Re: [dmarc-ietf] ARC-Seal is meaningless security theatre

[Bron Gondwana <[e-mail]>]

On Fri, 18 Aug 2017, at 04:48, Seth Blank wrote:
> On Thu, Aug 17, 2017 at 1:09 AM, Bron Gondwana
> <[e-mail]> wrote:>> I laugh as well, but it's more than p=reject isn't enough in the ARC
>> world, because it doesn't distinguish between:>> a) I'm OK with email from my domain being sent via mailing lists; and>> b) no, this domain is only ever used for direct messages, it should
>>    never appear in ARC chains that don't also pass DKIM.> 
> The DMARC WG charter directly addresses this:
> https://datatracker.ietf.org/wg/dmarc/charter/> 
> Our stated goal is to fix indirect mail flows so that they do not
> break under DMARC. To me, that's an explicit requirement of a), with
> b) being out of scope.
OK, so case (a) means that we are explicitly redefining the behaviour of
a DMARC receiver.  It should now accept messages that it used to reject,
because they have additional new headers.  Which means what - until it's
updated it now no longer compliant, or else it means (as I have just
responded to Brandon in what appears to be a split of this same thread)
that intermediate sites which modify messages are left in a limbo where
they have to guess what happens.
In one respect, that's no different than the situation now where
intermediate modifiers KNOW that they can't send on messages for
p=reject domains (or at least, they would know if they were DMARC-
aware).  But it does mean that workarounds for DMARC (like modifying the
from header) are needed for some time yet.
Bron.

--
  Bron Gondwana, CEO, FastMail Pty Ltd
  [e-mail]