[dmarc-ietf] Re: Review of draft-ietf-dmarc-arc-to-historic

[Baptiste Carvello <[e-mail]>]

Hi,

Le 16/07/2026 à 08:19, Richard Clayton a écrit :
> 
>    *  Abuse of trusted chains: Attackers have been leveraging situations
>       where recipients trusted ARC chains by modifying email after an
>       initial attestation and then passing it to another entity which
>       trusted that attestation.  Assessing whether the email came
>       directly from the entity at the head of the ARC chain is complex
>       and assessing whether or not any changes to the email were made by
>       a trusted signer or a malicious third party has proved to be
>       impossible.

while this might be true, it also raises questions: isn't authentication
of _direct_ mail flows between good faith actors precisely what DMARC is
supposed to achieve. How could this be messed up?

It does seem that the main reason why ARC supposedly failed is that it
was only hurriedly and half-heartedly discussed on this list. I for one
remember that in the last year or two at least, the general tone on this
list was: "we need to focus on finishing DMARCbis, suggestions about
fixing indirect mail flows need to wait". And now suddenly it turned to:
"it's too late, let's give up and maybe start over somewhere else".

Is there reason to hope that the DKIM2 effort will do any better
regarding indirect mail flows, given its wide-encompassing focus?

Cheers,
B.

Nota Bene: yes, this might be border to off-topic (please keep the
subthread small). Still, that's the elephant in the room, and it had to
be said. Taking collective responsibility for a mess-up can be a useful
lesson from an experiment.