Subject: [spfbis] Proof of non-deployment [[email-masked]: Cron <root@primary> /usr/local/libexec/spf-txt.sh]

From: Måns Nilsson <[email-masked]>
Date: Tue, 7 Oct 2014 08:37:38 +0200

Since only 14.82 percent of the combined TXT||SPF queries received by my
authoritative master are SPF we must surely congratulate the SPF working
group in being correct by determining that there are impassable barriers
to deplying new RR types on the Internet. Only 1 in 7 queries  --
clearly a minority -- are for this new, unusable RR type.

----- Forwarded message from Cron Daemon <[email-masked]> -----

Date: Mon, 6 Oct 2014 22:27:09 GMT
From: Cron Daemon <[email-masked]>
To: [email-masked]
Subject: Cron <root@primary> /usr/local/libexec/spf-txt.sh

TXT:12065	SPF:2100

----- End forwarded message -----

-- 
Måns Nilsson     primary/secondary/besserwisser/machina
MN-1334-RIPE                             +46 705 989668
Everybody gets free BORSCHT!

---

From: Andrew Sullivan <[email-masked]>
Date: Tue, 7 Oct 2014 06:07:25 -0400

It's always fun to be sarcastic, but you seem to be missing a point.  

The WG did not decide to deprecate the type for fun.  The problem was that there was a bug in the original RFC: the way the TXT and TYPE99 RRtype use was specified, it was possible for two implementations to be fully conforming without being able to interoperate. So we had to make an incompatible change of some kind, and given the empirical evidence we had the WG decided that picking only one was safest.  TXT remains the overwhelming leader, so it won.  

A

-- 
Andrew Sullivan 
Please excuse my clumbsy thums. 

> On Oct 7, 2014, at 2:37, Måns Nilsson <[email-masked]> wrote:
> 
> _______________________________________________
> spfbis mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/spfbis

---

From: S Moonesamy <[email-masked]>
Date: Tue, 07 Oct 2014 07:31:09 -0700

Hello,
>clearly a minority -- are for this new, unusable RR type.

The following is from the write-up:

    "There was an intermediate conclusion about the topic of whether the SPF
     protocol should use the SPF RRTYPE or the TXT resource record.  It was
     followed by an objection.  After discussion of the topic at the IETF 83
     SPFBIS WG session the conclusion reached was that the decision would be
     not to publish RRTYPE 99 and and not to query RRTYPE 99.  The WG
     consensus about the RRTYPE can be described as particularly rough.  The
     topic of obsoleting the SPF RRTYPE generated a lot of controversy near
     the end of the WGLC.  There were a very high number of messages about
     the topic on the SPFBIS mailing list and the DNSEXT mailing list as some
     DNSEXT WG participants were not aware of RFC 6686."

The decision about which RR type to choose was not about one of them 
being clearly a minority.  I went through the discussions about the 
RR Type several times.  I also did that after the decision was taken 
to see whether it was the wrong choice.  A choice had to be made.  I 
am okay with being criticized for that choice.

Regards,
S. Moonesamy

---

From: "Murray S. Kucherawy" <[email-masked]>
Date: Tue, 7 Oct 2014 09:15:49 -0700

On Tue, Oct 7, 2014 at 3:07 AM, Andrew Sullivan <[email-masked]>
wrote:

> The WG did not decide to deprecate the type for fun.  The problem was that
> there was a bug in the original RFC: the way the TXT and TYPE99 RRtype use
> was specified, it was possible for two implementations to be fully
> conforming without being able to interoperate. So we had to make an
> incompatible change of some kind, and given the empirical evidence we had
> the WG decided that picking only one was safest.  TXT remains the
> overwhelming leader, so it won.
>

Given the survey work recorded in RFC6686, I would be curious to hear
people's theories explaining the substantial uptick of TYPE99 queries in
the last two years while the industry has actually gone in the opposite
direction.  Of course, that presumes there's ample breadth and no bias in
the traffic seen by this one resolver.

-MSK

---

From: Andrew Sullivan <[email-masked]>
Date: Tue, 7 Oct 2014 12:42:21 -0400

> the traffic seen by this one resolver.

We had methodological issues at the time of RFC 6686, too, so I think
we ought to be careful about speculating too much.

But I seem to recall someone telling us, right around the time of
6686, that some new SPF checking code had just shipped that used
TYPE99 as the default.  This news came too late in the publication
cycle to change the text.  But it shouldn't be surprising that we see
this now.

None of that matters, however, because the original RFC had that
interoperability bug in it, and the only reasonable thing to do was to
pick one type to look up.  I'm unhappy about using TXT, too, and
registered that unhappiness at the time.  But the deployed code is a
strong argument.

