Subject: [spfbis] [Technical Errata Reported] RFC7208 (6216)

From: RFC Errata System <[email-masked]>
Date: Fri, 26 Jun 2020 03:56:45 -0700 (PDT)

The following errata report has been submitted for RFC7208,
"Sender Policy Framework (SPF) for Authorizing Use of Domains in Email, Version 1".

--------------------------------------
You may review the report below and at:
https://www.rfc-editor.org/errata/eid6216

--------------------------------------
Type: Technical
Reported by: David Bürgin <[email-masked]>

Section: A.4

Original Text
-------------
ptr._spf.example.com.  SPF  "v=spf1 -ptr +all"

Corrected Text
--------------
ptr._spf.example.com.  TXT  "v=spf1 -ptr:example.com +all"

Notes
-----
The example in appendix A.4, 'Multiple Requirements Example', does not
work as intended.

In the example, the SPF record at ptr._spf.example.com contains the
directive '-ptr'.

When this directive is evaluated, the <target-name> is equal to
'ptr._spf.example.com'. An input <ip> such as 192.0.2.10, which has a
PTR record pointing to 'example.com', will fail to match, as that domain
is not equal to nor a subdomain of 'ptr._spf.example.com'. In other
words, given the DNS setup of appendix A, there are no inputs that
fulfil the requirement for matching this ptr mechanism.

The example can be fixed by supplying an appropriate <domain-spec>:
replace '-ptr' with '-ptr:example.com'.

Instructions:
-------------
This erratum is currently posted as "Reported". If necessary, please
use "Reply All" to discuss whether it should be verified or
rejected. When a decision is reached, the verifying party  
can log in to change the status and edit the report, if necessary. 

--------------------------------------
RFC7208 (draft-ietf-spfbis-4408bis-21)
--------------------------------------
Title               : Sender Policy Framework (SPF) for Authorizing Use of Domains in Email, Version 1
Publication Date    : April 2014
Author(s)           : S. Kitterman
Category            : PROPOSED STANDARD
Source              : SPF Update
Area                : Applications
Stream              : IETF
Verifying Party     : IESG

---

From: "John Levine" <[email-masked]>
Date: 26 Jun 2020 12:41:11 -0400

He's right, the example in the RFC doesn't work. Just reminds us how
hard it is to get this stuff right, particularly after zillions of
rounds of editing and eyes glazing.

R's,
John