Subject: Re: [dmarc-ietf] Do is need a new ptype? Was Re: New authentication method, DNSWL

From: Alessandro Vesely <[email-masked]>
Date: Mon, 21 Oct 2019 16:54:34 +0200

On Wed 07/Aug/2019 17:16:29 +0200 Murray S. Kucherawy wrote:
> 
>> If the definition of ptype smtp were "a parameter of the SMTP session used
>> to relay the message" it would be perfect.  I'd propose that policy.iprev
>> be deprecated and smtp.remote-ip used instead>>
> 
> Given that RFC8601 was published just last month, it'll probably be a while
> before this happens.

Wouldn't an accepted erratum be enough to change the wording in the IANA page?

About the new ptype, a reviewer suggested to also use it to report whether the
query supported DNSSEC.  No DNSWL that I know supports it.  However, I know
some DKIM filters report that feature either as a comment or as a reason in the
dkim= methodspec.  Using the new ptype might make that clearer.  Consider:

    Authentication-Results: example.com;
      dkim=pass dns.sec=yes header.i=@example.org header.b=j5aQ3SJv

What you think?

https://tools.ietf.org/html/draft-vesely-authmethod-dnswl-11#section-2

Best
Ale
--

---

From: Tim Wicinski <[email-masked]>
Date: Mon, 21 Oct 2019 13:49:03 -0400

Alessamdro

There are a couple of different combinations of dnssec
valid/invalid/expired you would want to account for.

Tim

On Mon, Oct 21, 2019 at 10:54 AM Alessandro Vesely <[email-masked]> wrote:

> _______________________________________________
> dmarc mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/dmarc
>

---

From: Alessandro Vesely <[email-masked]>
Date: Mon, 21 Oct 2019 20:11:51 +0200

Hi Tim,

The I-D linked below provides for yes, no (not signed), or na (for not
applicable).  The expired case should perhaps map to "no"?  The lookup only
sets an AD bit...

Best
Ale

On Mon 21/Oct/2019 19:49:03 +0200 Tim Wicinski wrote:
> 
> Alessandro
> 
> There are a couple of different combinations of dnssec valid/invalid/expired
> you would want to account for. 
> 
> Tim
> 
> 
> On Mon, Oct 21, 2019 at 10:54 AM Alessandro Vesely <[email-masked]
> <mailto:[email-masked]>> wrote:
> 
>         Authentication-Results: example.com <http://example.com>;
>           dkim=pass dns.sec=yes header.i=@example.org <http://example.org>
>     header.b=j5aQ3SJv
> 
>     What you think?
> 
>     [email-masked] <mailto:[email-masked]>