Re: [dmarc-ietf] Overall last-call comments on DMARC

["Murray S. Kucherawy" <[e-mail]>]

On Tue, Apr 2, 2024 at 3:01 AM Alessandro Vesely <[e-mail]> wrote:

> >> By now, most mailing lists arranged to either rewrite From: or not
> break
> >> DKIM signatures.  We all hope those hacks are temporary. >
> >
> > What do you mean by "temporary", given the time scales that have already
> > passed since RFC 7489 saw wide deployment?  Do you envision those
> > techniques ending sometime soon?
>
> Yeah, the time scale is killing us.  Is ten years soon enough?
>

You tell me.  You say you're hoping they're temporary, yet they've been
around a long time and I'm not sure that there's an alternative on the
table.  I'm asking you to explain.


> > If "most" mailing lists have arranged rewrites or non-mutation, and this
> > appears to be working, are there specific techniques we should
> standardize
> > here?
>
> I believe it's possible to leverage ARC so as to overcome those mailing
> lists
> hacks, for an expanding set of domains.  It is not difficult to modify ML
> software in order to rewrite and/or mutate on a per-user basis.  One can
> obtain
> the same effect with existing software if it provides for twin lists or
> similar
> means to split users into two categories.
>

This isn't consistent with your previous comment, which claimed that "most"
lists are already doing this.  Your language here is more like a proposal.
I'm having a hard time following.

What is it that you believe we should be telling industry to do?

> Are you suggesting we need some standard way to calculate and/or share a
> > sealer's reputation for any of this to work?
>
> Sealer's reputation is the same as domain reputation.  Good to have it,
> whenever it comes.
>

I interpreted your earlier remark to be a claim that this stuff won't work
absent such data.


> For ARC, I'd rather consider per-forwarder contracts.  Forwarding (of
> which MLs
> are a case) doesn't happen out of the blue.  It has to be set up.
> Involving
> the target receiver in the setup may make it trust the sender's seals,
> when
> they belong to the stream thus set up and identified.
>

So, a "contract" between each mailing list and each subscriber?  What would
that mean?

-MSK, p11g