Subject: Enough DMARC whinging

From: Phillip Hallam-Baker <[email-masked]>
Date: Tue, 29 Apr 2014 15:54:55 -0400

I am finding it rather hard to follow the DMARC discussion. Some folk
have managed to convince me that they are upset but working out why
would require rather a lot of spec crunching.

My best theory so far is that DMARC is some sort of email policy
statement and that either (1) some companies are now publishing a
policy that states 'reject all mail that purports to come from this
address that does not have authentication Y' or (2) some companies are
now rejecting mail not in compliance with said policy or (3) both.

There is a simple truth about DNS names: Whoever owns them makes the
rules for their use [1]. If you don't like the rules for google.com
then choose another domain to post from.

If people want email to work with mailing lists, then don't complain
about reasonable choices people want to make. Work out a way to fix
mailing lists so that they work properly.

There is no reason we can't change the way From works. Or add new from headers.

Are we engineers or curators of the past?

[1] Thus be rather suspicious of folk who claim that we merely rent
the use on terms of their choosing.

-- 
Website: http://hallambaker.com/

---

From: "Andrew G. Malis" <[email-masked]>
Date: Tue, 29 Apr 2014 18:14:55 -0400

Philip,

Here are the effects that I see. I use this gmail account for my IETF
mailing lists. I am now consistently seeing email sent from Yahoo users end
up in my spam folder with the following embedded warning message:

*Be careful with this message.* Our systems couldn't verify that this
message was really sent by yahoo.com. You might want to avoid clicking
links or replying with personal information.  Learn
more<http://support.google.com/mail/bin/answer.py?hl=en&answer=1366858&ctx=mail&authuser=1&expand=2>

The sender, of course, is completely unaware of what is happening on the
receiver's end, so they have no reason to want to change from Yahoo to
another domain for posting.

So this is imposing pain on the receiver, since I now have to consistently
check my spam folder for valid IETF email.

I see that you also use gmail, so you should start checking your spam
folder as well.

Cheers,
Andy

---

From: Christian de Larrinaga <[email-masked]>
Date: Wed, 30 Apr 2014 07:20:17 +0100

IETF could recommend people using Yahoo or AOL wanting to be read should
resubscribe to IETF lists from another domain?

Andrew G. Malis wrote:
> mailing lists. I am now consistently seeing email sent from Yahoo
> users end up in my spam folder with the following embedded warning
> message:
>
> message was really sent by yahoo.com <http://yahoo.com>. You might
> want to avoid clicking links or replying with personal
> information.  Learn more
> <http://support.google.com/mail/bin/answer.py?hl=en&answer=1366858&ctx=mail&authuser=1&expand=2>
>
> The sender, of course, is completely unaware of what is happening on
> the receiver's end, so they have no reason to want to change from
> Yahoo to another domain for posting.
>
> So this is imposing pain on the receiver, since I now have to
> consistently check my spam folder for valid IETF email.
>
> On Tue, Apr 29, 2014 at 3:54 PM, Phillip Hallam-Baker
> <[email-masked] <mailto:[email-masked]>> wrote:
>
>     rules for their use [1]. If you don't like the rules for
>     google.com <http://google.com>

-- 
Christian de Larrinaga
FBCS, CITP, MCMA
-------------------------
@ FirstHand
-------------------------
+44 7989 386778
[email-masked]
-------------------------

---

From: Phillip Hallam-Baker <[email-masked]>
Date: Wed, 30 Apr 2014 10:39:21 -0400

If there is a problem, I am not seeing it on gmail.

I have checked my spam filters, no mail to any IETF list there. So
unless gmail is doing a hard reject on this, I am not seeing issues.

Of course the way to make mailing lists work with DMARC would be to
look at the headers and treat messages with mailing list headers
differently. Perhaps the issue isn't in DMARC but how the information
from DMARC is applied.

With all email filtering technologies, the results of any
authentication or policy check is merely advice, not a requirement.
The sender can't impose any requirements on the receiver. Folk who get
hot under the collar about mail filtering tech tend to do so because
they don't understand that.

On Tue, Apr 29, 2014 at 6:14 PM, Andrew G. Malis <[email-masked]> wrote:
> Be careful with this message. Our systems couldn't verify that this message
> was really sent by yahoo.com. You might want to avoid clicking links or
> replying with personal information.  Learn more
>
> I see that you also use gmail, so you should start checking your spam folder
> as well.
>
> Cheers,
> Andy
>
>

---

From: "Andrew G. Malis" <[email-masked]>
Date: Wed, 30 Apr 2014 11:03:15 -0400

Phillip,

>From my reading of sections 10.2, 5.2, and 15.4 of
draft-kucherawy-dmarc-base-04,
you can't do that and still claim receiver conformance with that draft
(although there's the question of whether one should claim conformance to
an informational draft in the first place).

Cheers,
Andy

---

From: Dave Crocker <[email-masked]>
Date: Wed, 30 Apr 2014 10:16:01 -0500

On 4/30/2014 10:03 AM, Andrew G. Malis wrote:
> draft-kucherawy-dmarc-base-04, you can't do that and still claim
> receiver conformance with that draft (although there's the question of
> whether one should claim conformance to an informational draft in the
> first place).

(Conformance is voluntary.  People choose the specs they want to 
support, no matter the formal status.)

To the extent that varying from -base produces better results at 
reasonable cost, then receivers will do it.  The challenge is to offer 
clear and compelling guidance about that variance and gain support for 
its use.

For example, using the mere presence of List-* header fields as a basis 
for deviating from a domain owner's DMARC policy request would seem an 
easy attack vector by bad actors.

On the other hand, using the presence of the fields, combined perhaps 
the list signing the message (and covering those fields) and with the 
receiver's knowing that the list operator has a good reputation might 
make quite a bit of sense...

d/

-- 
Dave Crocker
Brandenburg InternetWorking
bbiw.net

---

From: Phillip Hallam-Baker <[email-masked]>
Date: Wed, 30 Apr 2014 12:52:51 -0400

On Wed, Apr 30, 2014 at 11:03 AM, Andrew G. Malis <[email-masked]> wrote:
> draft-kucherawy-dmarc-base-04, you can't do that and still claim receiver
> conformance with that draft (although there's the question of whether one
> should claim conformance to an informational draft in the first place).

Given a choice between conformance with a draft and conformance with
reality, I favor the second over the first.

---

From: Mitch Rodrigues <[email-masked]>
Date: Wed, 30 Apr 2014 11:16:51 -0700

Here is what I gather from all this talk.

I do not think DMARC is going anywhere and will continue to gain support
and popularity is it an inconvenience definitely, however going forward, I
feel it is our responsibility to make sure it is standards compliant, or
come up with new standards so everything does not go boom in the night.
With this said,
I also see a lot of traffic being spammed now for what appears to be no
apparent reason (Mostly from Yahoo domains), but hey thats less email i
have to read through.

And as for Google.com, If google wants to use it for their internal emails,
that is totally their choice, and will go one of two ways. A) It will work
flawlessly for their needs. or B) It will break things, and force them to
refine the strategy a bit more so it can be useable in the wild.

Mitch