Return-Path: X-Original-To: dmarc@ietfa.amsl.com Delivered-To: dmarc@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E9857C14F5F9 for ; Sun, 27 Oct 2024 11:28:36 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.109 X-Spam-Level: X-Spam-Status: No, score=-2.109 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, SPF_PASS=-0.001, T_SCC_BODY_TEXT_LINE=-0.01, URIBL_DBL_BLOCKED_OPENDNS=0.001, URIBL_ZEN_BLOCKED_OPENDNS=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=iecc.com Received: from mail.ietf.org ([50.223.129.194]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id O2qfuC1mLU2o for ; Sun, 27 Oct 2024 11:28:32 -0700 (PDT) Received: from gal.iecc.com (gal.iecc.com [IPv6:2001:470:1f07:1126:0:43:6f73:7461]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-256) server-digest SHA256) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 84838C14F5FF for ; Sun, 27 Oct 2024 11:28:32 -0700 (PDT) Received: (qmail 47668 invoked from network); 27 Oct 2024 18:28:30 -0000 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed; d=iecc.com; h=date:message-id:from:to:cc:subject:in-reply-to:references:mime-version:content-type; s=ba2d671e864e.k2410; t=1730053700; x=1730399300; bh=Pyx512gq7nkpAgGmRuy9ojBza6P837SaNN7wE8Z6KgQ=; b=FaHVhncuN+RO6DfSqDPbZiUatVyKGqeaR4wjEquqw3+Ymp4TavSNIts0zhm32Z/G+6cglGP2FQ4WXIccXwi9/h60b6OrgoHA1Cx4x/qo1IBnEaNR4WvbLChGK1b/WQdSuTRND3lsfDYABNAmPupP6BeCNc9fJ9BGxB9YF50tx8vXtMFG8Y34OE09cKvuuZ10VhtyjTze+luuM+oyiC/YAa46kcAOKL14FPqgdIQIt7Uc8FXJ6X+vLDBKfmx+nyRP6Mv2Z5b1HAXjMgoF6CoTvqvJvahks9Kr1ORUl90VLiN0dcXTNDzaYIBTlPlc99u/6KHtR7ibSkDY/mmoE1rArw== Received: from ary.qy ([IPv6:2001:470:1f07:1126::78:696d:6170]) by imap.iecc.com ([IPv6:2001:470:1f07:1126::78:696d:6170]) with ESMTPS (TLS1.3 ECDHE-RSA CHACHA20-POLY1305 AEAD) via TCP6; 27 Oct 2024 18:28:30 -0000 Received: by ary.qy (Postfix, from userid 501) id A3CE0A3A80E6; Sun, 27 Oct 2024 14:28:29 -0400 (EDT) Received: from localhost (localhost [127.0.0.1]) by ary.qy (Postfix) with ESMTP id 3F16EA3A80C8; Sun, 27 Oct 2024 14:28:29 -0400 (EDT) Date: 27 Oct 2024 14:28:29 -0400 Message-ID: From: "John R. Levine" To: "Tero Kivinen" , "Richard Clayton" X-X-Sender: johnl@ary.qy In-Reply-To: <26398.20320.975512.417122@fireball.acr.fi> References: <21B7963C-1CBC-4017-98D7-77749FDA6B3E@bluepopcorn.net> <20241024221344.26C84A326945@ary.qy> <084985fb-5bcd-1acf-e73c-358690f49f3a@taugh.com> <43f5078a-0873-d22a-b529-8112de51c7ca@taugh.com> <3c6cb525-b0c0-4fed-9207-bb1b841fde9b@tana.it> <26397.38204.564597.374262@fireball.acr.fi> <26398.20320.975512.417122@fireball.acr.fi> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii; format=flowed Message-ID-Hash: SF74ICD5ZGQ7KSRTKLOC6MATCJ7Z7LCP X-Message-ID-Hash: SF74ICD5ZGQ7KSRTKLOC6MATCJ7Z7LCP X-MailFrom: johnl@iecc.com X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; header-match-dmarc.ietf.org-0; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header CC: dmarc@ietf.org X-Mailman-Version: 3.3.9rc6 Precedence: list Subject: =?utf-8?q?=5Bdmarc-ietf=5D_Re=3A_What_do_do_with_ARC=2C_Re=3A_Discussion_Thr?= =?utf-8?q?ead_?= List-Id: "Domain-based Message Authentication, Reporting, and Compliance (DMARC)" Archived-At: List-Archive: List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: On Sun, 27 Oct 2024, Tero Kivinen wrote: >> Yes in DKIM2 you may discover that an alteration was malicious, but at >> least it will be crystal clear (once, for forensic purposes you check >> every signature to hand) which entity should be blocked henceforth. > > That looks like this forensic thing is done by the postmaster etc on > the receiving end, i.e., people, not automatic systems, thus this is > even less scaleable than users adding their known trusted forwarders > to their trusted forwarders list. You're missing the point. There aren't a lot of malicious forwarders. I can't even remember the last time I got mail from one. In most cases, if you get forwarded mail, you can use the reputation of the original sender. DKIM2 lets you tell mechanically that it really was forwarded, a key difference from ARC. If a host is doing malicious forwarding, it is unlikely that it is sending any mail people want, so you can just block it. We already have ways to share lists of bad senders. R's, John