rfc-6577

Authentication-Results Registration Update for Sender Policy Framework (SPF) Results

M. Kucherawy

date2012-03 streamIETF wgnon working group statusPROPOSED STANDARD pages5 canonicalhttps://www.rfc-editor.org/rfc/rfc6577 doi10.17487/RFC6577

This memo updates the registry of authentication method results in Authentication-Results: message header fields, correcting a discontinuity between the original registry creation and the Sender Policy Framework (SPF) specification. [STANDARDS-TRACK]

obsoleted by

rfc-7001 — Message Header Field for Indicating Message Authentication Status

updates

rfc-5451 — Message Header Field for Indicating Message Authentication Status

Extracted elements (7)

design-rationale §3

The new 'fail' result replaces 'hardfail' for SPF (and Sender-ID) failures and carries the same definition previously used for 'hardfail' in RFC 5451 Section 2.4.2: the client is explicitly not authorized to inject or relay mail using the sender's DNS domain. The rename aligns the registry with the SPF specification's own terminology.

email, security

errata §1

RFC 5451 registered 'hardfail' as the SPF failure result in the Email Authentication Result Names registry, but the SPF specification (RFC 4408) uses the string 'fail' for the same condition. This discrepancy was documented in RFC Errata ID 2617 and is corrected by this memo.

email, registry

interoperability-note §4.2

The update to replace 'hardfail' with 'fail' for SPF authentication results also applies to Sender-ID (RFC 4406), since Sender-ID reuses SPF result codes. Implementations processing Authentication-Results headers for either mechanism should treat 'fail' as the canonical result name going forward.

normative-requirement §4.1 MUST

New registrations to either the Email Authentication Methods or Email Authentication Result Names registry MUST specify a status value of either 'active' or 'deprecated'.

email, registry

registry §4.1

IANA amended both the Email Authentication Methods and Email Authentication Result Names registries to include a 'Status' column. Legal values are 'active' (entry is in current use) and 'deprecated' (entry is no longer in current use). All existing entries except 'hardfail' are marked 'active'.

email, registry

registry §4.2

IANA amended the Email Authentication Result Names registry (in the Email Authentication Parameters group) to add a 'Status' column, mark 'hardfail' as 'deprecated', and update the 'fail' entry to be active for auth methods 'spf' and 'sender-id', with meaning defined in this memo Section 3.

email, registry

security-consideration §5

Because this memo corrects a registry error, older implementations may not recognize the corrected 'fail' result string and may only recognize 'hardfail'. Implementers are advised to support both result strings for some period of time to maintain interoperability, noting that some implementations already use the SPF-defined 'fail' string.

email, security