IETF Logo Mail Archive

Re: [dmarc-ietf] Issue submission - Mailing list security and potential solutions using DMARC

John Levine <johnl@taugh.com> Tue, 15 September 2020 15:55 UTC

Return-Path: <johnl@iecc.com>
X-Original-To: dmarc@ietfa.amsl.com
Delivered-To: dmarc@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 304C63A0CA0 for <dmarc@ietfa.amsl.com>; Tue, 15 Sep 2020 08:55:13 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.451
X-Spam-Level:
X-Spam-Status: No, score=-1.451 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_INVALID=0.1, DKIM_SIGNED=0.1, HEADER_FROM_DIFFERENT_DOMAINS=0.249, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=no autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=fail (2048-bit key) reason="fail (message has been altered)" header.d=iecc.com header.b=ChiP7su7; dkim=fail (2048-bit key) reason="fail (message has been altered)" header.d=taugh.com header.b=qvKjIkBa
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id A9_VDyaXnMTh for <dmarc@ietfa.amsl.com>; Tue, 15 Sep 2020 08:55:11 -0700 (PDT)
Received: from gal.iecc.com (gal.iecc.com [IPv6:2001:470:1f07:1126:0:43:6f73:7461]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 361963A0C9E for <dmarc@ietf.org>; Tue, 15 Sep 2020 08:55:10 -0700 (PDT)
Received: (qmail 36418 invoked by uid 100); 15 Sep 2020 15:55:10 -0000
Date: Tue, 15 Sep 2020 15:55:10 -0000
Message-ID: <rjqo4u$114c$2@gal.iecc.com>
From: John Levine <johnl@taugh.com>
To: dmarc@ietf.org
DKIM-Signature: v=1; a=rsa-sha256; c=simple; d=iecc.com; h=date:message-id:from:to:subject:references:in-reply-to:cleverness; s=8e39.5f60e3de.k2009; i=news@user.iecc.com; bh=SIxVexWk9wpJWgjugJeMgQumtzvNvaj8QYJuj9GU/N0=; b=ChiP7su7iX1AQ6zmgcD/IhzzlPPrdcsDEdRm2fRII/OpH2SozKhzfqel0SdUZiTVLtWWuwwec3MAdOBuQINPSFwj5/zIoCKfNNh1nv3s6ipQjDd11z/zQ5V2KhMbhGyH+gfp431rzu98zwSCDqqi17qAfDY93iyjgfLbRUa2A65Z8iwyr5YByoe01Bdr4YMMI5Cpk5jUObiukJRMNQtZzP5e+KrY9PcONfkGCblwcnMiiWsCyPzN32px5ht1jY4VhjItYqMyD9JDr/qc2hiEbbpccZ0pfTKwae3iP23FNHXca0lj1hP2g7+MuJTCNfUK+6s+1+cqLCHc9JDgxXguFQ==
DKIM-Signature: v=1; a=rsa-sha256; c=simple; d=taugh.com; h=date:message-id:from:to:subject:references:in-reply-to:cleverness; s=8e39.5f60e3de.k2009; olt=news@user.iecc.com; bh=SIxVexWk9wpJWgjugJeMgQumtzvNvaj8QYJuj9GU/N0=; b=qvKjIkBaaU2NRW3OmsgWroTLQcAtj2jYY0hxQLzGN7MJ+auSuxekUpOe8aAUn1LKbgfmlVO8+0lUGrg/Ikti3gELgb2c5i37inuEX89crOWBMMQpYl/bqRuHZJ66lMY+dhkcbEQf9fQsPOXvKkrsYnvEyx/GVapaPyDuVuX9MQYGhG9voenuE6QQ83drJykhCU3sgqlN0FFrsnfjt+8SHgddKckTR9JG5VVO+sK5/GmBx+mCsriYILlAcoA8hN+PoYrNe6fJRPvZNaQHlxMD02rp/tHCe6Q7eUlHcntZz0RTTAIdiGg3zJqUkecHZStA1qjhL0JMokfqghs3tkYHHw==
Organization: Taughannock Networks
References: <CAL0qLwZEDNT+LZDMrzecSuTD794jn0CoXRA5FG=rk6QJXO5Hyg@mail.gmail.com> <20200913025842.1BBDD208C94C@ary.qy> <CAMSGcLDKRMbJ_30jZdKE_6hkKaktwBxU6_E=E=bnK2_CKMNEXw@mail.gmail.com>
In-Reply-To: <CAL0qLwZEDNT+LZDMrzecSuTD794jn0CoXRA5FG=rk6QJXO5Hyg@mail.gmail.com> <20200913025842.1BBDD208C94C@ary.qy> <CAMSGcLDKRMbJ_30jZdKE_6hkKaktwBxU6_E=E=bnK2_CKMNEXw@mail.gmail.com>
Cleverness: some
X-Newsreader: trn 4.0-test77 (Sep 1, 2010)
Originator: johnl@iecc.com (John Levine)
Archived-At: <https://mailarchive.ietf.org/arch/msg/dmarc/TwmsjLhyGv_8bR5oVzo7sruhQDw>
Subject: Re: [dmarc-ietf] Issue submission - Mailing list security and potential solutions using DMARC
X-BeenThere: dmarc@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: "Domain-based Message Authentication, Reporting, and Compliance \(DMARC\)" <dmarc.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/dmarc>, <mailto:dmarc-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/dmarc/>
List-Post: <mailto:dmarc@ietf.org>
List-Help: <mailto:dmarc-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/dmarc>, <mailto:dmarc-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 15 Sep 2020 15:55:13 -0000

In article <CAMSGcLDKRMbJ_30jZdKE_6hkKaktwBxU6_E=E=bnK2_CKMNEXw@mail.gmail.com>,
Joseph Brennan  <brennan@columbia.edu> wrote:
>"Domain administrators must not apply dmarc authentication to domains
>from which end users send mail that may be re-sent via lists or
>automatic forwarding."  -- done. Then dmarc will be simple and
>reliable, and bank statements and similar messages are protected as
>intended. Building in a standard workaround significantly weakens the
>whole concept, doesn't it?

Unfortunately, we have ample evidence that domain operators will
ignore that advice.

According to someone who was in the room when Yahoo flipped the
switch, the person in charge said words to the effect that I know this
will screw up everyone's mailing lists and I don't care.

R's,
John
-- 
Regards,
John Levine, johnl@taugh.com, Primary Perpetrator of "The Internet for Dummies",
Please consider the environment before reading this e-mail. https://jl.ly

v2.46.0 | Report a Bug | By Email | System Status