IETF Logo Mail Archive

Re: [dmarc-ietf] easier DKIM, DMARC2 & SPF Dependency Removal

Alessandro Vesely <vesely@tana.it> Sat, 24 June 2023 11:04 UTC

Return-Path: <vesely@tana.it>
X-Original-To: dmarc@ietfa.amsl.com
Delivered-To: dmarc@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D3B22C1516E2 for <dmarc@ietfa.amsl.com>; Sat, 24 Jun 2023 04:04:20 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.097
X-Spam-Level:
X-Spam-Status: No, score=-2.097 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, NICE_REPLY_A=-0.001, RCVD_IN_DNSWL_BLOCKED=0.001, RCVD_IN_ZEN_BLOCKED_OPENDNS=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001, URIBL_DBL_BLOCKED_OPENDNS=0.001, URIBL_ZEN_BLOCKED_OPENDNS=0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=neutral reason="invalid (unsupported algorithm ed25519-sha256)" header.d=tana.it header.b="SuujKst1"; dkim=pass (1152-bit key) header.d=tana.it header.b="BSzsKvCX"
Received: from mail.ietf.org ([50.223.129.194]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id rH818qqtmtr9 for <dmarc@ietfa.amsl.com>; Sat, 24 Jun 2023 04:04:12 -0700 (PDT)
Received: from wmail.tana.it (wmail.tana.it [94.198.96.74]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange ECDHE (P-256) server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C64E2C151522 for <dmarc@ietf.org>; Sat, 24 Jun 2023 04:04:10 -0700 (PDT)
DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=tana.it; s=epsilon; t=1687604648; bh=x+mswscQ/B1nm0Df8V+rt9DJi0Lu38citljvNxoNIr4=; h=Author:Date:Subject:To:References:From:In-Reply-To; b=SuujKst1V7+4zOpylhnw8wVK5t+5e4+radQJEx2TSi+d8myhRhhOkJHB5lmVJXeBA JxlDpxCVzrsTXppWvPSDA==
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=tana.it; s=delta; t=1687604648; bh=x+mswscQ/B1nm0Df8V+rt9DJi0Lu38citljvNxoNIr4=; h=Date:Subject:To:References:From:In-Reply-To; b=BSzsKvCXvs5OTnFf8WfXQRgSyGEN7AYpI1eUt9/kV+Naq0S38rUD4tlPJo9Bq+PKV FJSgQeXLGtzfDcmP/1gu/EXb5TFAmuIDh+xNsA5o9ZaGeQbvYr+HKl1J642uWKhN7h q/BauTWQeBouDZQgw0UJWM/91WFPhg3auEQ9Z8MREJ24Qct6IX8ocZDL3lae7
Original-Subject: Re: [dmarc-ietf] easier DKIM, DMARC2 & SPF Dependency Removal
Author: Alessandro Vesely <vesely@tana.it>
Received: from [172.25.197.111] (pcale.tana [172.25.197.111]) (AUTH: CRAM-MD5 uXDGrn@SYT0/k, TLS: TLS1.3, 128bits, ECDHE_RSA_AES_128_GCM_SHA256) by wmail.tana.it with ESMTPSA id 00000000005DC033.000000006496CDA7.000022CF; Sat, 24 Jun 2023 13:04:07 +0200
Message-ID: <e0bc3c28-aa0f-2a9c-afd0-8b90e6b82510@tana.it>
Date: Sat, 24 Jun 2023 13:04:07 +0200
MIME-Version: 1.0
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:102.0) Gecko/20100101 Thunderbird/102.11.0
Content-Language: en-US, it-IT
To: Barry Leiba <barryleiba@computer.org>, dmarc@ietf.org
References: <CABZJ8kmg75qo70V-N65b6C4w+g7gX0ehv3CsqG-765BbBGcn=A@mail.gmail.com> <20230623021810.E5F8DF9B3B94@ary.qy> <CAFcYR_WY8MEag7sup_7DnmzRuZJ7zeyJT6TATL45wCKBrsF3UQ@mail.gmail.com> <bfbe77ad-8aba-d803-de06-d734a177066b@taugh.com> <CAFcYR_U=qW0k5EC2_y+B1roXK91uzscT+vS5Y7jrNkG1bTxw5Q@mail.gmail.com> <c1b091c1-86a9-d3e3-5fcb-0b8d7d33fcf2@taugh.com> <CALaySJ+tKTCEJcNR0ehCNq6rGz-ARe=P72OTgOuKoAj1G1zjmA@mail.gmail.com> <024535ba-5845-fe35-5cfe-1302bae55659@taugh.com> <CALaySJJZ7rvQ72MRMJLpOF7+LffBYcoTqCaDV3FM+YZdGWMs2Q@mail.gmail.com>
Authentication-Results: tana.it; auth=pass (details omitted)
From: Alessandro Vesely <vesely@tana.it>
In-Reply-To: <CALaySJJZ7rvQ72MRMJLpOF7+LffBYcoTqCaDV3FM+YZdGWMs2Q@mail.gmail.com>
Content-Type: text/plain; charset="UTF-8"; format="flowed"
Content-Transfer-Encoding: 7bit
Archived-At: <https://mailarchive.ietf.org/arch/msg/dmarc/RV_MkW2dvNEw924B_q5ZpRL04Gs>
Subject: Re: [dmarc-ietf] easier DKIM, DMARC2 & SPF Dependency Removal
X-BeenThere: dmarc@ietf.org
X-Mailman-Version: 2.1.39
Precedence: list
List-Id: "Domain-based Message Authentication, Reporting, and Compliance \(DMARC\)" <dmarc.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/dmarc>, <mailto:dmarc-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/dmarc/>
List-Post: <mailto:dmarc@ietf.org>
List-Help: <mailto:dmarc-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/dmarc>, <mailto:dmarc-request@ietf.org?subject=subscribe>
X-List-Received-Date: Sat, 24 Jun 2023 11:04:20 -0000

On Fri 23/Jun/2023 22:56:59 +0200 Barry Leiba wrote:
> If the DMARC spec makes that clear, I think we win.  And recipients
> can still do what they want: if DMARCbis goes out with "use DKIM only"
> and a recipient wants to use SPF anyway, they can do that... just as a
> recipient that decides to use best-guess-SPF in the absence of actual
> SPF records is free to make that choice.


As old as DKIM is, it's still too young to be provided for in MTA design.  The 
software I use, for example, allows filters on incoming mail.  Messages are 
signed before going in the queue.  That means that signatures are broken in the 
(rare) event of 7-bit conversion, and DSNs generated on the fly are not signed 
at all.

If we want DMARC to brand authentication, we'd better add than remove mechanisms.


Best
Ale
--

v2.23.0 | Report a Bug | By Email