Re: [dmarc-ietf] Proposing an extension to DMARC to optionally require SPF and DKIM

["J. Gomez" <[e-mail]>]

On Tuesday, April 02, 2013 3:53 AM [GMT+1=CET], John Levine wrote:
> Right.  Since we know the same IP can emit both real and bogus
> messages and SPF can't tell the difference, what other result could
> you honestly provide?  Is it really a good idea to return an SPF pass
> for a message that might be a phish?

Yes, it would be a good idea to return an SPF pass, if and only if a standardized layer above SPF would require also a DKIM pass to build a final result of PASS.

Why? Because the probability of a trojanized AND spoofing client hosted in the same sending IP address is close to zero, but not equal to zero. To clear that marginal doubt, DKIM is needed. And to assert that policy requirement to others unaware of the particularities of that infraestructure, DMARC is need.

So the idea is this: if DMARC is in a layer above SPF and DKIM, lets plug in DMARC the holes anyone of those under it may have left open.

Yes, things could have been born perfect at once, but here we are and these issues we have. Why not patch them, if the solution is both within reach and cheap?

Regards,

J. Gomez