[dmarc-ietf] Re: I-D Action: draft-ietf-dmarc-arc-to-historic-00.txt

["Murray S. Kucherawy" <[e-mail]>]

On Thu, Apr 23, 2026 at 8:04 AM Alessandro Vesely <[e-mail]> wrote:

> Section 3.1 states that "ARC required evaluators to run a reputation
> system for ARC signers."  This is not accurate.  The only occurrence of the
> term "reputation" in the ARC specification is in Section 7.1.2, where it
> notes that a site /may/ apply reputation-based filtering.  There is no
> requirement for evaluators to operate such a system.
>

I would assume what's meant here is that ARC is only truly valuable if you
develop some kind of reputation for "good" or "bad" actors in the ARC
chain.  Without that, ARC's value is arguably limited.  (The same argument
applies to DKIM.)

Section 3.2 is titled "ARC’s Core Lesson: Signatures Are Not Trust".
> However, DMARC itself relies on trusting authenticated identifiers, whether
> established via cryptographic signatures or IP-based mechanisms.  For
> direct messages, this model is generally effective. There is a qualitative
> difference, however, when identity is asserted transitively (e.g., in
> forwarding scenarios): authentication alone does not convey the same level
> of trust. Informally, when an entity proves its own identity, this can be
> seen as a kind of “fixed point” of the trust function; this property does
> not hold when identity is asserted on behalf of a third party.
>

I'm not sure I understand the claim here.   A DMARC "pass" is not
predicated on trust (unless you only say DKIM passes for trusted entities,
for instance).  I mean, it could be, but the protocol doesn't require it
(and how could it?).

More generally, the use of signatures should be considered within a broader
> authentication and authorization framework.  Internet email has
> historically operated without mandatory authentication, and with an
> implicit authorization model in which any sender can attempt delivery to
> any recipient without prior arrangement.  This openness is a core property
> of the system.  Forwarding, by contrast, introduces third-party assertions
> of identity, where this implicit authorization model no longer applies
> cleanly.
>

If I configure this email address to forward elsewhere, does Gmail make any
assertions about any identity in the message (apart from, say, its own DKIM
signature)?  I don't think that's ever true, much less generally true.

-MSK