Re: [dmarc-ietf] ARC questions

John Levine <johnl@taugh.com> Mon, 23 November 2020 21:27 UTC

Return-Path: <johnl@iecc.com>
X-Original-To: dmarc@ietfa.amsl.com
Delivered-To: dmarc@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 013983A12A9 for <dmarc@ietfa.amsl.com>; Mon, 23 Nov 2020 13:27:46 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: 0.559
X-Spam-Level:
X-Spam-Status: No, score=0.559 tagged_above=-999 required=5 tests=[DKIM_INVALID=0.1, DKIM_SIGNED=0.1, HEADER_FROM_DIFFERENT_DOMAINS=0.249, PP_MIME_FAKE_ASCII_TEXT=0.11, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=no autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=fail (2048-bit key) reason="fail (message has been altered)" header.d=iecc.com header.b=gYl2I0DD; dkim=fail (2048-bit key) reason="fail (message has been altered)" header.d=taugh.com header.b=BlorD9jQ
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id fwCfp1DTMxyj for <dmarc@ietfa.amsl.com>; Mon, 23 Nov 2020 13:27:44 -0800 (PST)
Received: from gal.iecc.com (gal.iecc.com [IPv6:2001:470:1f07:1126:0:43:6f73:7461]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3528D3A120B for <dmarc@ietf.org>; Mon, 23 Nov 2020 13:27:43 -0800 (PST)
Received: (qmail 88876 invoked by uid 100); 23 Nov 2020 21:27:41 -0000
Date: 23 Nov 2020 21:27:41 -0000
Message-ID: <rph9gd$2mp3$1@gal.iecc.com>
From: "John Levine" <johnl@taugh.com>
To: dmarc@ietf.org
DKIM-Signature: v=1; a=rsa-sha256; c=simple; d=iecc.com; h=date:message-id:from:to:subject:references:in-reply-to:cleverness; s=15b25.5fbc294d.k2011; i=news@user.iecc.com; bh=6gRe6cR/aIT2Kl+1XoX83eaMLYWoviYc87+uzdY3yiU=; b=gYl2I0DDWXxlfIVU6wds+esMB7DqJ9wPCWA7jImDOn3JMP6wfiIa3DMKD8F1eocPm93ps4ly33cw/I8NdvbTNPicAA+AxFCzT8OvSIPu90ytr2b5wCzM2GR3p567734xL3f1sKJ4dBZg2liN1AtNMDvQPhsj6pTLIXIWsbdhO0BU1R6Axb291cITHCpie1Marvh2PD0bBuaQkpYnGfYDaHoATVqNfuo1WVGDdtVDG/9s2nhDgnAZE7hjCQQnQuLNTcJjD47mqaW5ld9rk6jUIxwe5ulc8g6lZiMh8aCJjUkJELh7SMMbNkp9RwfueKqHSoW/En82VjTr5cpDbp2DfA==
DKIM-Signature: v=1; a=rsa-sha256; c=simple; d=taugh.com; h=date:message-id:from:to:subject:references:in-reply-to:cleverness; s=15b25.5fbc294d.k2011; olt=news@user.iecc.com; bh=6gRe6cR/aIT2Kl+1XoX83eaMLYWoviYc87+uzdY3yiU=; b=BlorD9jQiz8MlztWnWSUIZrqKC7GMt3OmcF8+pFrHBHpnp3b5RswzFg67y4wpRnEVezP6t1l1YH7kzwg+XJgFNrI93I5Zgon5aT3ehDBtWDQHrVQNiVATUPNnSstC4EU9qNeSEpu9IBn9KYwmzUjNePqUE67OK/bZYBCVp7C77cMO+5pZS1j5WNrwBZnNM0czgvqcSACIJ0NRIY601XlEVXr6jAU+4PP/mQY08ZgJGDVzYi1brzTFrp9W0//+1UcKGQwa3Etbt29e4jBE1xfNX1fMXJZMDHtNAINWq7onEQrVd6XZiZ7CtcJcV39Vz9+2ikB8SkXMIdoQBAnvkdg2A==
Organization: Taughannock Networks
References: <dcc265f9-a143-5093-eba0-94ee059c7cc7@mtcc.com> <CAMSGcLCzN5q_p_TtUqv5CvwC0ZTkAY9eFaT_za-1WJXgRUmF4A@mail.gmail.com> <CAHej_8nN+827KB+tTuyoeZXoUaKzcYoeizNmwSY-fKTquroPMA@mail.gmail.com> <e3d428f4-1a29-4c6f-4a31-96a24a347e54@gmail.com>
In-Reply-To: <dcc265f9-a143-5093-eba0-94ee059c7cc7@mtcc.com> <CAMSGcLCzN5q_p_TtUqv5CvwC0ZTkAY9eFaT_za-1WJXgRUmF4A@mail.gmail.com> <CAHej_8nN+827KB+tTuyoeZXoUaKzcYoeizNmwSY-fKTquroPMA@mail.gmail.com> <e3d428f4-1a29-4c6f-4a31-96a24a347e54@gmail.com>
Cleverness: some
X-Newsreader: trn 4.0-test77 (Sep 1, 2010)
Originator: johnl@iecc.com (John Levine)
Archived-At: <https://mailarchive.ietf.org/arch/msg/dmarc/8BYuRC1tjaCt8BNYHnhyQ6NV7Tk>
Subject: Re: [dmarc-ietf] ARC questions
X-BeenThere: dmarc@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: "Domain-based Message Authentication, Reporting, and Compliance \(DMARC\)" <dmarc.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/dmarc>, <mailto:dmarc-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/dmarc/>
List-Post: <mailto:dmarc@ietf.org>
List-Help: <mailto:dmarc-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/dmarc>, <mailto:dmarc-request@ietf.org?subject=subscribe>
X-List-Received-Date: Mon, 23 Nov 2020 21:27:46 -0000

In article <e3d428f4-1a29-4c6f-4a31-96a24a347e54@gmail.com>om>,
Dave Crocker  <dcrocker@gmail.com> wrote:
>> I believe, though, that the intent of ARC is that it be scalable in 
>> ways that manual enumeration of known legit mailing lists and 
>> forwarders is not.
>
>"if you know which hosts are legit" buries an assumption that is 
>problematic, namely that you know who handled the message.  The fact
>that a message purports to be handled by a mailing list you trust does 
>not mean it actually was.

Pretty close, but not quite.

You know that a message came from a mailing list because you have your
list of IPs or DKIM signatures of lists you trust.

ARC deals with the problem that most list software forwards everything
with a subscriber's address on the From: line and does a lousy job of
spam filtering. The question is if the entity sending the message to
the list was who it purported to be. 

For example, if a message from a list fails DMARC alignment, but ARC
says it was aligned on the way in, it's likely a real message from a
subscriber. If it was unaligned on the way in, it's likely wpam.

R's,
John
-- 
Regards,
John Levine, johnl@taugh.com, Primary Perpetrator of "The Internet for Dummies",
Please consider the environment before reading this e-mail. https://jl.ly