[dmarc-ietf] Re: I-D Action: draft-ietf-dmarc-arc-to-historic-00.txt

[Dotzero <[e-mail]>]

On Mon, Apr 27, 2026 at 9:53 AM Todd Herr <todd=
[e-mail]> wrote:

>
> On Fri, Apr 24, 2026 at 2:12 PM Alessandro Vesely <[e-mail]> wrote:
>
>> On 24/04/2026 03:24, Murray S. Kucherawy wrote:
>> > On Thu, Apr 23, 2026 at 8:04 AM Alessandro Vesely <[e-mail]>
>> wrote:
>> >
>>
>> >> Section 3.2 is titled "ARC’s Core Lesson: Signatures Are Not Trust".
>> >> However, DMARC itself relies on trusting authenticated identifiers,
>> whether
>> >> established via cryptographic signatures or IP-based mechanisms.  For
>> >> direct messages, this model is generally effective. There is a
>> qualitative
>> >> difference, however, when identity is asserted transitively (e.g., in
>> >> forwarding scenarios): authentication alone does not convey the same
>> level
>> >> of trust. Informally, when an entity proves its own identity, this can
>> be
>> >> seen as a kind of “fixed point” of the trust function; this property
>> does
>> >> not hold when identity is asserted on behalf of a third party.
>> >
>> > I'm not sure I understand the claim here.   A DMARC "pass" is not
>> > predicated on trust (unless you only say DKIM passes for trusted
>> entities,
>> > for instance).  I mean, it could be, but the protocol doesn't require it
>> > (and how could it?).
>>
>>
>> Perhaps “trust” is not the most precise term here.  What I meant is that
>> a DMARC “pass” typically contributes positively to a message’s
>> evaluation (e.g., reducing its score).  While this is not a normative
>> requirement of the protocol, it is a common operational consequence of
>> successful authentication.
>>
>>
> The notion that a DMARC "pass" typically contributes positively to a
> message's evaluation is not only not a normative requirement of the
> protocol, it is in fact contrary to the text of both RFC 7489 and DMARCbis.
>
> RFC 7489 includes this text in the Abstract section:
>
> "DMARC does not produce or encourage elevated delivery privilege of authenticated
> email."
>
>
> DMARCbis, meanwhile, contains this text in the Introduction section:
>
> "A DMARC pass for a message indicates only that the use of the Author
> Domain has been validated for that message as authorized by the Domain
> Owner. Such authorization does not carry an explicit or implicit value
> assertion about that message or about the Domain Owner, and so a DMARC pass
> by itself does not guarantee that delivery to the recipient's Inbox would
> be safe or desirable."
>
>
> A DMARC pass allows one to evaluate the current message in the context of
> the authenticated identity's previous message sending history, but it does
> not and should not, by itself, ascribe a positive value to a message.
>
> --
> Todd
>

+1

Perfectly stated, Todd. Ascribing a positive value to a DMARC pass is a bad
and dangerous practice.