Re: [dmarc-ietf] Call for Adoption: DMARC Use of the RFC5322.Sender Header Field

[Scott Kitterman <[e-mail]>]

On Sunday, September 27, 2020 1:16:11 PM EDT John Levine wrote:
> In article <4004580.HQKp4RnRq6@zini-1880> you write:
> >I don't think this his helpful.  If something like this is going to be
> >standardized, it shouldn't be called DMARC because it's not.
> 
> We (the generic we) seem to have a fundamendal disconnect about what
> DMARC is for.
> 
> One group appears to believe it's about what users see in their inbox,
> to ensure that the address on the From: line matches the actual
> author.

Speaking at least for myself, not quite.  I think it's more about what users 
don't see than what they see.  I think most everyone agrees DMARC is to 
support filtering, I think the question is about how.

DMARC defines a policy set with the goal that receivers will act on that 
policy.  Specifically that receivers will reject/quarantine mail that fails 
DMARC for domains that have published such restrictive policies.

The approach defined is mechanical, not statistical.  I think that's the key 
difference.  Is it about specific policy enforcement, or is it just one more 
token for a bayesian network?

> The other group appears to believe it's a filtering signal that mail
> systems mix into the filtering process they apply between the time the
> mail arrives at the MX and the time the users sees it.

This seems to me to be an odd view because no RFC is needed to use From and 
it's relationship to either DKIM signing domain or SPF validated Mail From.  
Feeding data into an algorithm has no interoperability requirements.

That doesn't mean one can't use the data this way, because anyone can that 
wants to can.  That doesn't make it the specified protocol.

> I suppose both are right to some extent, but they have very different
> implications for the design.

Agreed.  Maybe it would help if someone who takes the latter view would 
explain what they think RFC 7489, Section 6.6.2, Step 6 is for:

>    6.  Apply policy.  Emails that fail the DMARC mechanism check are
>        disposed of in accordance with the discovered DMARC policy of the
>        Domain Owner.  See Section 6.3 for details.

I don't think that says "then toss the results into your classifier".

Scott K