Re: [dmarc-ietf] External review of draft-kucherawy-dmarc-base-01

[Franck Martin <[e-mail]>]

----- Original Message -----

> From: "Jim Fenton" <[e-mail]>
> To: "Murray S. Kucherawy" <[e-mail]>
> Cc: [e-mail]
> Sent: Friday, December 6, 2013 3:22:25 PM
> Subject: Re: [dmarc-ietf] External review of draft-kucherawy-dmarc-base-01

> A few reply responses inline.

> On 12/3/13 12:26 AM, Murray S. Kucherawy wrote:

> > > "If the RFC5322.From domain does not exist...": This specifies an action
> > 
> 
> > > that has nothing to do with DMARC. I don't know the history of this but
> > 
> 
> > > it seems like if there was going to be some global "you SHOULD reject
> > 
> 
> > > messages with a nonexistent From domain" action, it belongs someplace
> > 
> 
> > > like RFC 5322, not here. See also comment under A.4.
> > 
> 

> > I agree that RFC5322 doesn't establish this requirement. We're saying that
> > a
> > DMARC implementation needs to take this action as it, along with normal
> > DMARC operation, defeats spoof attempts.
> 

> Although this is an exceedingly rare usage, I still wonder whether this (and
> not 5322) is an appropriate place to place additional restrictions on
> otherwise-legal mail.

> In the event that the message is rejected during an SMTP transaction, should
> there be an error code specified for this?

There may be a BCP to discuss a bit more about it. Also I think we need to stress more these cases in security considerations or inline. 

However, RFC5322 section 3.6 says there must be one and only one From: header for the message to be "valid". So we can point to this rule and say something like with DMARC you should enforce that, and not be lenient ( http://tools.ietf.org/html/draft-ietf-appsawg-malformed-mail-11 section 1.1 second paragraph) 

Moreover RFC5322 says: 
from            =   "From:" mailbox-list CRLF 
So there must be at least one domain name in this Field. Once again, you can be less lenient here. Not DMARC role, here, but you can point back to this RFC and say stop to be lenient. 

However, IEA RFC 6854, states, that 
from = "From:" (mailbox-list / address-list) CRLF 
is ok between non IEA aware MTAs (section 3). I did not like the change of the From: header because it increases uncertainty in emails. Fortunately it is limited in scope, so once you have an MTA that can do IEA, you can enforce the mailbox-list again . 
Now closer to your point, I don't think any RFC states that the domain name found in the From: must exists or even be mildly "emailable", this is a "common" check you may do for the envelope from (cf http://spamassassin.apache.org/tests_3_3_x.html NO_DNS_FOR_FROM ). It is not common for the From: header but this is something DMARC could point out as something worth considering. 

Finally, you can't imagine what you find in bounces... All the badness , breakages are there... (or nearly).