Re: [dmarc-ietf] Proposing an extension to DMARC to optionally require SPF and DKIM

John,

I'm going to combine your responses. Please bear with me to ensure I understand what you are saying.

> Nope.  As I said, Terry's proposal adds nothing beyond the configuration I described.
> Please reread the message to which you were responding more carefully, paying particular 
> attention to the difference between SPF pass and neutral.  Really, you gain nothing.
> 
> bigbank.com txt "v=spf1 +ip4:22.22.22.22 ?ip4:157.55.158.0/23 
> ?ip4:157.55.234.0/24 ?ip4:157.56.112.0/24 ~all"

example.com ------------+
                        |
BigBank.com ------------+----> Microsoft Forefront IPs ----> Internet
                        |
Learning.edu            |
 security@bigbank.com --+

Case 1 - Mail comes from 22.22.22.22 -> Forefront scans it and it SPF passes -> Relays to Internet (e.g., Hotmail) who scans it and it is Neutral (since it came from Forefront IP range)
Case 2 - Mail comes from 1.2.3.4 (Learning.edu malicious spoof) -> Forefront scans it and it SPF fails -> Relays to Internet (e.g., Hotmail) who scans it and it is Neutral

But real mail from BigBank.com would have a DKIM header and so therefore it would DMARC pass at the Hotmail side.

Is that right?

But wouldn't it mean that a 3rd party who didn't validate DKIM or DMARC would always get SPF Neutral in the case of a legitimate message?

> Or you can sign all your mail with DKIM, publish no SPF at all, and use DMARC p=reject.

I've thought of that, too. I think that would be a good solution if DMARC compliance was more widespread than it is (it's pretty good now but there's still a very long tail of receivers who just use SPF and don't validate DKIM... I don't want to mention any names but there's at least one large MTA that still doesn't validate DKIM natively). Thus, if you don't publish SPF records, for the long tail of receivers that don't do DKIM or DMARC, they are even more prone to spoofing since they wouldn't pass SPF.

> (If anyone used ADSP, you could use ADSP discardable.  too.)

I've thought of that, too. But I heard ADSP was basically dead and superseded by DMARC.

-- Terry

-----Original Message-----
From: dmarc-bounces@ietf.org [mailto:dmarc-bounces@ietf.org] On Behalf Of John Levine
Sent: Monday, April 01, 2013 5:48 PM
To: dmarc@ietf.org
Cc: fmartin@linkedin.com
Subject: Re: [dmarc-ietf] Proposing an extension to DMARC to optionally require SPF and DKIM

>If you want to say, nobody else can spoof me, then you can do SPF -all,

Or you can sign all your mail with DKIM, publish no SPF at all, and use DMARC p=reject.  (If anyone used ADSP, you could use ADSP discardable.  too.)

One of the strengths of DMARC is that SPF and DKIM are each optional, and senders can use them in whatever combination best describes their mail setup.

_______________________________________________
dmarc mailing list
dmarc@ietf.org
https://www.ietf.org/mailman/listinfo/dmarc