Re: [dmarc-ietf] Response to a claim in draft-crocker-dmarc-author-00 security considerations

[Alessandro Vesely <[e-mail]>]

On Sun 19/Jul/2020 20:33:46 +0200 Dave Crocker wrote:
> 
> The essential point that needs to be made is that standards like this MUST NOT 
> be cast in terms of what end users will do.  In practical terms, this work has 
> nothing to do with end users. Really.  Nothing.
> 
> [...]
> 
> 
> (*) I've seen one posting here or somewhere else that noted that letting bad 
> mail through can lead to end-users being deceived. I'll claim that while true, 
> it is not relevant, since the behavior happens after DMARC, and the like, are 
> relevant.  That is, DMARC, etc., do not inform the end-user behavior.


Aren't those two paragraphs self-contradictory?

If DMARC were dependable, maybe users would learn to trust From:.  Or maybe 
not.  Avoiding end user considerations cuts both ways.  Yet, we can trust that 
if we do a well-defined, clear job, then the whole system will work better.


Best
Ale
--