Re: [dmarc-ietf] ARC questions

[Michael Thomas <[e-mail]>]

On 11/23/20 3:00 PM, Dave Crocker wrote:
> On 11/23/2020 2:58 PM, John R Levine wrote:
>>> And, again, when ARC work was pursued, I don't recall anyone 
>>> claiming that mailing lists were (significant) sources of misbehavior.
>> Well, OK.  Please feel free to provide footnoted documentation of 
>> what the actual motivation for ARC was if you believe it was 
>> something else.
>
>
> Typically, the burden of substantiating a claim falls on the person 
> making the affirmative claim.
>
What I'm struggling to understand is what having authenticated auth-res 
from a previous hop helps. this is what i found:

"With this information, Internet Mail Handlers MAY inform local policy 
decisions regarding disposition of messages that experience 
authentication failure due to intermediate processing."

that and:

"When an Authenticated Received Chain is used to determine message 
disposition, the DMARC processor can communicate this local policy 
decision to Domain Owners as described in Section 7.2.2."

seems to be the only motivation I can find. without ARC, a receiver 
could always check the new DKIM signature from, say, the mailing list 
and look up its reputation to decide whether to pass it along or not 
overriding the originating domain's policy. my recollection was that 
this was the "you break it, you own it" policy which i recall being the 
consensus. and indeed, there is nothing to stop a filter to look at the 
mailing list's auth-res and take it into account even if it's not part 
of the headers in the signature. maybe there is some attack there i'm 
not seeing off the top of my head, but it seems like this really hinges 
on reputation as was pointed out to me earlier.

It would be kind of nice to understand what gap ARC actually plugs and 
why it's important if you ask me. Also: there seem to be a lot of ways 
to achieve this, but this one is probably the most complicated one that 
I can envision.

Mike