{"action":"created","issue":{"url":"https://api.github.com/repos/mrisher/smtp-sts/issues/93","repository_url":"https://api.github.com/repos/mrisher/smtp-sts","labels_url":"https://api.github.com/repos/mrisher/smtp-sts/issues/93/labels{/name}","comments_url":"https://api.github.com/repos/mrisher/smtp-sts/issues/93/comments","events_url":"https://api.github.com/repos/mrisher/smtp-sts/issues/93/events","html_url":"https://github.com/mrisher/smtp-sts/issues/93","id":170512632,"number":93,"title":"[UTA feedback] - Section 3.2 & 3.2.1 Updates","user":{"login":"jjones425","id":18467553,"avatar_url":"https://avatars.githubusercontent.com/u/18467553?v=3","gravatar_id":"","url":"https://api.github.com/users/jjones425","html_url":"https://github.com/jjones425","followers_url":"https://api.github.com/users/jjones425/followers","following_url":"https://api.github.com/users/jjones425/following{/other_user}","gists_url":"https://api.github.com/users/jjones425/gists{/gist_id}","starred_url":"https://api.github.com/users/jjones425/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jjones425/subscriptions","organizations_url":"https://api.github.com/users/jjones425/orgs","repos_url":"https://api.github.com/users/jjones425/repos","events_url":"https://api.github.com/users/jjones425/events{/privacy}","received_events_url":"https://api.github.com/users/jjones425/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":1,"created_at":"2016-08-10T20:36:38Z","updated_at":"2016-08-22T15:20:29Z","closed_at":null,"body":"From Viktor\r\n\r\n> 3.2. Policy Expirations\r\n\r\ns/Expirations/Expiration/\r\n\r\n> An important consideration for domains publishing a policy is that senders will see a policy expiration as relative to the fetch of a policy cached by their recursive resolver.\r\n\r\nThis is rather poorly worded.  The policy expiration time is always measured from the time it is fetched via HTTPS, not from the retrieval of any DNS record.  Thus a policy will be used for up to its max-age.\r\n\r\nThe DNS TTL only comes into play when signaling a policy refresh via a new \"id\", in which case some clients may not notice the new \"id\" until the previous DNS TTL expires.\r\n\r\n> Consequently, a sender MAY treat a policy as valid for up to {expiration time} + {DNS TTL}. Publishers SHOULD thus continue to expect senders to apply old policies for up to this duration.\r\n\r\nThis is wrong, no policy will be cached beyond the last time it was available via HTTPS + its max-age.  The DNS TTL is only of interest when policies are replaced, and makes it possible (barring DNS MiTM) for clients to notice that cached policies are stale, and thus refresh them sooner.\r\n\r\n> 3.2.1. Policy Updates\r\n> \r\n> Updating the policy requires that the owner make changes in two places: the _mta_sts RR record in the Policy Domain's DNS zone and at the corresponding HTTPS endpoint.\r\n\r\nPlease avoid internal \"_\" in DNS names.  Thus use \"_mta-sts\" instead.  See precedents with \"_xmpp-server\", \"_xmpp-client\", ...\r\n\r\n> In the case where the HTTPS endpoint has been updated but the TXT record has not been, senders will not know there is a new policy released and may thus continue to use old, previously cached versions. Recipients should thus expect a policy will continue to be used by senders until both the HTTPS and TXT endpoints are updated and the TXT record's TTL has passed.\r\n\r\nHere, consider describing the rollover process with multiple \"id\" values in the HTTPS policy record.\r\n"},"comment":{"url":"https://api.github.com/repos/mrisher/smtp-sts/issues/comments/241447808","html_url":"https://github.com/mrisher/smtp-sts/issues/93#issuecomment-241447808","issue_url":"https://api.github.com/repos/mrisher/smtp-sts/issues/93","id":241447808,"user":{"login":"danmarg","id":1929099,"avatar_url":"https://avatars.githubusercontent.com/u/1929099?v=3","gravatar_id":"","url":"https://api.github.com/users/danmarg","html_url":"https://github.com/danmarg","followers_url":"https://api.github.com/users/danmarg/followers","following_url":"https://api.github.com/users/danmarg/following{/other_user}","gists_url":"https://api.github.com/users/danmarg/gists{/gist_id}","starred_url":"https://api.github.com/users/danmarg/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/danmarg/subscriptions","organizations_url":"https://api.github.com/users/danmarg/orgs","repos_url":"https://api.github.com/users/danmarg/repos","events_url":"https://api.github.com/users/danmarg/events{/privacy}","received_events_url":"https://api.github.com/users/danmarg/received_events","type":"User","site_admin":false},"created_at":"2016-08-22T15:20:28Z","updated_at":"2016-08-22T15:20:28Z","body":"https://github.com/mrisher/smtp-sts/pull/94"}}
{"actor":{"display_login":"danmarg"}}