IETF Logo Mail Archive

Re: [dmarc-ietf] Is From spoofing an interoperability issue or not?

Hector Santos <hsantos@isdg.net> Tue, 18 April 2023 21:19 UTC

Return-Path: <hsantos@isdg.net>
X-Original-To: dmarc@ietfa.amsl.com
Delivered-To: dmarc@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id EEA7EC151544 for <dmarc@ietfa.amsl.com>; Tue, 18 Apr 2023 14:19:34 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.097
X-Spam-Level:
X-Spam-Status: No, score=-2.097 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_ZEN_BLOCKED_OPENDNS=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001, URIBL_DBL_BLOCKED_OPENDNS=0.001, URIBL_ZEN_BLOCKED_OPENDNS=0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=isdg.net header.b="H1QgmwO6"; dkim=pass (1024-bit key) header.d=beta.winserver.com header.b="uBFWXMUU"
Received: from mail.ietf.org ([50.223.129.194]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id uXy-lYQOxxov for <dmarc@ietfa.amsl.com>; Tue, 18 Apr 2023 14:19:30 -0700 (PDT)
Received: from mail.winserver.com (mail.winserver.com [3.137.120.140]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3EC94C14CE31 for <dmarc@ietf.org>; Tue, 18 Apr 2023 14:19:30 -0700 (PDT)
DKIM-Signature: v=1; d=isdg.net; s=tms1; a=rsa-sha256; c=simple/relaxed; l=731; t=1681852761; atps=ietf.org; atpsh=sha1; h=Received:Received:Received:Received:Subject:From:Date: Message-Id:To:Organization:List-ID; bh=ycubI7xs60H2ww6WmUwmBVKFS 1aZRNQ0wHsUgPqdKFM=; b=H1QgmwO6m57fzV4w1Q9tz0vD3qCMvXcAXjkXNRHjU KO8ltVdkxS5ARQDCvHAeseWSawJ8GzxkQvA4lUcga7ymVs/1L+PkmNE6a7dQ3lDb J93iV6m4TJWKXTQl9lVMzrm36jisMue/Qlt8JK9el0zJkgAQZfTZChop/lkeMqJa h4=
Received: by winserver.com (Wildcat! SMTP Router v8.0.454.13) for dmarc@ietf.org; Tue, 18 Apr 2023 17:19:21 -0400
Authentication-Results: dkim.winserver.com; dkim=pass header.d=beta.winserver.com header.s=tms1 header.i=beta.winserver.com; adsp=none author.d=isdg.net signer.d=beta.winserver.com; dmarc=pass policy=reject author.d=isdg.net signer.d=beta.winserver.com (atps signer);
Received: from beta.winserver.com ([3.132.92.116]) by winserver.com (Wildcat! SMTP v8.0.454.13) with ESMTP id 2245551754.1.4724; Tue, 18 Apr 2023 17:19:20 -0400
DKIM-Signature: v=1; d=beta.winserver.com; s=tms1; a=rsa-sha256; c=simple/relaxed; l=731; t=1681852758; h=Received:Received: Subject:From:Date:Message-Id:To:Organization:List-ID; bh=ycubI7x s60H2ww6WmUwmBVKFS1aZRNQ0wHsUgPqdKFM=; b=uBFWXMUUft/AtLVUd5qu0WV VN+AWNjo6CHBMqh0QGZCbg0r9MmfBBN/KXEvE/POz7FAbKeHhYVz2yF5tU9o/hYP ziEYJcw+mIc9ULp4GcdLAQ3f9SzGoOiG7D7xUljjIAoQ88y/qp4bG4zTecBV3lxb ITqV4/FH+Yh904tGWrPU=
Received: by beta.winserver.com (Wildcat! SMTP Router v8.0.454.12) for dmarc@ietf.org; Tue, 18 Apr 2023 17:19:18 -0400
Received: from smtpclient.apple ([99.122.210.89]) by beta.winserver.com (Wildcat! SMTP v8.0.454.12) with ESMTP id 2691588926.1.11532; Tue, 18 Apr 2023 17:19:17 -0400
Content-Type: text/plain; charset="utf-8"
Mime-Version: 1.0 (Mac OS X Mail 16.0 \(3731.400.51.1.1\))
From: Hector Santos <hsantos@isdg.net>
In-Reply-To: <c75c4a1e-571f-af22-8520-4d924a7ef113@tana.it>
Date: Tue, 18 Apr 2023 17:19:06 -0400
Cc: IETF DMARC WG <dmarc@ietf.org>
Content-Transfer-Encoding: quoted-printable
Message-Id: <BFA68B0F-2516-4EFD-A06E-277E8B613DC4@isdg.net>
References: <4FD1C711-7A7D-40E5-88DE-95CDD248F92B@wordtothewise.com> <20230417160520.0398EBF3F4F7@ary.qy> <CAJ4XoYenNNNaiWJooioZDo9GhKUgZ2G+CmHSpXmt4jm9OD1ueg@mail.gmail.com> <c75c4a1e-571f-af22-8520-4d924a7ef113@tana.it>
To: Alessandro Vesely <vesely@tana.it>
X-Mailer: Apple Mail (2.3731.400.51.1.1)
Archived-At: <https://mailarchive.ietf.org/arch/msg/dmarc/O-f9oMvDXTt9TvyJBg_zw1tDORE>
Subject: Re: [dmarc-ietf] Is From spoofing an interoperability issue or not?
X-BeenThere: dmarc@ietf.org
X-Mailman-Version: 2.1.39
Precedence: list
List-Id: "Domain-based Message Authentication, Reporting, and Compliance \(DMARC\)" <dmarc.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/dmarc>, <mailto:dmarc-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/dmarc/>
List-Post: <mailto:dmarc@ietf.org>
List-Help: <mailto:dmarc-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/dmarc>, <mailto:dmarc-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 18 Apr 2023 21:19:35 -0000

On Apr 18, 2023, at 1:11 PM, Alessandro Vesely <vesely@tana.it> wrote:
> 
> Perhaps when DMARC will work smoothly, someone will find out how to tell legitimate rewriting from plain spoof.
> 

Lookup DMARC record and begin to piggy back off this lookup:

- Check for rewrite=1 tag indicating allowance to rewrite. 

- Check for asl= or atps=y signer authorization.

If the domain tells the resigner he can destroy the authorship, you now have a legitimate protocol negotiated handshake/contract. I prefer if there was an explicit authorization using asl= or atps=y, but an open ended rewrite=1 tag is fine, I think.  It is permission the domain is giving to resigners.

—
HLS

v2.23.0 | Report a Bug | By Email