Subject: [dmarc-ietf] Adam Roach's Yes on draft-ietf-dmarc-eaiauth-05: (with COMMENT)

From: Adam Roach via Datatracker <[email-masked]>
Date: Tue, 09 Apr 2019 20:24:51 -0700

Adam Roach has entered the following ballot position for
draft-ietf-dmarc-eaiauth-05: Yes

When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)

Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html
for more information about IESG DISCUSS and COMMENT positions.

The document, along with other ballot positions, can be found here:
https://datatracker.ietf.org/doc/draft-ietf-dmarc-eaiauth/

----------------------------------------------------------------------
COMMENT:
----------------------------------------------------------------------

Thanks to everyone who worked on this document.

---------------------------------------------------------------------------

The i18ndir review included a number of minor issues that appear to remain
unaddressed. (To be clear, I don't assert that all of them require document
changes, but I would expect to see responses to the reviewer on these points).
I reiterate one of the more important minor comments below.

---------------------------------------------------------------------------

I agree with Benjamin's DISCUSS comment: this document needs to better
explain the consequences of the inability to match %{s} and %{l}. He talks about
it from a security perspective, but I think there's also a discussion to be had
here about whether this disadvantages users who elect to have non-ASCII
characters in their mailbox names.

I did see the response to the i18ndir review regarding the low usage of these
macros. If that is relevant to the decision to ignore the proper functioning of
these macros, then such rationale should be included in this document. Further,
if this document is breaking these macros under certain circumstances due to low
deployment, I would urge the working group to consider whether this document
should formally deprecate their use rather than relegating certain users to
second-class status.

---------------------------------------------------------------------------

§1:

>  the From: header of e-mail messages.

Nit: "...header field..."

---------------------------------------------------------------------------
§5:

>  Section 2.11 of [RFC6376] defines dkim-quoted-printable.  Its
>  definition is modified in messages with internationalized headers so
>  that non-ASCII UTF-8 characters need not be quoted.  The ABNF for
>  dkim-safe-char in those messages is replaced by the following, adding
>  non-ASCII UTF-8 characters from [RFC3629]:

Nit (twice): replace "UTF-8 characters" with either "UTF-8 byte sequences" or
"UTF-8 encoded Unicode characters".

---------------------------------------------------------------------------

§3:

>  Header names and other text intended primarily to be interpreted by

Nit: "Header field names..."

---------------------------------------------------------------------------

§5:

>  DKIM [RFC6376] specifies a message header that contains a

Nit: "...header field..."

>  of a DKIM-Signature header MUST be encoded as A-labels.  This rule is

Nit: "...header field..."

>  consistency with other headers.  (A-labels remain valid to allow a

Nit: "...header fields..."

>  in section 3.7, the hash MUST use the domain name in the format it
>  occurs in the header.

Nit: "...header field."

---

From: "John Levine" <[email-masked]>
Date: 11 Apr 2019 00:26:54 +0200

In article <[email-masked]> you write:
>explain the consequences of the inability to match %{s} and %{l}.

It has no consequences at all.  As Scott noted, it documents what the code does now.

 He talks about
>characters in their mailbox names.

I have to object here -- this is asking us to put a tutorial about SPF
into this minor update document.  Anyone who is familiar with SPF
knows that local part macros are useless and it makes no difference.

Even if they weren't useless and we we wanted to encode UTF-8 local
parts in the DNS, that doesn't work because the semantics of local
parts and of domain names and the way they are interpreted are very
different.  The obvious problem is case folding which has in the past
kind of mostly worked because the ASCII DNS case folding rule and
ASCII mail case folding conventions happen to be similar, but it goes
straight downhill from there with characters other than ASCII letters
and digits.  This has been argued to death many times, and again this
is not the place for a tutorial.

R's,
John