Re: Case-sensitive status

Murray S. Kucherawy wrote:

> > > Would it break any known implementations to change them to all-
> > > lowercase in the new RFC, just to be consistent with other things?
> 
> [...]
>
> > There should be test cases in the test suite covering this point,

No, the RFC 4408 test suite doesn't test for "Received-SPF" header 
generation (which is the only aspect of SPF that *outputs* result names).

> > [...]
>
> I think there's a risk people will/did implement it verbatim, missing
> the nuance that ABNF string comparisons are case-insensitive unless
> actual octets are specified.

The possibility certainly exists, however there's also the "be tolerant in 
what you accept" principle, which probably caused most implementors to 
handle result names case insensitively.

> > That part of the ABNF apparently only affects the Received-SPF header
> > field.  Is there any chance to get rid of this in 4408bis, e.g., with
> > a pointer to RFC 4408, plus some "please use RFC 5451" blurb?  Any
> > "erratum" for Received-SPF should be listed, I vaguely recall that
> > this is the case, but this could be buried in some "things you really
> > do not more need to care about" appendix.
>
> I just replied to this on apps-discuss, but basically if there's some
> reasonable demonstration that the world has largely dropped
> Received-SPF in favour of Authentication-Results, then such a change
> should probably be fine.

I think the best way to deal with the "Received-SPF" header in 4408bis is 
to define its grammar for implementors who would like to *parse* it, but
then say that it SHOULD NOT be generated and that "Authentication-Results"
SHOULD be generated instead.

-Julian