]" <[email-masked]>
Date: Wed, 11 Sep 2013 06:43:54 -0700
List-Id: Security Area Directorate <secdir.ietf.org>

On Wed, Sep 11, 2013 at 6:22 AM, S Moonesamy <[email-masked]> wrote:

> I am responding to the comment about DKIM only and wait for the SPFBIS WG
> to address the other issues.
>

Was the SecDir review for this draft posted to the spfbis list?  I haven't
seen it.

>
>  The Security Considerations section is adequate for the purpose except
>> that no mention is made anywhere in the specification about DKIM and how a
>> mail receiver should interpret presence of DKIM and SPF policy at the same
>> time. This is a legitimate concern since DKIM is already a standards track
>> proposal and SPF is only now being promoted to Standards Track. Thus the
>> SPF document should address the question of dual use.
>>
>
> There was a BoF at the last IETF meeting to discuss proposals about how to
> interpret the presence of DKIM and/or SPF policy at the same time (
> http://www.ietf.org/**proceedings/87/minutes/**minutes-87-dmarc<http://www.ietf.org/proceedings/87/minutes/minutes-87-dmarc>).  The dual use can be addressed as part of the DMARC effort.
>

DKIM has no intrinsic policy component.   Are we actually talking about
ADSP here?

Assuming we are, I think the best we could do is to note that it's possible
for ADSP and SPF to yield conflicting policy results; one could be a "pass"
while the other could be a "fail", meaning the receiving MTA now has one
"reject" instruction and one "accept" instruction.  The receiving ADMD will
have to make a decision about which one ought to get precedence.

-MSK