Subject: [apps-discuss] Comments on draft-ietf-appsawg-email-auth-codes-01

From: Alexey Melnikov <[email-masked]>
Date: Sat, 31 May 2014 18:05:53 +0100

Hi Murray,
I've checked the IANA registry and your new X.7.19 enhanced status code seem to conflict with the RRVS one from your other recently approved document.

Other comments:

Description of DKIM codes: do they cover lack of any DKIM signature or only cases when DKIM signatures are present, but don't verify or cover wrong domains?

In section "2.3. Reverse DNS Failure Code" - you point to one section of RFC 7001, which internally points to another section inside RFC 7001. Maybe it would be better to point to the latter section directly?

I am not convinced about the "multiple failures" status code, but then it provides more information than X.7.0, so it is probably Ok.

Other than that I think the document is serving a useful purpose, so I support its advancement.

Best Regards,
Alexey

---

From: "Murray S. Kucherawy" <[email-masked]>
Date: Sat, 31 May 2014 23:39:51 -0700

On Sat, May 31, 2014 at 10:05 AM, Alexey Melnikov <[email-masked]
> wrote:

> I've checked the IANA registry and your new X.7.19 enhanced status code
> seem to conflict with the RRVS one from your other recently approved
> document.
>

Quite right.  Serves me right for having several things on the go.  :-)
Fixed for -02.

> Other comments:
>
> Description of DKIM codes: do they cover lack of any DKIM signature or
> only cases when DKIM signatures are present, but don't verify or cover
> wrong domains?
>

The DKIM specification says that an unsigned message is to be treated no
differently than one with a signature that failed to verify.  I also don't
know of any receivers that only care that there was a valid signature
regardless of the domain that added it, so that doesn't seem to be a use
case we need to worry about.

> In section "2.3. Reverse DNS Failure Code" - you point to one section of
> RFC 7001, which internally points to another section inside RFC 7001. Maybe
> it would be better to point to the latter section directly?
>

That idea is probably better for this case, yes.  Updated for -02.

> I am not convinced about the "multiple failures" status code, but then it
> provides more information than X.7.0, so it is probably Ok.
>

The reason that was suggested (by Barry, I believe) is that a message might
be rejected for multiple authentication failures, yet you can only return a
single code.  However, let's say you always expect SPF to fail, but DKIM
should always pass.  Reporting an SPF failure is useless there; providing
the less specific response in that case is actually more useful.

> Other than that I think the document is serving a useful purpose, so I

Thanks for the review!

-MSK