Re: [dmarc-ietf] Proposing an extension to DMARC to optionally require SPF and DKIM

["J. Gomez" <[e-mail]>]

On Tuesday, April 02, 2013 2:37 AM [GMT+1=CET], Franck Martin wrote:
> We did SPF or DKIM because both were not solving the problem on their
> own. So both combined together has all the advantages less the
> inconveniences. 
> 
> If you want to say, nobody else can spoof me, then you can do SPF
> -all, but then no large receiver never really trusted this policy
> assertion. Also, you can put a DMARC record and SPF and not DKIM
> sign, you will get the same benefits.

Hmm, are you missing the part where several independent clients send to the Internet through the same cloud-based email gateway, and therefore "-all" in SPF still allows for spoofing if any of those clients is trojanized, and DMARC in its current form does nothing to solve this problem?

Ok, DMARC has been devised by brand-companies (Facebook, Linkedin, Big-Bank-X) and mailbox-providers (Hotmail, Yahoo, Gmail), I see that and I understand their needs to reliably exchange email policies. But there is more people in the email ecosystem, like for example cloud-services providers, who also happen to do email.

I think the needs of everyone (exchanging email policies, and securing authentication in a multitenant cloud service) can be met easily with DMARC, without harm for any of those camps.

Regards,

J. Gomez