Re: [dmarc-ietf] WGLC editorial review of draft-ietf-dmarc-dmarcbis-30

["Murray S. Kucherawy" <[e-mail]>]

On Sun, Mar 31, 2024 at 5:22 AM Douglas Foster <
[e-mail]> wrote:

> On SPF, our document should say simply,
> " a DMARC-compliant evaluator MUST NOT reject a message, based on SPF
> result, prior to receiving the Data section and checking for aligned and
> verifiable signatures."
>
> Of course, evaluators may still reject early base on known-bad server or
> known-bad Mail From domain, but not based on SPF alone.
>
> I weary of the notion that the solution to all authentication problems is
> to stop authenticating.
>

I suggest that we need to be clear on what "evaluator" is in that sentence.

I think the proposed text makes architectural assumptions that may not be
universally true.  For instance, an upstream SPF filter might do something
dispositive to the message before the DMARC implementation even gets a
chance to see the body.

So if "evaluator" is the DMARC implementation specifically, we don't know
if it's compliant or not because it never got a chance to see the message
body (the DATA section).  But if "evaluator" is the operator's overall
receiving function, of which both of those implementations are a part, then
I think that assertion is probably correct.

Overall, I would hope that operators understand that DKIM (and thus DMARC)
can't be evaluated if the message is rejected before the body arrives, but
I suppose it can't hurt to remind them.

-MSK, p11g