Re: [dmarc-ietf] Sender vs From Addresses

[Gren Elliot <[e-mail]>]

Hi,

For better or worse, there is long established practice in the Calendaring community when implementing iMIP (rfc6047) when an assistant is working on behalf of a manager for the manager’s email address to populate the “From:” header and the assistant’s email address to populate the “Sender:” header.  Mailing software seems to go to lengths to follow this convention even when it doesn’t do so for other email messages “sent on behalf of”.  I assume this means that things will break somewhere if this convention isn’t followed for at least some peoples calendaring software.

So, it looks like at the moment people will need to make a choice between enforcing DMARC and having calendaring software continue to function.

Surely it is possible to offer different levels of DMARC enforcement where there is a level that forces using the “From:” header and a newer level which follows the existing email standards for validating who the author is – i.e. use “Sender:” if present, else use “From:”?

Alternatively, we really ought to update the Email RFCs to deprecate the “Sender:” header.  Otherwise you effectively have canonical standards from the same standards body which flatly contradict each other.

Software and standards layered on top of email like iMIP would also need similar updates.  .  I’m not actually recommending this – whilst we might design things differently now, the existing practice with “From:” and “Sender:” makes sense to me and the level of complexity with dealing with this seems trivial compared to other things we need to deal with.

Regards,
Gren