IETF Logo Mail Archive

Re: [dmarc-ietf] easier DKIM, DMARC2 & SPF Dependency Removal

Hector Santos <hsantos@isdg.net> Tue, 27 June 2023 18:58 UTC

Return-Path: <hsantos@isdg.net>
X-Original-To: dmarc@ietfa.amsl.com
Delivered-To: dmarc@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8E1F6C14CE51 for <dmarc@ietfa.amsl.com>; Tue, 27 Jun 2023 11:58:47 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.096
X-Spam-Level:
X-Spam-Status: No, score=-2.096 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HTML_MESSAGE=0.001, RCVD_IN_ZEN_BLOCKED_OPENDNS=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001, URIBL_DBL_BLOCKED_OPENDNS=0.001, URIBL_ZEN_BLOCKED_OPENDNS=0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=isdg.net header.b="bFSXavj2"; dkim=pass (1024-bit key) header.d=beta.winserver.com header.b="07aXyfsu"
Received: from mail.ietf.org ([50.223.129.194]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 7gNc8fyMqtTK for <dmarc@ietfa.amsl.com>; Tue, 27 Jun 2023 11:58:43 -0700 (PDT)
Received: from mail.winserver.com (mail.winserver.com [3.137.120.140]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 1FE26C14CE2B for <dmarc@ietf.org>; Tue, 27 Jun 2023 11:58:43 -0700 (PDT)
DKIM-Signature: v=1; d=isdg.net; s=tms1; a=rsa-sha256; c=simple/relaxed; l=3865; t=1687892314; atps=ietf.org; atpsh=sha1; h=Received:Received:Received:Received:From:Subject:Date: Message-Id:To:Organization:List-ID; bh=oTjd4UpSsfCwuG1AxnPSWuEcg pCAYWi+7r2xRbdf9pY=; b=bFSXavj24rl9ZydLMw/KjQa1I6kwvEE6E235U8wPR mSL77Y7sUHVHnmOLI0Wqv+MQ5x28ED0rXNvOA5IHaAv6D6dxzvaHQCFmHNiKaE8X C3lw3HwTe/EpMXXAv2KVpM3P62u7cnCZlgsQYl0Un21xd4CRU748RngHPeLdHJCq /A=
Received: by winserver.com (Wildcat! SMTP Router v8.0.454.13) for dmarc@ietf.org; Tue, 27 Jun 2023 14:58:34 -0400
Authentication-Results: dkim.winserver.com; dkim=pass header.d=beta.winserver.com header.s=tms1 header.i=beta.winserver.com; adsp=none author.d=isdg.net signer.d=beta.winserver.com; dmarc=pass policy=reject author.d=isdg.net signer.d=beta.winserver.com (atps signer);
Received: from beta.winserver.com ([3.132.92.116]) by winserver.com (Wildcat! SMTP v8.0.454.13) with ESMTP id 3990026036.1.5884; Tue, 27 Jun 2023 14:58:34 -0400
DKIM-Signature: v=1; d=beta.winserver.com; s=tms1; a=rsa-sha256; c=simple/relaxed; l=3865; t=1687892312; h=Received:Received:From: Subject:Date:Message-Id:To:Organization:List-ID; bh=oTjd4UpSsfCw uG1AxnPSWuEcgpCAYWi+7r2xRbdf9pY=; b=07aXyfsucRastj0E6jpPks6+qN3Q NoRA3lfeIYWtD48JSvtkyhD69HKIBNQsfysk7/w5Pnk9Lwjo1BkpFlm6PmKTmuN1 jiRNafZsEAbRHWxWnYn4RuQB6wz2v5R64MQd2KYAKEjkjL15TZlhnNPTAmzrttWv eTAAB3L+iNpaTpQ=
Received: by beta.winserver.com (Wildcat! SMTP Router v8.0.454.12) for dmarc@ietf.org; Tue, 27 Jun 2023 14:58:32 -0400
Received: from smtpclient.apple ([99.122.210.89]) by beta.winserver.com (Wildcat! SMTP v8.0.454.12) with ESMTP id 141114803.1.19424; Tue, 27 Jun 2023 14:58:32 -0400
From: Hector Santos <hsantos@isdg.net>
Content-Type: multipart/alternative; boundary="Apple-Mail=_46C6DB23-48A7-4A82-A6E2-F36AD5E5F63E"
Mime-Version: 1.0 (Mac OS X Mail 16.0 \(3731.400.51.1.1\))
Date: Tue, 27 Jun 2023 14:58:21 -0400
In-Reply-To: <89f982c1d43140ed9a07ce11135562e9@1und1.de>
Cc: "dmarc@ietf.org" <dmarc@ietf.org>
References: <20230623021810.E5F8DF9B3B94@ary.qy> <6495D504.4090809@isdg.net> <839aa10b-f7fa-c7a2-76db-6441189afca2@dusatko.org> <CALaySJ+gcVvpzJcrpUbOkOvjUFAhzw=pZovpZC7BhW_x7VW7nA@mail.gmail.com> <CAL0qLwasxzqJt7Hr7gZd86C=ivCrDUci_i6pkJJUTnqzL1pHMA@mail.gmail.com> <CALaySJ+gjR6D-OSE_07iSH2zXa7wypUQwPN1cL-1s+NC2S4L8g@mail.gmail.com> <99e1ef2d-053b-8cfe-f369-fa8475d142ae@tana.it> <CALaySJKZoAPTT-+cZEww+y2eUsDbNXcybb=Z7RxNLyfzPMr7ng@mail.gmail.com> <89f982c1d43140ed9a07ce11135562e9@1und1.de>
Message-Id: <C26E8DFB-62C0-41EB-A680-DB1193554C6C@isdg.net>
X-Mailer: Apple Mail (2.3731.400.51.1.1)
X-Comment: Missing recipient address appended by wcSMTP router.
To: dmarc@ietf.org
Archived-At: <https://mailarchive.ietf.org/arch/msg/dmarc/IrPFATCO-p3DR9hbQiihW7EhJ0c>
Subject: Re: [dmarc-ietf] easier DKIM, DMARC2 & SPF Dependency Removal
X-BeenThere: dmarc@ietf.org
X-Mailman-Version: 2.1.39
Precedence: list
List-Id: "Domain-based Message Authentication, Reporting, and Compliance \(DMARC\)" <dmarc.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/dmarc>, <mailto:dmarc-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/dmarc/>
List-Post: <mailto:dmarc@ietf.org>
List-Help: <mailto:dmarc-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/dmarc>, <mailto:dmarc-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 27 Jun 2023 18:58:47 -0000

