Re: [dmarc-ietf] Proposing an extension to DMARC to optionally requireSPF and DKIM

[Elizabeth Zwicky <[e-mail]>]

On Apr 1, 2013, at 4:15 PM, J. Gomez wrote:

> -- makes DMARC more resilient in case any of its underliying authentications mechanisms becomes compromised/broken/moot in the future.

It's not clear to me that this is usefully true.

Let us pretend that DKIM is broken -- you can forge a DKIM signature for anybody you like.

Anybody who needed a DMARC 'both' option before is now out of luck -- DMARC can always pass, so they are vulnerable to whatever problem they would have been vulnerable to without it.

Anybody who actually needed the current DMARC 'any' option is also out of luck, because they can't go to 'both'. 

Only the tiny minority of people who can use 'both' but don't actually need to remain protected, and the net result is that the standard is unusable. There is some benefit, but it is not enough to be worth any significant cost, and adding a new option is a big implementation cost.

	Elizabeth