Re: [spfbis] [Technical Errata Reported] RFC7208 (4082)

[Scott Kitterman <[e-mail]>]

5.7.8 talks about things like incorrect password issues. That's not the kind of authentication at work for SPF.  SPF is more strictly about authorization,  not authentication. 

This should be rejected. 

Scott K

On August 13, 2014 7:13:06 PM EDT, RFC Errata System <[e-mail]> wrote:
>The following errata report has been submitted for RFC7208,
>"Sender Policy Framework (SPF) for Authorizing Use of Domains in Email,
>Version 1".
>
>--------------------------------------
>You may review the report below and at:
>http://www.rfc-editor.org/errata_search.php?rfc=7208&eid=4082
>
>--------------------------------------
>Type: Technical
>Reported by: D. Stussy <[e-mail]>
>
>Section: 8.7
>
>Original Text
>-------------
>...  If the message is rejected during the SMTP transaction for
>this reason, the software SHOULD use an SMTP reply code of 550
>and, if supported, the 5.5.2 enhanced status code ...
>
>Corrected Text
>--------------
>...  If the message is rejected during the SMTP transaction for
>this reason, the software SHOULD use an SMTP reply code of 550
>and, if supported, the 5.7.8 enhanced status code ...
>
>Notes
>-----
>5.5.2 refers to responses where there's an SMTP COMMAND syntax error.
>5.7.8 refers to messages where authentication credentials are invalid.
>
>5.7.8 is a better description for rejecting an unauthorized message due
>to the
>application of invalid authentication credentials such as bad syntax in
>an SPF DNS record.
>
>The author of this errata notes that the IANA is showing a pending
>addition to
>the enhanced codes to add SPF-specific error code 5.7.24 (in lieu of
>5.5.2 or
>5.7.8), but currently sees no valid RFC proposing it.  The draft is
>located at:
>http://tools.ietf.org/html/draft-ietf-appsawg-email-auth-codes-07
>
>The use of 5.5.2 here is misleading since the source of the error is
>not the
>SMTP command stream.
>
>Instructions:
>-------------
>This erratum is currently posted as "Reported". If necessary, please
>use "Reply All" to discuss whether it should be verified or
>rejected. When a decision is reached, the verifying party (IESG)
>can log in to change the status and edit the report, if necessary. 
>
>--------------------------------------
>RFC7208 (draft-ietf-spfbis-4408bis-21)
>--------------------------------------
>Title               : Sender Policy Framework (SPF) for Authorizing Use
>of Domains in Email, Version 1
>Publication Date    : April 2014
>Author(s)           : S. Kitterman
>Category            : PROPOSED STANDARD
>Source              : SPF Update
>Area                : Applications
>Stream              : IETF
>Verifying Party     : IESG