+1

> On Jun 27, 2023, at 11:06 AM, Tobias Herkula <tobias.herkula=401und1.de@dmarc.ietf.org> wrote:
> 
> Signing That, nothing to add.
> 
> -----Original Message-----
> From: dmarc <dmarc-bounces@ietf.org> On Behalf Of Barry Leiba
> Sent: Tuesday, June 27, 2023 4:24 PM
> To: Alessandro Vesely <vesely@tana.it>
> Cc: dmarc@ietf.org
> Subject: Re: [dmarc-ietf] easier DKIM, DMARC2 & SPF Dependency Removal
> 
> I don't understand how most of your message fits into this discussion:
> you're comparing SPF's policy points with DMARC policy.  we're talking about SPF as an authentication mechanism together with DKIM (not
> DMARC) as an authentication mechanism... and then using those authentication results in DMARC policy evaluation.
> 
> But here: I've said all this before in separate places, so I'll put it in one place, here, one more time:
> 
> Given that SPF and DKIM are both configured properly:
> 1. If SPF passes, DKIM will always pass.
> 2. If DKIM fails, SPF will always fail.
> 3. In some scenarios, DKIM will pass when SPF fails.

Yes, since SPF comes first, by far, in my empirical field experience, if SPF fails, odds are good DKIM will fail.   But if DKIM passes, then it can be interesting to see if this can fix a false positive with SPF.

—
HLS

v2.23.0 | Report a Bug | By Email