Subject: Re: [spfbis] Last Call: <draft-ietf-spfbis-4408bis-19.txt> (Sender Policy Framework (SPF) for Authorizing Use of Domains in Email, Version 1) to Proposed Standard

From: S Moonesamy <[email-masked]>
Date: Mon, 26 Aug 2013 19:40:29 -0700

Hello,
At 13:07 23-08-2013, Douglas Otis wrote:
>4.6.4.  DNS Lookup Limits
>
>Was:
>,--
>SPF implementations MUST limit the total number of mechanisms and
>modifiers ("terms") that cause any DNS query to 10 during SPF
>evaluation.
>'--
>
>Change to:
>,---
>SPF evaluation must limit the number of mechanisms, and the modifier
>term 'redirect' to occur in no more than10 instances within the
>evaluation process.  The mechanisms 'ip4', ip6', and 'all' are
>excluded from this instance limitation.  Each mechanism is permitted
>to resolve subsequent resource record sets (RRsets) that MUST not
>contain more than 10 resource records to complete a match check.
>When the number of instances exceeds 10, or when subsequent
>resolutions exceeds 10, check_host() MUST produce a "permerror"
>result.
>
>The maximum number of DNS transactions initiated by an SPF
>evaluation is therefore 1 for the initial SPF resource record, 10 for
>each mechanism times 10 transactions needed to complete a matching
>process for a total of 111 DNS transactions.  This number excludes
>those required by DNS to fulfill a request and those required by an
>EXP modifier.

Can the working group address the above comments?

Thanks,
S. Moonesamy (as document shepherd)

---

From: Scott Kitterman <[email-masked]>
Date: Mon, 26 Aug 2013 23:04:33 -0400

> Can the working group address the above comments?

We worked through the language of that section closely in the WG to try and 
make it more comprehensible while retaining correctness.  I don't find the 
proposed text an improvement over the working group's effort.

Scott K

---

From: Dave Crocker <[email-masked]>
Date: Mon, 26 Aug 2013 20:21:00 -0700

On 8/26/2013 8:04 PM, Scott Kitterman wrote:
>   I don't find the

I'll in fact suggest that any proposed text change needs to be based on 
specific assertions of needs and benefits that have gotten rough 
consensus, prior to worrying about the wording.

Get agreement on the nature of the problem with the current text, before 
haggling over how it's fixed.

I haven't seen any of the foundational work that might justify making a 
change.

d/

-- 
Dave Crocker
Brandenburg InternetWorking
bbiw.net

---

From: S Moonesamy <[email-masked]>
Date: Mon, 26 Aug 2013 21:13:23 -0700

Hi Dave, Scott,

The comments are at 
http://www.ietf.org/mail-archive/web/ietf/current/msg81811.html

The comment which I should have included is:

   "Section 4.6.4 fails to offer a sufficiently clear warning about potential
    magnitudes of DNS transactions initiated by a single SPF evaluation where
    two are recommended to occur one for the separate identifiers.  In fact,
    this section appears to make assurances no more that 10 DNS queries will
    result and is widely misunderstood."

There wasn't any response to this on the Last Call thread.

Regards,

---

From: Scott Kitterman <[email-masked]>
Date: Tue, 27 Aug 2013 00:17:59 -0400

On Monday, August 26, 2013 21:13:23 S Moonesamy wrote:
>    "Section 4.6.4 fails to offer a sufficiently clear warning about
> potential magnitudes of DNS transactions initiated by a single SPF
> evaluation where two are recommended to occur one for the separate
> identifiers.  In fact, this section appears to make assurances no more that
> 10 DNS queries will result and is widely misunderstood."
> 

It's wrong (the comment).

Now you have a response.

Scott K

P.S. If you gather I'm getting tired of dealing with the same comments over 
and over again, I am.

---

From: Dave Crocker <[email-masked]>
Date: Mon, 26 Aug 2013 22:02:04 -0700

> There wasn't any response to this on the Last Call thread.

Exactly my point...

d/