Subject: [marf] I-D Action: draft-ietf-marf-authfailure-report-05.txt

From: [email-masked]
Date: Thu, 01 Dec 2011 16:00:21 -0800

A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the Messaging Abuse Reporting Format Working Group of the IETF.

	Title           : Authentication Failure Reporting using the Abuse Report Format
	Author(s)       : Hilda L. Fontana
	Filename        : draft-ietf-marf-authfailure-report-05.txt
	Pages           : 19
	Date            : 2011-12-01

   This memo registers an extension report type to ARF for use in
   reporting messages that fail one or more authentication checks
   performed on receipt of a message, with the option to include
   forensic information describing the specifics of the failure.

A URL for this Internet-Draft is:
http://www.ietf.org/internet-drafts/draft-ietf-marf-authfailure-report-05.txt

Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/

This Internet-Draft can be retrieved at:
ftp://ftp.ietf.org/internet-drafts/draft-ietf-marf-authfailure-report-05.txt

---

From: Alessandro Vesely <[email-masked]>
Date: Fri, 02 Dec 2011 13:55:57 +0100

> 	Filename        : draft-ietf-marf-authfailure-report-05.txt

I still have some problems with the example.  It seems that ".com" and
".net" were swapped at least in one place, and in any case it is
difficult to avoid confusion with them.  Perhaps it's me, but wouldn't
it be possible to replace the domain names (tentatively) like so?

  s/example.com/originator.example/
  s/example.net/verifier-reporter.example/

Specific nits in the text/rfc822-headers (3rd) part are as follows:

* There is no "To:" header field,

* the topmost Received has ".com" and ".net" swapped,

* there are more than three minutes between internal servers
  handling, and they are inconsistent with the Date field.  I'd
  change those lines with, say,

   Received: from anexample.example.com ([192.0.2.1])
    by mta1011.mail.tp2.example.net with ESMTP
    Sat, 08 Oct 2011 04:16:24 -0700 (PDT)
   Received: from internal-client-001.example.com
    by mail.example.com (an alias for anexample)
    with SMTP id o3F3BwdY028431;
    Sat, 08 Oct 2011 04:16:23 -0700 (PDT)
   Date: Sat, 8 Oct 2011 09:16:23 -0400 (EDT)

* the DKIM-Signature has d=example.net rather than d=example.com, and

* the A-R field misses a semicolon at the end of the first line while
  the second line conflates two methods.  I'd rewrite it taking three
  lines, e.g.

   Authentication-Results: mta1011.mail.tp2.example.net;
    spf=pass smtp.mailfrom=anexample.example.com;
    dkim=fail (bodyhash) header.d=examle.com;

For the second part, this should instead be

   Authentication-Results: mta1011.mail.tp2.example.net;
    dkim=fail (bodyhash) header.d=examle.com;

Also in the second part, where would Reported-URI be derived from?

Then, the report would be sent from the verifier/reporter back to
example.com.  Instead, the outermost "Received:" field is "from
mail.example.com by mx.example.net".  The IP address 192.0.2.1 doesn't
seem to belong here.  Do we need an outermost Received field?  If the
intent is to exemplify a generated but not yet sent report, it can be
omitted as well as Return-Path and Authentication-Results.  If not,
I'd also add a DKIM-Signature.

One more nit, there is an unbalanced parenthesis in the last line of
the second paragraph of Section 3.2.4

 DKIM-Canonicalized-Body:  A base64 encoding of the canonicalized body
    of the message as generated by the verifier.  The encoded content
    MUST be limited to those bytes that contribute to the DKIM body
    hash (i.e., the value of the "l=" tag; see Section 3.7 of [DKIM].

---

From: Alessandro Vesely <[email-masked]>
Date: Fri, 02 Dec 2011 16:22:15 +0100

Oops, perhaps that should be

>     Sat, 08 Oct 2011 04:16:24 -0700 (PDT)
      Sat, 08 Oct 2011 06:16:24 -0700 (PDT)

---

From: Hilda Fontana <[email-masked]>
Date: Mon, 5 Dec 2011 09:20:19 -0800

Thanks Alessandro I'll take a look

On Fri, Dec 2, 2011 at 4:55 AM, Alessandro Vesely <[email-masked]> wrote:

> _______________________________________________
> marf mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/marf
>

-- 
Hilda L Fontana
 VP, Technology
eCert, Inc.
One Market Street, Suite 3600
San Francisco, CA 94105
p: 626.676.8852
f:  415.651.8932

**eCert - Trust the MessageTM
*www.ecertsystems.com* <http://www.ecertsystems.com/>
* *
----------------------------------------

CONFIDENTIALITY NOTICE

The information contained in this e-mail and any attachments is
CONFIDENTIAL and is intended only for the use of the addressee. Any
unauthorized use, disclosure, distribution, dissemination, or copying is
strictly prohibited and may be unlawful. If you are not the intended
recipient, you are prohibited from any further viewing of the e-mail or any
attachments or from making any use of the e-mail or attachments. If you
believe you have received this e-mail in error, please notify us
immediately and permanently delete the e-mail, any attachments, and all
copies from any drives or storage media and destroy any printouts of the
e-mail or attachments and any copies of such printouts. Thank you for your
cooperation.

