IETF Logo Mail Archive

[spfbis] Should we encourage the use of SPF "soft include" for common platforms?

"Kurt Andersen (b)" <kboth@drkurt.com> Sat, 23 February 2019 18:07 UTC

Return-Path: <kurta@drkurt.com>
X-Original-To: spfbis@ietfa.amsl.com
Delivered-To: spfbis@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D08F3130DD6 for <spfbis@ietfa.amsl.com>; Sat, 23 Feb 2019 10:07:55 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2
X-Spam-Level:
X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=drkurt.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id lB8NUu0eOZra for <spfbis@ietfa.amsl.com>; Sat, 23 Feb 2019 10:07:53 -0800 (PST)
Received: from mail-it1-x130.google.com (mail-it1-x130.google.com [IPv6:2607:f8b0:4864:20::130]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C937A12F19D for <spfbis@ietf.org>; Sat, 23 Feb 2019 10:07:53 -0800 (PST)
Received: by mail-it1-x130.google.com with SMTP id e24so7580803itl.1 for <spfbis@ietf.org>; Sat, 23 Feb 2019 10:07:53 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=drkurt.com; s=20130612; h=mime-version:from:date:message-id:subject:to:cc; bh=OxrETRP9W0S7/ucM2//IinFG/6Tl9DIFogHtWfaBGt8=; b=RL8pERAvCXrhNeVqs+2oHJ575lLtzgnYagmS6K70zYmyO9KRIVVz0XnR03M7GdMkKK xppJiRRxOCvqM8xzjxCfiHzEC0rNL3VBey1Xr0VLGVccVkdYbVqyTXnmk+hM0TWz2uwY 1vD+HIKRjUxHUcOCGyU4BDl36vq1A29mxd23g=
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:from:date:message-id:subject:to:cc; bh=OxrETRP9W0S7/ucM2//IinFG/6Tl9DIFogHtWfaBGt8=; b=osZmuPUdKlt6AKLlgOpP9JtHkWIkz3HpVDDnwPdzp6/NvZTdu53NJGTF9TXWfoSkCy QnJazpPXJBacKNxEZtrLTikMN9yhrPR9v8wR41OkZZKqozZbrPjtMKoa5jazpwH0UxeW KTlEVExiTJY8bWNgJGLJ/kGcyn4Oc5ZwgTDcEac9s+13rHJdJrZyMvHm2x0fIEjRIUiz pOkkaB9Qh43V9K9CRvNR2Pm8peZuaQar2XccTtXXezxEFAl621GhbiD9Gqnu8MynhHUA dvtfUOESS0FqZIKRRF0+AcIw5vVKqQUn6NXZUVVmt3KS39WcJHrDHXH3scqy0Xa42IlT YwiQ==
X-Gm-Message-State: AHQUAubvk7XltLct6A4OpgT9LOgP6P4HXOTdMmwz43Kw9+XC8Q4Zznwh wyE9loFkcR1CWp45V0/+cvjLXnWbtNW6jW1aziTxOA==
X-Google-Smtp-Source: AHgI3IbJwDd/9Ex4/FjEuSFducVUs4L2KkSKQSMhQ803l6HszyVq8cqs2KUWi6yOBaHI5jPSOs8PcVqnvS6LG7elLps=
X-Received: by 2002:a24:3c05:: with SMTP id m5mr6037961ita.78.1550945272700; Sat, 23 Feb 2019 10:07:52 -0800 (PST)
MIME-Version: 1.0
From: "Kurt Andersen (b)" <kboth@drkurt.com>
Date: Sat, 23 Feb 2019 10:07:31 -0800
Message-ID: <CABuGu1oxZvM+kf_pvE9B5LFVwr1wOrZGJDxDoGEgUqhHW9x9gQ@mail.gmail.com>
To: "dmarc@ietf.org" <dmarc@ietf.org>
Cc: spfbis@ietf.org
Content-Type: multipart/alternative; boundary="0000000000000bbbb5058293963e"
Archived-At: <https://mailarchive.ietf.org/arch/msg/spfbis/KyuFALpk3O1Dadr-JVZUo11nsVk>
Subject: [spfbis] Should we encourage the use of SPF "soft include" for common platforms?
X-BeenThere: spfbis@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: SPFbis discussion list <spfbis.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/spfbis>, <mailto:spfbis-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/spfbis/>
List-Post: <mailto:spfbis@ietf.org>
List-Help: <mailto:spfbis-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/spfbis>, <mailto:spfbis-request@ietf.org?subject=subscribe>
X-List-Received-Date: Sat, 23 Feb 2019 18:07:56 -0000

With the growth of huge platforms that emit mail from the same common set
of IPs (such as GSuite, O365, or large ESPs), regular SPF "include" ends up
granting a DMARC pass to a lot more potential authors than most
organizations would necessarily choose to grant.

Instead of using the standard "(+)include:" approach, if domain owners used
"?include:" as their mechanism, then that would prevent the SPF result from
granting a DMARC PASS result when traffic is coming from one of these
massively included platforms. It would essentially force the DMARC result
to be driven only by the DKIM evaluation.

Thoughts?

--Kurt Andersen

(I'm copying the spfbis list too because there may be folks lurking there
who are not on the DMARC list)

v2.23.0 | Report a Bug | By Email