Subject: [spfbis] Summary for upgrades from RFC 4408

From: Scott Kitterman <[email-masked]>
Date: Wed, 27 Mar 2013 00:01:42 -0400

After I uploaded the last revision, I remembered that we said we would include 
a short section on technical changes from RFC 4408 when we were deciding on 
the document reorganization.  Here's a first cut at it.  I expect this will be 
another appendix.  I was thinking right after the examples (this would then 
become Appendix C).  Please suggest a better title.

Appendix C.  Changes in implementation requirements from RFC 4408

 - Use of DNS RR type SPF (99) has been removed from the protocol [RFC 6686].

 - A new DNS related processing limit based on "void lookups" has been added 
[section 4.6.4].

 - A new option for converting repeated DNS SERVFAIL responses from temperror 
to permerror as been added [section 2.6.6].

 - Use of the ptr mechanism and the %p macro have been strongly discouraged 
[section 5.5] and [section 7.2].  They remain part of the protocol, but 
records ought to be updated to avoid them.

 - Use of the Authentication Results header field [RFC 5451] as a possible 
alternative to use of the Received-SPF header field is discussed [section 9.2].

 - There have been a number of minor corrections to the ABNF to make it more 
clear and correct [Appendix A].  SPF library implementers should give the 
revised ABNF a careful review to determine if implementation changes are 
needed.

 - Use of X- fields in the ABNF has been removed [RFC 6648].

 - Ambiguity about how to deal invalid domain-spec after macro expansion has 
been documented.  Depending on one specific behavior has to be avoided [section 
4.8].

 - General operational information has been updated and expanded based on 8 
years of post [RFC 4408] operations experience [section 10] and Appendices D - 
H.

 - Security considerations have been reviewed and updated [section 11].

What did I miss?  What should be worded better?

Scott K

---

From: Scott Kitterman <[email-masked]>
Date: Sun, 31 Mar 2013 17:30:25 -0400

On Wednesday, March 27, 2013 12:01:42 AM Scott Kitterman wrote:
> After I uploaded the last revision, I remembered that we said we would
> include a short section on technical changes from RFC 4408 when we were
> deciding on the document reorganization.  Here's a first cut at it.  I
> expect this will be another appendix.  I was thinking right after the
> examples (this would then become Appendix C).  Please suggest a better
> title.
> 
>  - A new option for converting repeated DNS SERVFAIL responses from
> temperror to permerror as been added [section 2.6.6].
> 
> been documented.  Depending on one specific behavior has to be avoided
> [section 4.8].
> 
> years of post [RFC 4408] operations experience [section 10] and Appendices D
> - H.
> 

I have not gotten much in the way of feedback on this and I think it's 
important to get right.  I'd appreciate if anyone else has reviewed the 
proposed text and finds it OK, they say so.  I'm somewhat reluctant to commit 
it to 4408bis without that.

This is all I'm waiting on before publishing -14 and telling the chairs I 
think we're ready for WGLC.

Scott K

---

From: "Murray S. Kucherawy" <[email-masked]>
Date: Sun, 31 Mar 2013 15:40:07 -0700

> > Appendix C.  Changes in implementation requirements from RFC 4408

I would add a note at the top of the section that indicates the changes are
all either (a) corrections to errors in 4408, or (b) additional
documentation based on consensus of operational experience acquired since
publication of 4408.  Otherwise, a reviewer might wonder what the basis of
some or all of these might be.

> > records ought to be updated to avoid them.

"...because they were found to still be in use..."

> > alternative to use of the Received-SPF header field is discussed [section
> > 9.2]
>

"Authentication-Results"

> > been documented.  Depending on one specific behavior has to be avoided

"...deal with..."

-MSK