<http://www.ecertsystems.com/>

---

From: "Murray S. Kucherawy" <[email-masked]>
Date: Wed, 7 Dec 2011 22:01:30 -0800

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On Behalf Of Alessandro Vesely
> Sent: Friday, December 02, 2011 4:56 AM
> To: [email-masked]
> Subject: Re: [marf] I-D Action: draft-ietf-marf-authfailure-report-05.txt
> 
> I still have some problems with the example. [...]

Thanks for your suggestions.

Here's a full replacement example I think will work.  Let me know if I've missed anything.

-MSK

---

From: SM <[email-masked]>
Date: Wed, 07 Dec 2011 22:54:35 -0800

Hi Murray,
>Here's a full replacement example I think will work.  Let me know if 

This is a quick pass.

  "Arrival-Date: 8 Oct 2011 13:16:24 +0000(GMT)"

I suggest dropping the GMT in that line.

BTW, I did not think about the Version field previously.  As a quick 
comment, if the report interoperate with the base specifications, 
that should not be a problem.

According to the Auth-Failure field, this report is DKIM related.  It 
qualifies as a DKIM report (3.2.3).  The DKIM-Domain and 
DKIM-Identity fields are required.  There isn't a requirement level 
in the draft though.

Regards,
-sm

---

From: "Murray S. Kucherawy" <[email-masked]>
Date: Thu, 8 Dec 2011 10:23:28 -0800

> From: [email-masked] [mailto:[email-masked]] On Behalf Of SM
> Sent: Wednesday, December 07, 2011 10:55 PM
> To: [email-masked]

Why?  The others all have timezones.  There should be a space before the opening parenthesis though.

> qualifies as a DKIM report (3.2.3).  The DKIM-Domain and DKIM-Identity
> fields are required.  There isn't a requirement level in the draft
> though.

Right; added.

Thanks,
-MSK

---

From: SM <[email-masked]>
Date: Thu, 08 Dec 2011 13:11:35 -0800

Hi Murray,
>the opening parenthesis though.

It was easier than pointing out the missing space. :-)

Regards,
-sm

---

From: Alessandro Vesely <[email-masked]>
Date: Fri, 09 Dec 2011 13:00:41 +0100

> Here's a full replacement example I think will work.  Let me know

I attach a patch

--- afrf-example.txt	Fri Dec 09 12:54:27 2011
+++ arfr-example.txt	Fri Dec 09 12:58:31 2011
@@ -1,9 +1,8 @@
-Return-Path: [email-masked]
 Message-ID: <[email-masked]>
 From: "SomeISP Mail Antispam Feedback" <[email-masked]>
 To: [email-masked]
 Subject: FW: You have a new bill from your bank
-Date: Sat, 8 Oct 2011 14:15:59 -0600 (CST)
+Date: Sat, 8 Oct 2011 15:15:59 -0500 (CDT)
 MIME-Version: 1.0
 Content-Type: multipart/report;
   boundary="------------Boundary-00=_3BCR4Y7kX93yP9uUPRhg";
@@ -33,10 +32,9 @@
 Auth-Failure: bodyhash
 DKIM-Canonicalized-Body: VGhpcyBpcyBhIG1lc3NhZ2UgYm9ke
  SB0aGF0IGdvdCBtb2RpZmllZCBpbiB0cmFuc2l0Lgo=
-Arrival-Date: 8 Oct 2011 13:16:24 +0000(GMT)
+Arrival-Date: 8 Oct 2011 20:15:58 +0000(GMT)
 Source-IP: 192.0.2.1
 Reported-Domain: a.sender.example
-Reported-URI: http://www.sender.example/
 
 --------------Boundary-00=_3BCR4Y7kX93yP9uUPRhg
 Content-Type: text/rfc822-headers
@@ -68,7 +66,7 @@
 Reply-To: [email-masked]
 From: [email-masked]
 To: [email-masked]
-Subject: You have a new bill
+Subject: You have a new bill from your bank
 Message-ID: <[email-masked]>
 
 --------------Boundary-00=_3BCR4Y7kX93yP9uUPRhg--