Re: [dmarc-ietf] Signaling MLMs

["Murray S. Kucherawy" <[e-mail]>]

On Fri, Apr 14, 2023 at 7:32 PM Jesse Thompson <[e-mail]> wrote:

> On Fri, Apr 14, 2023, at 7:17 PM, Murray S. Kucherawy wrote:
>
> The Sender's users being denied the ability to participate in a list due
> to its policies seems to me like it puts this customer service problem
> where it belongs.
>
>
> Let's say, tomorrow, IETF configures this list to reject Todd's mail (as
> well as for every other member with p=reject) and/or disables from
> rewriting. Does Todd's domain owner care? No.
>

This is where it breaks down for me.

What's the calculus here?  The domain owner decides that protecting its
name in this one targeted way is so valuable that it's fine with whatever
negative impact it has downstream?  And we're supposed to be OK with giving
this sort of approach a blanket green light by not declaring such use of
DMARC not interoperable?  And we're fine with giving their biz dev, PR,
legal, and all the other teams you named a pass on dealing with the
aftermath?  Because as I think you can see, those are not the teams in the
trenches figuring this out.

Why do you believe that the domain owner and its users shouldn't feel the
pain for such a decision?  That its customers go someplace else that does
care about these things?  Or that it has to split its mail flows into
something general purpose and something transactional in the name of
continued interoperability?

Before this domain turns on "p=reject", the MLM didn't have a customer
service problem.  Now it suddenly does, not through any change it made, but
rather because one of its subscriber's domains set that policy, and some
other subscriber's domain elects to enforce it.  Does that seem right to
you?  Because that's what all of this did to the IETF, for example.


> Todd cares. Todd can't argue with his CISO and IT security team and biz
> dev team and public relations team and legal team and all of the other
> forces that caused his domain owner to publish p=reject. But he can argue
> with IETF for making the decision to make the change, because he feels like
> the IETF considers him an important stakeholder.
>

So push on the smaller operator, not the ones imposing the change that
suddenly renders well established practices invalid.  That seems like the
right solution to you?

-MSK, participating