Re: [dmarc-ietf] Proposed text for p=reject and indirect mail flows

["Murray S. Kucherawy" <[e-mail]>]

On Fri, Apr 14, 2023 at 6:47 PM Douglas Foster <
[e-mail]> wrote:

> Unless a mailing list has controls in place to ensure that EVERY post
> comes from the asserted participant, it is the height of hypocrisy to ask
> an evaluator to assume that the post is from the asserted participant.
>  IETF cannot do even the easiest part of that task, so I have no reason to
> expect better elsewhere.
>

Nobody is asking the evaluator to assume anything.  That's what email
authentication is about; it shouldn't assume anything, and you only really
know something when you get a "pass".  Reacting harshly to a "fail" when
there are so many legitimate ways the current authentication schemes can
fail is folly.  But people are looking for silver bullets, so here we are.

A world free of fraudulent email is a laudable goal, of course.  But since
DMARC can only actually affect direct domain attacks, and makes no
discernible attempt to mitigate cousin domain or display name attacks to
which attackers can trivially switch, I think I'd like to see some proof
that it staves off enough of the darkness to be worth this level of defense.

-MSK, participating