Re: [spfbis] WG Review: SPF Update (spfbis)

+1, work out the current SPF spec issues, codify the spec, based on 
the 9 IETF-MAN/VENDOR-YEARS history.

We need to keep in mind that back during MARID it was clearly 
envisioned that new PAYLOAD technologies will come and we always knew 
there would be a need to couple or augment the technologies.   That is 
why a few of use considered a SMTP extension called HEAD to allow a 
sender to send the RFC5322 header first.

But the principle reason why MARID started was because of the 2003 
SORBIG world wide eVirus attacks which exploited 100% the SMTP relaxed 
nature of MAIL FROM checking and used the ACCEPT/BOUNCE requirement at 
a two prone attempt to deliver the payload:

     1st the RCPT TO,
     2nd the MAIL FROM during the bounce.

So a key goal was to avoid any payload download which the original SPF 
clone CEP by Microsoft was promoting (changed to SENDER-ID).

The compromise was the SUBMITTER protocol which was a SMTP extension 
to pass the PRA as a MAIL FROM keyword.

     MAIL FROM: <id @ SENDER-DOMAIN.COM> SUBMITTER=user@AUTHOR-DOMAIN.COM

If the goal of this SCOPE= idea is to serve the same purpose, then we 
already have the SUBMITTER protocol and its definitely in use.

-- 
Hector Santos, CTO
http://www.santronics.com
http://santronics.blogspot.com

SM wrote:
> At 09:18 20-12-2011, IESG Secretary wrote:
>> Changes to the SPF specification will be limited to the correction
>> of errors, removal of unused features, addition of any enhancements
>> that have already gained widespread support, and addition of
>> clarifying language.
>>
>> The working group will also produce a document describing the
>> course of the SPF/Sender-ID experiment (defined in the IESG note
>> on the RFCs in question), bringing that experiment to a formal
>> conclusion.  No other work on Sender-ID will be done.
>>
>> Finally, the working group will develop the proposed "scope"
>> extension found in draft-mehnle-spfbis-scope.
> 
> The first two work items will generate their share of controversies.  I 
> suggest removing the "scope" document from the list of work items to 
> restrict the scope of the controversies at the initial stage.  Once the 
> proposed working group has produced the deliverables that can bring 
> closure to the SPF/Sender-ID debates, it can determine whether there are 
> still any surviving WG participants to pursue work on extensions to 
> 4408bis.
> 
>> The initial draft set:
>>         draft-kitterman-4408bis
>>         draft-mehnle-spfbis-scope
> 
> That should be:
> 
>   draft-kitterman-4408bis-00
>   draft-mehnle-spfbis-scope-00
> 
> Regards,
> -sm
> _______________________________________________
> spfbis mailing list
> spfbis@ietf.org
> https://www.ietf.org/mailman/listinfo/spfbis
> 
> 