Re: [dmarc-ietf] Email security beyond DMARC?

"Doug Foster" <fosterd@bayviewphysicians.com> Thu, 21 March 2019 18:36 UTC

Return-Path: <btv1==98346c22364==fosterd@bayviewphysicians.com>
X-Original-To: dmarc@ietfa.amsl.com
Delivered-To: dmarc@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 467D6131580 for <dmarc@ietfa.amsl.com>; Thu, 21 Mar 2019 11:36:18 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.999
X-Spam-Level:
X-Spam-Status: No, score=-1.999 tagged_above=-999 required=5 tests=[AC_DIV_BONANZA=0.001, BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=bayviewphysicians.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id UQDCKhr1w07r for <dmarc@ietfa.amsl.com>; Thu, 21 Mar 2019 11:36:15 -0700 (PDT)
Received: from mail.bayviewphysicians.com (mail.bayviewphysicians.com [216.54.111.133]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 77F1F13157B for <dmarc@ietf.org>; Thu, 21 Mar 2019 11:36:15 -0700 (PDT)
X-ASG-Debug-ID: 1553193373-0990574bec948c0001-K2EkT1
Received: from webmail.bayviewphysicians.com (webmail.bayviewphysicians.com [192.168.1.49]) by mail.bayviewphysicians.com with ESMTP id A1ngQmtVXqWOA7wj (version=TLSv1.2 cipher=ECDHE-RSA-AES256-SHA384 bits=256 verify=NO); Thu, 21 Mar 2019 14:36:13 -0400 (EDT)
X-Barracuda-Envelope-From: fosterd@bayviewphysicians.com
X-Barracuda-RBL-Trusted-Forwarder: 192.168.1.49
X-ASG-Whitelist: Client
X-SmarterMail-Authenticated-As: fosterd@bayviewphysicians.com
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=bayviewphysicians.com; s=s1025; h=content-type:mime-version:message-id:date:subject:to:from; bh=3tvAyoe10D/k1YqZmWajsZQfbtLZAWKpD3+hxfsRqRM=; b=SFnypvOfAlYRdZC1y2T3h8SZT1ySAKuvqmIqdUKXUuqvvLcy1919C8Y6n0g0YCKLS A6Aqqj3eePiXU7vqkkTUw3ywGtupQZXtZYDG2OZy8EPwZV9vXMdpRJQH0W2O2hOUB oeBNKUuabxiYt5/lDsm4R1TI+wbRVaaHCTfnaie20=
Received: from MSA189 (MSA-189.BayviewPhysicians.com [192.168.2.94]) by webmail.bayviewphysicians.com with SMTP (version=TLS\Tls12 cipher=Aes256 bits=256); Thu, 21 Mar 2019 14:36:05 -0400
From: "Doug Foster" <fosterd@bayviewphysicians.com>
X-Barracuda-RBL-IP: 192.168.2.94
To: "'Ken Simpson'" <ksimpson+ietfdmarc@mailchannels.com>, "'John R Levine'" <johnl@taugh.com>
Cc: "'IETF DMARC WG'" <dmarc@ietf.org>, "'Dotzero'" <dotzero@gmail.com>
References: <20190319184209.804E42010381DB@ary.qy> <alpine.DEB.2.20.1903201442260.7108@softronics.hoeneisen.ch> <alpine.OSX.2.21.1903201042010.79863@ary.qy> <CAJ4XoYcyaEBHYGPDY4ah_O+Obk-tijnL9SnxvzKyywu4BEmkrw@mail.gmail.com> <alpine.OSX.2.21.1903211031070.83149@ary.qy> <CAEYhs4GJeRhCQUxWxCDm8K46v_rTjER3ueoMRhMdUdZzK1ZSaQ@mail.gmail.com>
In-Reply-To: <CAEYhs4GJeRhCQUxWxCDm8K46v_rTjER3ueoMRhMdUdZzK1ZSaQ@mail.gmail.com>
Date: Thu, 21 Mar 2019 14:36:04 -0400
X-ASG-Orig-Subj: RE: [dmarc-ietf] Email security beyond DMARC?
Message-ID: <002901d4e014$f0b50570$d21f1050$@bayviewphysicians.com>
MIME-Version: 1.0
Content-Type: multipart/alternative; boundary="----=_NextPart_000_002A_01D4DFF3.69A56140"
X-Mailer: Microsoft Outlook 14.0
Thread-Index: AQE6O+S0HJlyLiYHqbQiq+xXXaEBHALEYuj6AsdeCWcB1qzo1wGfJ1scAdfzHram9OQMQA==
Content-Language: en-us
X-Exim-Id: 002901d4e014$f0b50570$d21f1050$
X-Barracuda-Connect: webmail.bayviewphysicians.com[192.168.1.49]
X-Barracuda-Start-Time: 1553193373
X-Barracuda-Encrypted: ECDHE-RSA-AES256-SHA384
X-Barracuda-URL: https://mail.bayviewphysicians.com:443/cgi-mod/mark.cgi
X-Barracuda-BRTS-Status: 1
X-Virus-Scanned: by bsmtpd at bayviewphysicians.com
X-Barracuda-Scan-Msg-Size: 11994
Archived-At: <https://mailarchive.ietf.org/arch/msg/dmarc/9XgViycRyFjI36VllzWran7zteQ>
Subject: Re: [dmarc-ietf] Email security beyond DMARC?
X-BeenThere: dmarc@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: "Domain-based Message Authentication, Reporting, and Compliance \(DMARC\)" <dmarc.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/dmarc>, <mailto:dmarc-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/dmarc/>
List-Post: <mailto:dmarc@ietf.org>
List-Help: <mailto:dmarc-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/dmarc>, <mailto:dmarc-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 21 Mar 2019 18:38:59 -0000

I am all for anything that cuts unwanted email.   Not sure of the need to distinguish between spam and phishing.

 

I am assuming that I am the only one in this group not using DMARC.   You heard my problems with SPF.  

 

What do you do for SPF Exceptions?

·         We have never seen a legitimate sender who needed an exception?

·         We whitelist the source IP address and trust that it will only be used for appropriate domains?

·         We whitelist the sender domain and hope it will never be spoofed?

·         Something else?

 

Also, how do you handle SPF non-pass:   Neutral, Softfail, Syntax errors,  or  Excessive nesting

 

Do you handle SPF any differently between senders with DMARC enforcement and those without?

 

Doug Foster

 

 

From: dmarc [mailto:dmarc-bounces@ietf.org] On Behalf Of Ken Simpson
Sent: Thursday, March 21, 2019 1:01 PM
To: John R Levine
Cc: IETF DMARC WG; Dotzero
Subject: Re: [dmarc-ietf] Email security beyond DMARC?

 


> I'm going to have to disagree with you John. DMARC is about preventing
> direct domain abuse. It does not specifically address phishing as the bad
> guys can simply use cousin domains, homoglyphs, etc.

Well, it's abount a subset of phishing.  It's surely more about phishing 
than about spam.

 

IMHO, by cutting out direct domain spoofing, DMARC makes it easier for receivers to craft algorithms that spot impersonation attacks. Once you have configured DMARC, receivers can build - for example - a machine learning system that learns what your legitimate email looks like. They can use that same system to identify messages that look like your legitimate email but which do not actually originate from your domain.

 

If you want to detect domain impersonation or "brand" impersonation, you first have to have a verifiable ground truth corpus. That is what DMARC offers.

 

Regards,

Ken