Stephen, Thanks for the comments...
On 6/7/2014 8:08 PM, Stephen J. Turnbull wrote: > Two nits to pick. First, I'd like a whole (sub)section (containing > approximately one sentence :-) for Mediator responsibilities, even if > it's redundant with step 4 of the specification. Maybe a subsection > of section 5 (Discussion)? Uhh... why? > Second, from the draft: > > The expiration time on the Secondary signature needs to be long > enough to permit evaluation by receivers of the re-submitted > message, yet short enough to limit the potential for unauthorized > replay attacks. A good choice is a small number of days or even > hours. > > Due to greylisting (I've seen a message that got greylisted twice, > once at the mailing list and once at the recipient), I'd recommend > that the absolute minimum for expiration time be 12 hours, and that at > least 24 hours be recommended. Long ago, the usual email minimum timer was 72 hours, to deal with a long weekend... I'll suggest that rather than using precise number, perhaps the spec should indicate what the functional requirement or goal is, to guide the choice of actual timer value(s). Text suggesting how to accomplish this in the draft would not be met with hostility... d/ -- Dave Crocker Brandenburg InternetWorking bbiw.net _______________________________________________ dmarc mailing list [email protected] https://www.ietf.org/mailman/listinfo/dmarc
