Re: [dmarc-ietf] Proposed rework of the wording in section 2.1 of draft-dmarc-interoperability

["Stephen J. Turnbull" <[e-mail]>]

Murray S. Kucherawy writes:
 > On Wed, Dec 9, 2015 at 9:19 AM, Stephen J. Turnbull <[e-mail]> wrote:

 >> I would add
 >>
 >>     The Authenticated Identifiers defined by these specifications need
 >>     bear no relationship ...

 > Do we think that's necessary here, or is that same advice which is
 > (I'm fairly sure) present in RFC6376 and RFC7208 sufficient?  I
 > guess another way to word that is: How independent is this work
 > from full understanding of those?

I've already expressed my opinion, but I hope I'll be forgiven a gloss
on my previous words.

In Mailman we have three levels of "ownership": *list*, (virtual)
*domain*, and *site* (host system).  Mailman list and domain owners
can choose their mitigation policies, and they need a guide.  I hope
this BCP can be written in a way that allows them to identify their
own use case, and choose an appropriate mitigation.  Needless to say,
almost all of them would find RFCs 6376 and 7208 useless, and many
site owners are in the same boat -- they don't really understand MTAs,
MIME, HTML (sorry, but yeah that's necessary), or digital signatures,
and most are kinda fuzzy on the roles of MUAs and the email header.
Mailman has already pretty much decided what mitigations we can and
will implement; I haven't seen anything else we need to do.

I suspect most indirect mailflow managers are in the same boat.  It
seems to me that more than the implementers themselves, it's going to
be system managers choosing implementations and channel managers
choosing behaviors who need refer to, and will benefit from, this BCP.

Steve