Re: [dmarc-ietf] Overall last-call comments on DMARC

["Murray S. Kucherawy" <[e-mail]>]

On Mon, Apr 1, 2024 at 4:44 AM Alessandro Vesely <[e-mail]> wrote:

> > * Mailing lists — Mailing list operators, including ietf.org, have had
> to
> > implement rewriting of From addresses such as [e-mail] becomes
> > user=[e-mail] when a p=strict or p=quarantine
> policy is in
> > place. This works to some extent for IETF, but there is an enormous
> number of
> > mailing list operators, each of whom would need to implement address
> rewriting.
> > While address rewriting is not the recommended solution, it is widely
> used
> > because of the widespread inappropriate use described above.
>
> By now, most mailing lists arranged to either rewrite From: or not break
> DKIM
> signatures.  We all hope those hacks are temporary.
>

What do you mean by "temporary", given the time scales that have already
passed since RFC 7489 saw wide deployment?  Do you envision those
techniques ending sometime soon?

If "most" mailing lists have arranged rewrites or non-mutation, and this
appears to be working, are there specific techniques we should standardize
here?


> ARC provides a protocol
> whereby a mailing list can certify its behavior to an end receiver.
> Unfortunately, we are still missing a protocol whereby trusting an ARC
> sealer
> can be established by a receiver for each mail stream.  We are halfway
> across
> the ford.
>

Are you suggesting we need some standard way to calculate and/or share a
sealer's reputation for any of this to work?

-MSK, p11g