spf-discuss
[Top] [All Lists]

Re: RE: SPF: Not just a clever idea

2004-06-07 19:42:47
In 
<1086652584(_dot_)1852(_dot_)71170(_dot_)camel(_at_)localhost(_dot_)localdomain>
 Mark Shewmaker <mark(_at_)primefactor(_dot_)com> writes:

On Mon, 2004-06-07 at 13:12, Julian Mehnle wrote:
Seth Goodman [sethg(_at_)GoodmanAssociates(_dot_)com] wrote:
I think it is fair to say that most of us know little, if anything,
about the PRA extraction algorithm.  Could you provide any more details
as to how it operates?

The PRA extraction algorithm is also defined in section 4 of:
http://www.ietf.org/internet-drafts/draft-ietf-marid-core-00.txt

Note that there was a good post the MARID mailing list with a
suggested replacement for the algorithm described in the document.  It
is (intended to be) functionally identical for well formed emails, but
deals with bogus emails better.  (e.g. what if an email has two From:
headers or no headers at all?)  Jim Lyon (MS) asked if it was OK to
to use the new description, and I think he will.


While the XML idea I think is just nonsense for all the *technical*
reasons that have been repeated many times since January, the
"caller-id algorithm" just makes me queasy.  It is not that it is a
bad idea, or does useless or wrong stuff, it just appears to me to be
totally untested.  The fact that the spec is not designed to deal with
error conditions is a good sign of how little it has been put to real
use.  There is a ton of other evidence that it has existed mostly on
paper in the MARID mailing list archives.

If the "caller-id algorithm" works, then I will be *very* happy.  We
need something that verifies the mail headers in addition to the SMTP
data.  It just makes me queasy that we are talking about rolling out a
standard that will effect so much email w/o lots of real-world testing
on the system.


-wayne