Subject: Re: [spfbis] #33: Marked Failed Mail Exposure

From: Arthur Thisell <[email-masked]>
Date: Sat, 8 Sep 2012 08:29:04 -0700 (PDT)

> I strongly believe there is a serious underestimation of how much current 
> implementations and deployments since 2003 support the original 
> specification {...}

This discussion needs to be closed, not because insight was brought up from real-world examples, but because it brought up issues that were resolved in MARID.

---

From: Hector Santos <[email-masked]>
Date: Sat, 08 Sep 2012 21:30:51 -0400

The actual complete relevant statement was:

> I strongly believe there is a serious underestimation of how much current implementations and deployments since 2003 support the original specification "MAY REJECT" with a reject-on-fail implementation and deployment despite if is optional or not.  RFC4408 simply relaxed the semantics to make it non-normative to appease the IETF adoption process.

What was resolved and what are we referring to about 4408 resolved in 
MARID?

My point is that I believe the security issue #33 can possibly be even 
more prevalent when many early adopters and established 
implementations begin to consider and update their existing code with 
4408BIS and will find out it will not be so simple to just ACCEPT+MARK 
SPF FAILED messages.  There is a lot of considerations to be made, and 
namely what ISSUE #33 is describing.

Any reference to original specs is a operational realistic fact that 
there could be a high degree of implementators that still work with 
the original specs.  We are one of them.

Is there a suggestion here that most systems do a ACCEPT+MARK and 
stream separation for SPF failures and therefore, we are the exception 
  to the rule and this issue #33 is in fact a non-issue?

-- 
HLS