Re: [dmarc-ietf] third party authorization, not, was non-mailing list

[Dotzero <[e-mail]>]

On Tue, Aug 25, 2020 at 2:13 PM John R Levine <[e-mail]> wrote:

> On Tue, 25 Aug 2020, Dotzero wrote:
> >>> I would expect there to be multiple potential approaches to identifying
> >>> acceptable intermediaries.
> >>
> >> The harder part is to decide which intermediary gets to re-sign which
> >> message at the time you apply the weak signature.
> >
> > It would have be the domain in the "To" field.  It wouldn't work with
> > random unknown intermediaries. It would address the MLM issue as long as
> > the MLM domain is the same as the "To" domain when the message was
> > originally sent. It could also presumably work for vanity domains if they
> > DKIM sign. It wouldn't work for forwards on the receiver side that the
> > sender is unaware of.
>
> If the list is [e-mail], does the signature have to be
> d=lists.foo.org?  How about d=foo.org?
>

This is something that would have to be thought through and discussed. I
want to lean towards exact match but I could be convinced that the base
organization signature would be acceptable as a starting point. I would
recommend anyone coding this for signing to use a flag to easily switch
between the two. I'd recommend that any intermediary doing signing consider
using the CNAME approach so that all their lists can easily be signed with
an exact match signature. This is one of the areas where implementation and
operational considerations may differ from standards considerations.

>
> On the flip side, do you put a weak signature on all of your outgoing
> mail, which seems like a bad idea, or just mail that you expect to go
> through list modification?  In the latter case, how do you tell?  These
> are the scaling problems that I fear make this unworkable.
>

I think only putting the weak signature on mail you expect to be modified
would be the way to go. As I indicated in my previous post, there are
multiple ways to address identifying which mail is likely to go through an
intermediary.  Large mail providers/data gatherers probably already have an
awareness in this space. Others could probably create lists which could be
checked realtime or updated/downloaded once or twice a day. Organizations
could also enable self registration of intermediary use by their users. It
might also be a combination of these approaches. I don't see this as an
issue that makes scaling unworkable. There are plenty of folks checking for
blocklists, how does this differ significantly either operationally or in
scale?

Michael Hammer