Re: [dmarc-ietf] easier DKIM, DMARC2 & SPF Dependency Removal

Hector Santos <hsantos@isdg.net> Thu, 22 June 2023 20:23 UTC

Return-Path: <hsantos@isdg.net>
X-Original-To: dmarc@ietfa.amsl.com
Delivered-To: dmarc@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 036ECC14CE27 for <dmarc@ietfa.amsl.com>; Thu, 22 Jun 2023 13:23:51 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.096
X-Spam-Level:
X-Spam-Status: No, score=-2.096 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HTML_MESSAGE=0.001, RCVD_IN_ZEN_BLOCKED_OPENDNS=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001, URIBL_DBL_BLOCKED_OPENDNS=0.001, URIBL_ZEN_BLOCKED_OPENDNS=0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=isdg.net header.b="ST4lhzj0"; dkim=pass (1024-bit key) header.d=beta.winserver.com header.b="UT0D/2d+"
Received: from mail.ietf.org ([50.223.129.194]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 9I1lV8_OXhDA for <dmarc@ietfa.amsl.com>; Thu, 22 Jun 2023 13:23:46 -0700 (PDT)
Received: from mail.winserver.com (mail.winserver.com [3.137.120.140]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 9DD68C14CE38 for <dmarc@ietf.org>; Thu, 22 Jun 2023 13:23:46 -0700 (PDT)
DKIM-Signature: v=1; d=isdg.net; s=tms1; a=rsa-sha256; c=simple/relaxed; l=4050; t=1687465421; atps=ietf.org; atpsh=sha1; h=Received:Received:Received:Received:From:Message-Id:Subject: Date:To:Organization:List-ID; bh=Et0ky/Aemas13WyHFUZT81CK73IpUTL 6UUb0itn26qA=; b=ST4lhzj0j0+VQoruycTfajCfeJ2vlNZCJlBRZ/Q3X/YOCaS 85uDHeejy0rHIWWOdwX84itcX8Sqk44WyvzOx1ljI+ezrJg6QwJHz7GBw1UUwUR+ 1f7HvL8bC04CWBcqTSkQStNwxJN4j59J+AFyd41VyFXrOGqHYmtX+pgbVf0M=
Received: by winserver.com (Wildcat! SMTP Router v8.0.454.13) for dmarc@ietf.org; Thu, 22 Jun 2023 16:23:41 -0400
Authentication-Results: dkim.winserver.com; dkim=pass header.d=beta.winserver.com header.s=tms1 header.i=beta.winserver.com; adsp=none author.d=isdg.net signer.d=beta.winserver.com; dmarc=pass policy=reject author.d=isdg.net signer.d=beta.winserver.com (atps signer);
Received: from beta.winserver.com ([3.132.92.116]) by winserver.com (Wildcat! SMTP v8.0.454.13) with ESMTP id 3563139755.1.8232; Thu, 22 Jun 2023 16:23:39 -0400
DKIM-Signature: v=1; d=beta.winserver.com; s=tms1; a=rsa-sha256; c=simple/relaxed; l=4050; t=1687465414; h=Received:Received:From: Message-Id:Subject:Date:To:Organization:List-ID; bh=Et0ky/Aemas1 3WyHFUZT81CK73IpUTL6UUb0itn26qA=; b=UT0D/2d+hbvH14yzkYcfRZWLUH4q SDvo26ol28HEWb73U/Sgd7TvlECHwH6BYjLl7fVSqVeJ9KD3PhykglQtSozW3NCP StzxyqbkN5ANyHKiHlJdgeXui8/5ZAogK7pAfyGLBjc0Acppgo2kufg2ZEHo3lGW KMdjpABls7E/OIQ=
Received: by beta.winserver.com (Wildcat! SMTP Router v8.0.454.12) for dmarc@ietf.org; Thu, 22 Jun 2023 16:23:34 -0400
Received: from smtpclient.apple ([70.230.12.88]) by beta.winserver.com (Wildcat! SMTP v8.0.454.12) with ESMTP id 4009189974.1.11812; Thu, 22 Jun 2023 16:23:33 -0400
From: Hector Santos <hsantos@isdg.net>
Message-Id: <7F25BC09-3F26-49AC-9506-5451CEA2264F@isdg.net>
Content-Type: multipart/alternative; boundary="Apple-Mail=_D1F872D8-998E-4588-BD23-738D6C7B8E29"
Mime-Version: 1.0 (Mac OS X Mail 16.0 \(3731.400.51.1.1\))
Date: Thu, 22 Jun 2023 16:23:22 -0400
In-Reply-To: <CALaySJJ7_v6k63mcPOn7HnqXSnkFZhuK70M-LtpVvSYzzObtKQ@mail.gmail.com>
