Re: RFC 4408 Errata - PermError on invalid domains after macro expansion

On 24/Oct/11 22:37, Scott Kitterman wrote:
> 
> My preference here would be to treat these as PermError since an empty
> domain-spec is not useful to the protocol and should be an error.

Then PermError can result from both an incorrect SPF record and a
macro expanded illicit sender identity.

> My solution (note: different than RFC4408 already due to other,
> non-controversial erratum):
> 
>>         A "PermError" result means that the domain's published records
>>         could not be correctly interpreted.  This signals an error
>>         condition that requires manual intervention to be resolved, as
>>         opposed to the TempError result.   If the message is rejected
>>         during the SMTP transaction for this reason, the software SHOULD
>>         use an SMTP reply code of 550 and, if supported, the 5.5.2 DSN
>>         code.

I don't think it may gain wide consensus to reject on PermError.  It
can result from inadvertently getting the syntax wrong, which is
totally unrelated with a third party acting maliciously.  By removing
the last sentence above, it is more likely that the intended meaning
of the spec --reject on Fail-- will be conveyed.

>>                Be aware that if the domain owner uses macros
>>         (<xref target="macros"/>), it is possible that this result is due
>>         to the checked identities having an unexpected format.  The domain
>>         and domain-spec MUST be fully macro expanded before being tested
>>         for errors.

I'd put both these considerations in Section 8.1.  In addition, the
note in the last but one paragraph there deserves an uppercase SHOULD,
before the explanation.  E.g.

   The domain and domain-spec MUST be fully macro expanded before
   being tested for errors.

   Note: Domains SHOULD avoid using the "s", "l", "o", or "h" macros
   in conjunction with any mechanism directive.  These macros can be
   exploited so as to get a PermError instead of the intended outcome,
   in certain circumstances:  If the domain owner uses them, it is
   possible that PermError results due to the checked identities
   having an unexpected format.  In addition, these macros severely
   limit the ability of implementations to cache results of
   check_host() and thus reduce the effectiveness of DNS caches.

jm2c