Subject: [spfbis] Fwd: Re: Ticket #47 domain-spec

From: Scott Kitterman <[email-masked]>
Date: Wed, 06 Feb 2013 01:37:33 -0500

Resending to the list as it doesn't look like the list copy ever arrived.

Scott K
----------  Forwarded Message  ----------

Subject: Re: [spfbis] Ticket #47 domain-spec
Date: Wednesday, February 06, 2013, 12:56:03 AM
From: Stuart Gathman <[email-masked]>
To: [email-masked]
CC: [email-masked]

Resent because ietf.org is ignoring my emails for some reason (no 
confirmation requests sent).

On 02/05/2013 11:16 PM, Stuart Gathman wrote:
> On 02/05/2013 04:34 PM, Murray S. Kucherawy wrote:
>> Feel free to point me at previous discussion, but why "(even when the 
>> connection type is IPv6)"?
> Because that is what rfc4408 says.   The A and MX mechanisms look for 
> A or AAAA RRs depending on the
> connection type.  EXISTS, on the other hand, always looks only for A 
> records.  That was perfectly clear.
>
> The ambiguity is what to do when there is a DNS error.  For other 
> mechanisms, a temperror would result, and
> lacking any further specification, you could assume the same for 
> exists.  However EXISTS is special, and given its intended usage,
> a temperror is not as helpful (and maybe you could argue that if the 
> DNS service is unavailable, the RR doesn't "exist" - or maybe that the 
> record is in a superposition of "exists" and "not exists" until it is 
> able to be observed).
>
I added a test to the test suite that allows either interpretation for 
now.

After mulling it over, I am on the side of sticking with temperror. 
But I won't be alarmed if spfbis decides to go with nomatch.  That 
would just nudge applications away from advanced filtering (which 
typically involve localpart which is problematic in itself), and more 
toward logging.

-----------------------------------------

---

From: Scott Kitterman <[email-masked]>
Date: Sun, 10 Feb 2013 01:34:15 -0500

Here's what I decided to commit locally for -11:

>           The domain-spec is expanded as per <xref target="macros"/>. The
>           resulting domain name is used for a DNS A RR lookup (even when the
>           connection type is IPv6). If any A record is returned, this
>           mechanism matches.

I believe that's sufficient.  It preserves the normal processing for DNS error 
to generate a temperror.  It's also shorter.

Scott K

> _______________________________________________
> spfbis mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/spfbis