Re: [dmarc-ietf] Overall last-call comments on DMARC

[Jim Fenton <[e-mail]>]

On 4 Apr 2024, at 12:08, Murray S. Kucherawy wrote:

> On Thu, Apr 4, 2024 at 12:02 PM Dotzero <[e-mail]> wrote:
>
>>
>>
>>>
>>> My overall point is that this thread makes it seem like we're not putting
>>> forward a complete solution.  It feels a lot more like a proposed standard
>>> that for its clear success depends on a bunch of other things that range
>>> from experimental to abstract to undefined.  And if that's a correct
>>> summary, I'm asking if that's what we really want to do.  It seems a little
>>> haphazard, like we're scrambling to tie together the loose ends of a movie
>>> plot.  We need to do a good job of bringing our audience to as solid a
>>> conclusion as possible, or the critics' reviews might not come out well.
>>>
>>
>> My response to your statement "... this thread makes it seem like we're
>> not putting forward a complete solution." is a complete solution to what?
>> It seems like people are trying to throw in everything but the kitchen
>> sink, including new proposals and rehashing old issues that were supposedly
>> settled, as we go through last call.
>>
>
> Yes, that's part of what I'm observing.  It's possibly a form of scope
> creep, and indeed "We should stop that" is one valid response.  :-)

I don’t think it’s scope creep at all. The WG charter puts “Review and refinement of the DMARC specification” in phase III, after “Specification of DMARC improvements to support indirect mail flows”. It seems clear to me that standards-track DMARC needs to incorporate those improvements.

IESG accepted ARC as an improvement to support indirect mail flows, and I think a complete solution needs to incorporate that. I wish there were better data to support advancing ARC to standards track, and not just from Google (it has to work for smaller players as well).

But I am troubled by the possibility that ARC might require domain reputation to avoid ARC header fields supporting From address spoofing. One reason it might work for Google is because they’re big enough to derive their own domain reputation. We’ve not had success with domain reputation at internet scale.

-Jim