Re: [dmarc-ietf] ARC-Seal is meaningless security theatre

[Bron Gondwana <[e-mail]>]

On Thu, 17 Aug 2017, at 10:34, Seth Blank wrote:
> On Wed, Aug 16, 2017 at 5:21 PM, Bron Gondwana
> <[e-mail]> wrote:>> The only way you could even hope (as a mailing list) to avoid
>> rewriting the sender is for every site that currently has DMARC
>> p=reject to change that to a new policy which explicitly means "only
>> reject if no ARC chain" - otherwise you can't stop rewriting sender
>> until you know that every receiver on your list is ARC-aware.> 
> I don't understand your point.

If you are a mailing list and you receive a message from a domain with
DMARC p=reject, you can't send that message on to the members of your
list without rewriting the sender.
> The only way DKIM works is if enough receivers validate it.
> 
> The only way adding elliptic curve to DKIM works is if enough
> receivers validate it.> 
> The only way a DMARC policy works is if enough receivers validate it.> 
> ARC is the explicit solution to mailing list breakage with DMARC.
> But, as with all other IETF RFCs, only works if enough receivers
> validate it.> 
> Our job is to make sure ARC accomplishes its goals under the DMARC
> charter, and demonstrate value to receivers that it's worthwhile to
> implement.> 
> There will always be a ramp up and implementation phase, that is a
> feature, not a bug, and not a reason to say "it won't work."
While there exists A SINGLE SITE which is ARC-unaware and DMARC p=reject
aware, you can't use ARC on a DMARC p=reject domain without rewriting
the sender.  Otherwise that site will bounce the email.
You still have to rewrite the sender until there is either full adoption
or sufficient adoption that you just don't care about the stragglers.
ARC doesn't solve that unless every receiver is either ARC-aware or DMARC-
unaware.  Hence the suggestion that I think Hector is making - to define
a new policy p=rejectnonarc or something, which means that sites which
are ARC-unaware accept rather than reject.
Bron.


--
  Bron Gondwana, CEO, FastMail Pty Ltd
  [e-mail]