Subject: Re: [spfbis] #33: Marked Failed Mail Exposure

From: Arthur Thisell <[email-masked]>
Date: Sun, 9 Sep 2012 15:34:49 -0700 (PDT)

> Nevertheless, what often causes confusion with sentences like that is
> that it's not always clear whether there are other alternatives to the
> ones mentioned in the sentence.  In other words, which of the
> following does the quoted sentence mean?:

I agree, it could be made clearer.   Maybe to make Hector happy, we can use the language directly out of draft-mengwong-spf-01:

                                                MTAs, MDAs, and MUAs may
   choose to accept, classify, discard, or reject messages based on the
   result of an SPF test.

OK, even that is somewhat ambiguous since it could be argued that only certain SPF results can use certain actions.   *shrug*   I don't think we can write anything that would be absolutely clear to absolutely everyone, especially people who want to see something that isn't there.

Maybe a longer quote out of draft-spf-mengwong-spf-01 would be better:

                                             SMTP receivers may query
   sender domains using these mechanisms and decide the validity of a
   given SMTP transaction while that transaction is ongoing, even before
   any message data is passed.  Alternatively, SPF tests can be
   performed after SMTP time by an MDA or MUA.  MTAs, MDAs, and MUAs may
   choose to accept, classify, discard, or reject messages based on the
   result of an SPF test.

---

From: "Murray S. Kucherawy" <[email-masked]>
Date: Sun, 9 Sep 2012 15:47:25 -0700

>    choose to accept, classify, discard, or reject messages based on the

I'm not a fan of encouraging message authentication work being done in
MUAs.  We wrote a big appendix to RFC5451 on this topic after that
huge debate during its development.

-MSK