A

-- 
Andrew Sullivan
[email-masked]

---

From: Scott Rose <[email-masked]>
Date: Tue, 7 Oct 2014 14:03:22 -0400

On Oct 7, 2014, at 12:15 PM, Murray S. Kucherawy <[email-masked]> wrote:

> Given the survey work recorded in RFC6686, I would be curious to hear people's theories explaining the substantial uptick of TYPE99 queries in the last two years while the industry has actually gone in the opposite direction.  Of course, that presumes there's ample breadth and no bias in the traffic seen by this one resolver.
> 

I know there has been a push to deploy SPF and DKIM in the .gov TLD, so that may be some of the uptick.  From past experience, I would wager most enterprises are using older, already deployed code that does queries for both TYPE99 and TXT RR's when looking for SPF polices.  For .gov agencies, if they have existing, known code that has the functionality, it's easier to turn it on then upgrade.  Wouldn't account for all of the increase though.

Scott

> -MSK

===================================
Scott Rose
NIST
[email-masked]
+1 301-975-8439
Google Voice: +1 571-249-3671
http://www.dnsops.gov/
===================================

---

From: Mark Andrews <[email-masked]>
Date: Wed, 08 Oct 2014 08:26:57 +1100

> cycle to change the text.  But it shouldn't be surprising that we see

The working group got told repeatedly that they just had to wait
as new code went from being written to being deployed.  They got
given data that showed type spf queries were increasing.  They just
refused to listen and used the stupid excuse of type txt not "working"
with type spf to claim that they had to abandon the transition.

There was plenty of time to change the decision but they refused
to listen.

Transitions like this take about a decade and they abandoned the
transition early.
 
> registered that unhappiness at the time.  But the deployed code is a

When you jump to the end state of SPF only, of course it won't work
with TXT.  However there was nothing wrong with that.  Also there
was nothing preventing people publishing both types if they wanted
to during the transition.  There was nothing preventing the transition
continuing.

The real reason that most of the working group didn't want to move
from TXT and resented that DNS people said use a seperate type for
this and resisted changing things.

-- 
Mark Andrews, ISC
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: +61 2 9871 4742                 INTERNET: [email-masked]

---

From: "Murray S. Kucherawy" <[email-masked]>
Date: Tue, 7 Oct 2014 14:54:07 -0700

> with type spf to claim that they had to abandon the transition.

Sorry, but "refused to listen" is false.  Your position was heard and
extensively debated.  The working group simply did not concur.

> to during the transition.  There was nothing preventing the transition

It would be wonderful to have any evidence other than DNS RRTYPE counts to
support the idea that there was any such organized transition in progress.
Perhaps you or Mans can share from whom all these new type 99 queries are
coming?

Meanwhile, I have not heard one peep from anyone in any of the email
communities to which I am connected that there's an attempt to move toward
type 99, not in 2012 and not today.  In fact, the contrary is probably true
given that the main open source implementation has (as I understand it)
since removed its type 99 query code.  Does anyone still paying attention
to this list have any such information?  I'm genuinely curious.  I've put
out some feelers to the places where I think the increased type 99 queries
might be originating.  I've yet to hear back.

Scott, I can't think of anyone more connected to SPF than you are: Are you
aware of such a transition?

> this and resisted changing things.

I don't think I can parse this sentence.  I suspect though that Appendix A
of RFC6686 better characterizes the situation than "resented"; the
resistance to which you refer was a lot more pragmatic than emotional.

-MSK

---

From: Scott Kitterman <[email-masked]>
Date: Tue, 07 Oct 2014 18:07:11 -0400

>aware of such a transition?
I'm not particularly interested in spending time relitigating the issue with people throwing ad hominem attacks around. I have my opinion on whose listening skills were deficient.  

The working group decided and it's done.   Revisiting it now doesn't make any sense. 

Scott K

>------------------------------------------------------------------------
>

---

From: Olafur Gudmundsson <[email-masked]>
Date: Wed, 8 Oct 2014 00:48:07 -0400

> The working group decided and it's done.   Revisiting it now doesn't make any sense. 

+1 

SPF fans (like me) get over it, we lost and its time to move on. 
The only moral is there is a lag between RFC publications and until effects are seen. 

	Olafur

---

From: Måns Nilsson <[email-masked]>
Date: Wed, 8 Oct 2014 07:55:55 +0200

> the traffic seen by this one resolver.

It is an authoritative name server with recursion no; in its
configuration. It hosts among others my personal domains, so there is
all the reason to suspect bias. I've seen similar figures from other
name servers, hosted by other people, but they also might suffer from
similar bias. (Not the least because these other data sources also 
are run by DNS people who seem to believe that support for new RR types
is possible..)

The methodolgy for such collection is indeed not  established -- as far as
I can tell. There is some argument that you probably hit a larger amount
of SPF lookup implementations when you are looking at auth server data;
further, there is reason to expect that the width of data is influenced
by the amount of email directed at domains hosted at the name server,
and, finally, the number of domains hosted on the name server would be
a strong component in influencing the data quality/relevance.

If, OTOH, you want to look at what people have deployed, in terms of
records in zones, a resolver serving a large outgoing SMTP relay would
be the best point.

-- 
Måns Nilsson     primary/secondary/besserwisser/machina
MN-1334-RIPE                             +46 705 989668
Kids, the seven basic food groups are GUM, PUFF PASTRY, PIZZA,
PESTICIDES, ANTIBIOTICS, NUTRA-SWEET and MILK DUDS!!