Re: [dmarc-ietf] Issue submission - Mailing list security and potential solutions using DMARC

[John Levine <[e-mail]>]

In article <CAL0qLwZEDNT+LZDMrzecSuTD794jn0CoXRA5FG=[e-mail]> you write:
>-=-=-=-=-=-
>
>While I'm thinking of it:
>
>On Sat, Sep 12, 2020 at 6:11 PM Murray S. Kucherawy <[e-mail]>
>wrote:
>
>> On Thu, Sep 10, 2020 at 3:51 PM Douglas E. Foster <fosterd=[e-mail]> wrote:
>>> [e-mail]. ...

>How does this compare to what's done here already (if enabled)?
>https://wiki.list.org/DEV/DMARC

As far as I know, no widely available list software does that.

Several years ago I came up with a per user rewrite hack for DMARC-ed
addresses so a From header like:

 [e-mail]

turns into:

 [e-mail]

Henrik did something similar for the IETF lists:

 marissa=[e-mail]

(You can see that in the copy of Doug's address above.)

In both cases we set up a temporary forward from the rewritten address
to the real one. This works pretty well. The problem is that it
requires that the list software can stick its fingers into the MTA and
manage aliases on the fly which isn't usually the case.

By the way, all of the anti-DMARC hacks I'm aware of are listed here:

	https://wiki.asrg.sp.am/wiki/Mitigating_DMARC_damage_to_third_party_mail

Look at the history, you'll see most of them have been there at least since 2016.




-- 
Regards,
John Levine, [e-mail], Primary Perpetrator of "The Internet for Dummies",
Please consider the environment before reading this e-mail. https://jl.ly