Cc: "Murray S. Kucherawy" <superuser@gmail.com>, IETF DMARC WG <dmarc@ietf.org>
To: Barry Leiba <barryleiba@computer.org>
References: <30BB83B2-B454-41B8-992B-8E2569802D9C@1und1.de> <D225D7FC-C570-4B63-A694-9F16DB1F33E1@kitterman.com> <CALaySJKwuOK-81dW2H9dtURxa5mLQDUNo+MWcs+Hho8N+yP9qg@mail.gmail.com> <2817813.dRqVH37e0G@localhost> <CALaySJJbPFBAV_7mZaARYWuMzuX+74r2Cm0jD+z92_iuFRn_MQ@mail.gmail.com> <25736.57534.195344.782189@fireball.acr.fi> <1ec42959-977a-9ce0-907a-83a5eb2b6ef2@tana.it> <25739.5435.550786.601699@fireball.acr.fi> <25739.33240.127804.524371@fireball.acr.fi> <5d9a0b0f-8777-2494-d779-376c6ab8b37d@tana.it> <xtudkqv5sqxs4c2nnilna5lf4b266br4xwdjwoq4fdyjpgzjln@xdb5rldfeini> <3087d0fa-91b4-62b4-fc64-a705c7f0b672@taugh.com> <CAHej_8=VnOC1Pms2JKJYG=2Dqtp2nc9oe-j=aEmNfvGuNhvzZA@mail.gmail.com> <a9505fda-ed21-1fc6-adb6-f231225a1ceb@tana.it> <CAHej_8nNGQR9Bm59dsu=XG7iBGyyW=SCh4=0cBM8NWodHyo6pQ@mail.gmail.com> <2de0ca2a-2c18-91ae-f306-38e70aaebf8e@inboxsys.com> <CAH48ZfwjMEwG=b7EsKkXQLzPgcysMLOj2QhZ7_8fs6uQ7zxXYQ@mail.gmail.com> <2080c6e5-2b57-be82-995b-a0986c3a45c5@inboxsys.com> <CAHej_8=7M=zJB2ENbnEQfRMfwEXDnGo61jHE_qQPTc0V9tFMdA@mail.gmail.com> <CAL0qLwauT-Fq-c5ubf43S7O8Likp+Pjj8SoE2uDNisAZMWfLkA@mail.gmail.com> <CALaySJJ7_v6k63mcPOn7HnqXSnkFZhuK70M-LtpVvSYzzObtKQ@mail.gmail.com>
X-Mailer: Apple Mail (2.3731.400.51.1.1)
Archived-At: <https://mailarchive.ietf.org/arch/msg/dmarc/XSozgkoxDviVM55JcigkAlDZdN4>
Subject: Re: [dmarc-ietf] easier DKIM, DMARC2 & SPF Dependency Removal
X-BeenThere: dmarc@ietf.org
X-Mailman-Version: 2.1.39
Precedence: list
List-Id: "Domain-based Message Authentication, Reporting, and Compliance \(DMARC\)" <dmarc.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/dmarc>, <mailto:dmarc-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/dmarc/>
List-Post: <mailto:dmarc@ietf.org>
List-Help: <mailto:dmarc-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/dmarc>, <mailto:dmarc-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 22 Jun 2023 20:23:51 -0000

> On Jun 22, 2023, at 1:08 PM, Barry Leiba <barryleiba@computer.org> wrote:
> 
>> I concur that this isn't really a problem for either working group to solve as part of a standard,
> 
> Well, the part that the working group needs to solve is whether the
> challenges of getting DKIM right are such that we need to retain SPF
> to fill that gap, or whether the issues with relying on SPF are more
> significant.  I think that's an important part of the decision we're
> discussing, and will be a significant part of judging consensus on
> that discussion.
> 
> Barry, as chair
> 

Barry, this is obviously a new relaxation option.  From a mail system integration standpoint, the options are:

1) A version bump to DMARC2 with new semantics with backward DMARC1 compatibility, or

2) Use a DMARC1 Extended tag option allowed by DMARC1.   Alessandro cited an excellent backward compatible extended tag option:

auth=dkim|spf (default value), auth=dkim+spf, auth=dkim, auth=spf

Of course, this would need to be discussed and I know Levine see this is too late for DMARCbis, but in my opinion,  Why the rush?  IETF San Fran next month?

DMARCBis is highly contentious and remains problematic. You know whats happening. I put my IETF faith in you.

—
HLS