Re: [dmarc-ietf] ARC questions

[Todd Herr <[e-mail]>]

On Mon, Nov 23, 2020 at 12:02 PM Dave Crocker <[e-mail]> wrote:

> On 11/23/2020 7:38 AM, Todd Herr wrote:
>
> On Mon, Nov 23, 2020 at 9:50 AM Joseph Brennan <[e-mail]>
> wrote:
> On Sat, Nov 21, 2020 at 7:14 PM John Levine <[e-mail]> wrote:
>
>>
>>
>>> This also means that ARC isn't useful if you don't have a reputation
>>>> system to tell you where the lists and other forwarders that might add
>>>> legit ARC signatures are.
>>>>
>>>
>> And if you know which hosts are legit mailing lists or forwarders, you
>> already know what ARC would tell you.
>>
>
> I believe, though, that the intent of ARC is that it be scalable in ways
> that manual enumeration of known legit mailing lists and forwarders is not.
>
>
> "if you know which hosts are legit" buries an assumption that is
> problematic, namely that you know who handled the message.  The fack that a
> message purports to be handled by a mailing list you trust does not mean it
> actually was.
>
> That's the issue that ARC resolves.
>
> ARC (and DKIM) produce noise-free uses of identifiers.  If the
> authentication validates, the receiver knows is really was handled by who
> is saying it was handled by.  Without these, you don't.
>
>
> Yes, but knowing it really was handled by who is saying it was handled by
isn't the entirety of the problem.

I can know from ARC headers that X handled the message and what email
authentication checks X purports to have done when handling the message and
what results X claims to have obtained. What I have to decide in that case
is "do I trust X to record correct and valid results?" because the answer
to that question will impact my disposition of the message when it reaches
me.

It's obviously not the place of the ARC protocol spec to proscribe how
trust in ARC results can be determined, but without some system in place
for assigning trust levels to ARC Sealers, ARC has limited utility for
sites that serve as the terminal destination for a message.

-- 

*Todd Herr* | Sr. Technical Program Manager
*e:* [e-mail]
*p:* 703.220.4153


This email and all data transmitted with it contains confidential and/or
proprietary information intended solely for the use of individual(s)
authorized to receive it. If you are not an intended and authorized
recipient you are hereby notified of any use, disclosure, copying or
distribution of the information included in this transmission is prohibited
and may be unlawful. Please immediately notify the sender by replying to
this email and then delete it from your system.