[spfbis] Should we encourage the use of SPF "soft include" for common platforms?
"Kurt Andersen (b)" <kboth@drkurt.com> Sat, 23 February 2019 18:07 UTC
Return-Path: <kurta@drkurt.com>
X-Original-To: spfbis@ietfa.amsl.com
Delivered-To: spfbis@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1])
by ietfa.amsl.com (Postfix) with ESMTP id D08F3130DD6
for <spfbis@ietfa.amsl.com>; Sat, 23 Feb 2019 10:07:55 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2
X-Spam-Level:
X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9,
DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1,
HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001]
autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key)
header.d=drkurt.com
Received: from mail.ietf.org ([4.31.198.44])
by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024)
with ESMTP id lB8NUu0eOZra for <spfbis@ietfa.amsl.com>;
Sat, 23 Feb 2019 10:07:53 -0800 (PST)
Received: from mail-it1-x130.google.com (mail-it1-x130.google.com
[IPv6:2607:f8b0:4864:20::130])
(using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits))
(No client certificate requested)
by ietfa.amsl.com (Postfix) with ESMTPS id C937A12F19D
for <spfbis@ietf.org>; Sat, 23 Feb 2019 10:07:53 -0800 (PST)
Received: by mail-it1-x130.google.com with SMTP id e24so7580803itl.1
for <spfbis@ietf.org>; Sat, 23 Feb 2019 10:07:53 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=drkurt.com; s=20130612;
h=mime-version:from:date:message-id:subject:to:cc;
bh=OxrETRP9W0S7/ucM2//IinFG/6Tl9DIFogHtWfaBGt8=;
b=RL8pERAvCXrhNeVqs+2oHJ575lLtzgnYagmS6K70zYmyO9KRIVVz0XnR03M7GdMkKK
xppJiRRxOCvqM8xzjxCfiHzEC0rNL3VBey1Xr0VLGVccVkdYbVqyTXnmk+hM0TWz2uwY
1vD+HIKRjUxHUcOCGyU4BDl36vq1A29mxd23g=
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20161025;
h=x-gm-message-state:mime-version:from:date:message-id:subject:to:cc;
bh=OxrETRP9W0S7/ucM2//IinFG/6Tl9DIFogHtWfaBGt8=;
b=osZmuPUdKlt6AKLlgOpP9JtHkWIkz3HpVDDnwPdzp6/NvZTdu53NJGTF9TXWfoSkCy
QnJazpPXJBacKNxEZtrLTikMN9yhrPR9v8wR41OkZZKqozZbrPjtMKoa5jazpwH0UxeW
KTlEVExiTJY8bWNgJGLJ/kGcyn4Oc5ZwgTDcEac9s+13rHJdJrZyMvHm2x0fIEjRIUiz
pOkkaB9Qh43V9K9CRvNR2Pm8peZuaQar2XccTtXXezxEFAl621GhbiD9Gqnu8MynhHUA
dvtfUOESS0FqZIKRRF0+AcIw5vVKqQUn6NXZUVVmt3KS39WcJHrDHXH3scqy0Xa42IlT
YwiQ==
X-Gm-Message-State: AHQUAubvk7XltLct6A4OpgT9LOgP6P4HXOTdMmwz43Kw9+XC8Q4Zznwh
wyE9loFkcR1CWp45V0/+cvjLXnWbtNW6jW1aziTxOA==
X-Google-Smtp-Source: AHgI3IbJwDd/9Ex4/FjEuSFducVUs4L2KkSKQSMhQ803l6HszyVq8cqs2KUWi6yOBaHI5jPSOs8PcVqnvS6LG7elLps=
X-Received: by 2002:a24:3c05:: with SMTP id m5mr6037961ita.78.1550945272700;
Sat, 23 Feb 2019 10:07:52 -0800 (PST)
MIME-Version: 1.0
From: "Kurt Andersen (b)" <kboth@drkurt.com>
Date: Sat, 23 Feb 2019 10:07:31 -0800
Message-ID: <CABuGu1oxZvM+kf_pvE9B5LFVwr1wOrZGJDxDoGEgUqhHW9x9gQ@mail.gmail.com>
To: "dmarc@ietf.org" <dmarc@ietf.org>
Cc: spfbis@ietf.org
Content-Type: multipart/alternative; boundary="0000000000000bbbb5058293963e"
Archived-At: <https://mailarchive.ietf.org/arch/msg/spfbis/KyuFALpk3O1Dadr-JVZUo11nsVk>
Subject: [spfbis] Should we encourage the use of SPF "soft include" for
common platforms?
X-BeenThere: spfbis@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: SPFbis discussion list <spfbis.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/spfbis>,
<mailto:spfbis-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/spfbis/>
List-Post: <mailto:spfbis@ietf.org>
List-Help: <mailto:spfbis-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/spfbis>,
<mailto:spfbis-request@ietf.org?subject=subscribe>
X-List-Received-Date: Sat, 23 Feb 2019 18:07:56 -0000
With the growth of huge platforms that emit mail from the same common set of IPs (such as GSuite, O365, or large ESPs), regular SPF "include" ends up granting a DMARC pass to a lot more potential authors than most organizations would necessarily choose to grant. Instead of using the standard "(+)include:" approach, if domain owners used "?include:" as their mechanism, then that would prevent the SPF result from granting a DMARC PASS result when traffic is coming from one of these massively included platforms. It would essentially force the DMARC result to be driven only by the DKIM evaluation. Thoughts? --Kurt Andersen (I'm copying the spfbis list too because there may be folks lurking there who are not on the DMARC list)
- [spfbis] Should we encourage the use of SPF "soft… Kurt Andersen (b)
- Re: [spfbis] [dmarc-ietf] Should we encourage the… Tim Wicinski
- Re: [spfbis] [dmarc-ietf] Should we encourage the… Hector Santos
- Re: [spfbis] [dmarc-ietf] Should we encourage the… Vladimir Dubrovin
- Re: [spfbis] [dmarc-ietf] Should we encourage the… Kurt Andersen (b)
- Re: [spfbis] [dmarc-ietf] Should we encourage the… Dotzero
- Re: [spfbis] [dmarc-ietf] Should we encourage the… Hector Santos
- Re: [spfbis] Should we encourage the use of SPF "… Alessandro Vesely
- Re: [spfbis] [dmarc-ietf] Should we encourage the… Brandon Long