[dmarc-ietf] Restating the forwarding problem

[Douglas Foster <[e-mail]>]

Email authentication is only reliable when the message is received directly
from the originating organization. DMARCbis should have included a
disclaimer that made this limitation explicit.  We know, and have
discussed, that a message can gain or lose credentials when a third
organization is in the flow path.

Consider a DKIM signature applied by an outbound gateway service such as
ProofPoint or MimeCast.   The signature appears to provide authenticity,
but the signature is only reliable if the outbound gateway service
authenticated the client connection.   (DKIM2 is not expected to solve this
problem.)  In most cases, it is impossible to determine whether or not that
authentication occurred or not, and there has been at least one
well-publicized report of an outbound gateway service being duped into
accepting messages that impersonated its clients.

Whenever a third organization is in the flow path, the evaluator has these
realistic choices:

·        Reject the message if the intermediary is untrusted.

·        Authenticate the intermediary and ignore authentication issues for
the originating organization.

·        Attempt to look behind the interesults-SPF, and ARC Sets.

The last option is very difficult to implement even in specific cases.  In
the general case, it is essentially impossible, because the available data
is insufficient.   When a result can be computed, it will flag a lot of
legitimate and acceptable mail as suspect due to lack of authentication.
A large effort will be required to separate this large volume of false
positives from the small and possible non-existent volume of malicious
impersonation that may be hidden there.

Given all of this, possibly the most important contribution that ARC
provides is improved ability to know that an intermediary was involved, so
that the reputation of the intermediary can be evaluated, while also
ensuring that a DMARC result is not computed and applied inappropriately.

When the limitations of DMARC are understood, I cannot construct a scenario
where ARC data causes harm.