Re: [spfbis] New issue: 8.4. Fail: rejection is not described explicitly

[Alessandro Vesely <[e-mail]>]

On Sun 21/Apr/2013 16:53:49 +0200 Murray S. Kucherawy wrote:
> On Sun, Apr 21, 2013 at 3:26 AM, Alessandro Vesely <[e-mail]> wrote:
> 
>>> We should absolutely not discuss DMARC or other layers here.
>>
>> That's what I want to clarify.  SPF does not separate algorithm from
>> policy in the same way that DKIM is separated from ADSP.  How can DMARC
>> specify an interface to the SPF layer if SPF does not provide for one?
>
> RFC5451 is a perfectly good interface.  It works fine for OpenDMARC, for
> example.

Hm... RFC 5451 has phrases like 'if, for example, [SPF] returned as
"pass" result'.  It is not clear whether that refers to the result of
the check_host() function rather than, considering Section 4.2 "Local
Policy Enforcement", the combined result of check_host() and local
policy up to that point in the processing.

As a further example, Section 7.3 of RFC 5518 is formally ambiguous
too, because SPF could produce a "pass" result by validating the
"HELO" identity, and then VBR would be checked against a possibly
spoofed <reverse-path>.

Notwithstanding the loads of gratuitous advice we write, it seems
we're still missing crispy definitions of SPF results :-(