Subject: changing the SPF record version number?

From: wayne <[email-masked]>
Date: Thu, 05 Aug 2004 13:53:00 -0500

Yesterday in one of the MARID sessions at IETF-60, it was decided that
we should change the version number on the SPF records.

I didn't raise any objections to this during the meeting because I
needed to think about it.  Having thought about it over night, I think
that *just* changing the version number and abandoning the SPF1
records is a bad idea.

First off, I think people are underestimating the number of SPF
records that have already been published.  Someone with a list of all
the .ch domains has started to go through them and see who has
published records.  They added 20,000 domains to the SPF adoption roll
yesterday, and they are only up to 's'.  After doing two surveys of
1.3 million email domains in the last 3 months, I have also found that
the adoption roll underestimates the number of published SPF records.

Instead of just changing the version number of the records and
ignoring SPF1 records, I think we should use SPF1 records unless SPF2
records have been published and I think SPF2 should have the scope
variable added as per the Unified-SPF I-Ds.  Then, if domain owners
feel that they need different records when used with the PRA
algorithm, they can publish SPF2 records and use the scope variable to
make the required distinctions.

During the discussions of the Unified-SPF idea (which happened mostly
on the SPF lists, not here), there were also some discussions about
using a scope= modifier.  Personally, I don't think it is as good of a
solution, but it is certainly a possibility.

For those who are interested in reading the discussions about the
scope= modifier instead of just reinventing the wheel, you can view
the discussions of the spf-discuss archives from June and July here:

http://archives.listbox.com/[email-masked]/200406/index.html
http://archives.listbox.com/[email-masked]/200406/index.html

Basically search for the posts with the subject that have "unified" in
them.

-wayne

---

From: Frank Ellermann <[email-masked]>
Date: Sat, 07 Aug 2004 14:05:00 +0200

wayne wrote:

> I think that *just* changing the version number and
> abandoning the SPF1 records is a bad idea.

At least it's a consequent solution, and if SUBMITTER really
reintroduces bounces to innocent bystanders it's necessary.

Most existing v=spf1 records have one goal:  Protect the 2821
MAIL FROM, stop useless bounces to forged MAIL FROM addresses.

That's the one and only purpose of SPF classic, existing exp=
explanations like <http://spf.pobox.com/why.html> are based on
this assumption.

> I think we should use SPF1 records

For SPF/MAILFROM, and maybe for a compatible version of PRA,
if we add a rule that MAIL FROM != From: without Sender: is
implicitly handled like MAIL FROM == Sender (near step 4 in
draft-ietf-marid-core-02.txt 4.4).

> If domain owners feel that they need different records
> when used with the PRA algorithm, they can publish SPF2
> records and use the scope variable to make the required
> distinctions.

Okay, something like "v=spf2 a -all check=2822" could allow
incompatible header checks, and / or  "check=2821" would be
the same as an existing v=spf1 sender policy. 

In theory it's possible to add this modifier without changing
the version:  A "v=spf1" without "check=2822" would stand for
SPF classic, and a "v=spf1" with "check=2822" would allow new
incompatible checks like SPF/FROM-HDR resp. core-02 Sender-Id.

Something like "forget SPF/MAILFROM, do only new stuff" isn't
possible with protocol-00.txt and v=spf1, implementations are
free to ignore unknown modifiers.

                       Bye, Frank