From f1d706040785c90f114f80e7f45c597af06a03a9 Mon Sep 17 00:00:00 2001 From: "Danilo M." Date: Thu, 10 Sep 2026 11:38:20 +0200 Subject: fix: emit only registered ARF fields, verified against IANA Backlog item 4 asked for a primary source for the machine-readable part. It exists, and it is IANA's MARF registry rather than x-arf's own docs. Checked against that registry and RFC 5965 itself on 2026-09-10. Report-Type is not a registered field. The registry lists 25 names and it is absent; it came from this spec's worked example rather than a decision. Removed, because Feedback-Type already says it. Keeping it would have been harmless, since RFC 5965 section 6 makes ignoring an unknown field a MUST for the receiver, but that same section requires an extension field be registered, and a desk should be able to look up every field in a document this tool sends. Feedback-Type moves from abuse to fraud. RFC 5965 registers fraud as "indicates some kind of fraud or phishing activity" and abuse as "unsolicited email or some other kind of email abuse". This tool reports phishing, and some desks route fraud separately from bulk spam. Reported-Uri becomes Reported-URI, the spelling in the ABNF and the registration. The RFC's own worked example uses the other one, which is where this came from. Names are case-insensitive so nothing was broken. A new test holds the registry's 25 names and asserts every emitted field is one of them, with Source named as the single deliberate exception, so a new unregistered field cannot arrive unnoticed. Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_01LByBnw83xr9YP85nskzkyE --- docs/specs/2026-09-09-report.md | 13 ++++++++++--- 1 file changed, 10 insertions(+), 3 deletions(-) (limited to 'docs/specs/2026-09-09-report.md') diff --git a/docs/specs/2026-09-09-report.md b/docs/specs/2026-09-09-report.md index 12d2157..b3a67ae 100644 --- a/docs/specs/2026-09-09-report.md +++ b/docs/specs/2026-09-09-report.md @@ -111,20 +111,27 @@ second body to keep in sync with the first for no reader. An RFC 5965 envelope carrying x-arf fields inside it. ``` -Feedback-Type: abuse +Feedback-Type: fraud User-Agent: abusectl/0.1.0 Version: 1 -Report-Type: phishing Source: 198.51.100.7 Source-IP: 198.51.100.7 Reported-Domain: example.invalid Arrival-Date: Mon, 08 Sep 2026 09:12:44 +0000 -Reported-Uri: http://login-example.invalid/verify?id=REDACTED +Reported-URI: http://login-example.invalid/verify?id=REDACTED ``` `Feedback-Type`, `User-Agent` and `Version` are the three fields RFC 5965 requires. The rest are optional there or come from x-arf. +**Every field name here is in the IANA MARF registry except `Source`**, which +is x-arf's and is the reason the envelope carries x-arf fields at all. An +earlier draft of this example also carried `Report-Type: phishing`, which is +not registered anywhere; it was removed once the registry was checked, since +`Feedback-Type` already says it. `fraud` rather than `abuse` because RFC 5965 +defines it as "some kind of fraud or phishing activity", which is what this +tool reports. See backlog item 4 for what was checked against what. + **Why an RFC 5965 envelope with x-arf fields inside, rather than either alone.** RFC 5965 is an IETF standard and universally understood, but it was designed for feedback loops, where a report is ABOUT A MESSAGE. These reports -- cgit v1.2.3