Re: [spfbis] WGLC: draft-ietf-spfbis-4408bis-14

["John Levine" <[e-mail]>]

>Section 4.6.4:
>
>I imagine you're going to say that 10 is the limit imposed by most
>implementations, but shouldn't we say that there should be a finite,
>perhaps configurable limit, and operational experience has shown that 10 is
>a reasonable default?

If everyone doesn't have the same limit, an SPF check might fail at a
site with a lower limit and the identical check would succeed at one
with a higher limit.  The limit has been 10 for a long time and I
don't see any reason to change it now.

>The "Some implementations ..." sentence seems to be malformed.  I can't
>parse it.

That whole paragraph could be replaced by "the result of evaluating
check_host() with a syntactically invalid domain is undefined."

>Section 5.6:
>
>For IPv4, shouldn't the CIDR be 1*2DIGIT?  For IPv6, shouldn't the CIDR be
>1*3DIGIT?

What's wrong with 10.1.0.0/016 ?

>Section 11.3:

>Is that second bullet true?  It appears to claim that IP address spoofing
>is effectively impossible.

Ever since TCP stacks started randomizing sequence numbers in the
mid-1990s, spoofing a TCP session has been implausibly hard.  Spoofing
UDP is all too easy, but that's not what we're talking about here.

R's,
John