Re: [dmarc-ietf] making mail not work for your users, was the endless mailing list silliness

[John Sweet <[e-mail]>]

On Wed, Apr 17, 2013 at 5:12 PM, Terry Zink <[e-mail]>wrote:

> >>>
> Likewise, when I see your posts here on dmarc-ietf, I really don't care if
> it's you or someone pretending to be you. Some applications of email just
> aren't desperately in need of authentication.
> <<<
>
> So, are we basically on a discussion list that is in charge of moving
> forward the DMARC standard, but the discussion list itself can't
> authenticate with DMARC?
>

I have no problem with mailing lists representing posts as being from the
list, not from the original posters. I didn't subscribe to the individual
posters, I subscribed to the list. I do expect the list to authenticate
posters (especially since only certain addresses are allowed to post). I
don't expect the list to transport their authentication info through to me
to verify for myself.

Once I can tell the message is verifiably from [e-mail], I'm done
caring. I don't consider the mailing list convention of preserving the
From: of the original poster to be a useful or necessary feature. Digests
don't do it: they're always from the list.

If this means you can't post to some mailing lists from an address
protected by a DMARC reject policy, or that some mailing lists only send
digests, or always rewrite the From:, or even only rewrite the From: when
they can see the poster has a reject policy in effect, I'm fine with that.

If a list materially misrepresents the contents of a post, or identity of a
poster (same thing really), it will rapidly lose all its posters and
subscribers and cease to exist. This isn't a current scam profile, and I
can't see it ever becoming one.  This isn't a problem that needs solving,
let alone by DMARC.

J