[dmarc-ietf] Break SPF response: DKIM Only
Douglas Foster <dougfoster.emailstandards@gmail.com> Thu, 29 February 2024 17:48 UTC
Return-Path: <dougfoster.emailstandards@gmail.com>
X-Original-To: dmarc@ietfa.amsl.com
Delivered-To: dmarc@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E6CF3C18DBA4 for <dmarc@ietfa.amsl.com>; Thu, 29 Feb 2024 09:48:20 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -7.107
X-Spam-Level:
X-Spam-Status: No, score=-7.107 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-5, RCVD_IN_ZEN_BLOCKED_OPENDNS=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, T_SCC_BODY_TEXT_LINE=-0.01] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com
Received: from mail.ietf.org ([50.223.129.194]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 4GrnQPDFpRGE for <dmarc@ietfa.amsl.com>; Thu, 29 Feb 2024 09:48:20 -0800 (PST)
Received: from mail-lf1-x12f.google.com (mail-lf1-x12f.google.com [IPv6:2a00:1450:4864:20::12f]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 8D3BAC18DBA0 for <dmarc@ietf.org>; Thu, 29 Feb 2024 09:48:20 -0800 (PST)
Received: by mail-lf1-x12f.google.com with SMTP id 2adb3069b0e04-5132010e5d1so1295624e87.0 for <dmarc@ietf.org>; Thu, 29 Feb 2024 09:48:20 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1709228898; x=1709833698; darn=ietf.org; h=to:subject:message-id:date:from:mime-version:from:to:cc:subject :date:message-id:reply-to; bh=htUYQ5P8xGtPGYAPC0mkQxh2QxHr+14G8A7tM67e6Bc=; b=RnFgMFZ0y4Q/JnHOJcgtAKkfI8X7sdvcR5KbI7QQmrY07za66YcuwxYUI7KgMNrJKj /7FFhemoJjc1ijAxWHxZkLa8pfYu+1C0yUs8W9UlfNlwhkvZ6R4DHWPGj85PrugDfiei 7KnPWfJXSfgzR7QR/lL5Onhllr/PqKeANZIWLuNnIDE4tx4JZTBE8gMrkaGyoj28xDTV 5FLh89N3uD9cqc6SX9+SLCySoeSZy8FRd6UZrEOoELdD/lzonTJPoiv36CKtMOv2WMEH DHQInHqv2Rt75tsp3N6K6OFtOVYxOh3Oc7zaTc+7P446XeFkg1kSqE+VQ48pQPZTnLwz iNzA==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1709228898; x=1709833698; h=to:subject:message-id:date:from:mime-version:x-gm-message-state :from:to:cc:subject:date:message-id:reply-to; bh=htUYQ5P8xGtPGYAPC0mkQxh2QxHr+14G8A7tM67e6Bc=; b=lH0D7wMh+mMQaz66uKzTWgbqGwp2mhTeSZOy0iMLrIShdI4zMbslEKkbSdRQBvd79m fXlWemMyVZonCzkDac6AVSBUeXkPIh11r121CpbaL/tSg9/V6adCZZBt6ZJ2ziw/zu9p ex6UQiF4cP4jTcWHCb2Vq/jZ5Bzgl7mz3GCYUu243tPMmzS0d1cYYTqNsxvdrwrLLQzT uLw/f2RrGOHCXX5op3uaHKs+cA5hXSyMluzTWy+jjdM+xUf3ePNYaWWYq+i4uvYn4jEm 6x2XHzzYU08BVnwMW0lPyQfsuEqxPfpyL24ZyNLUu2Vr1XwGo5jghMoLARy4bq9Kyeyh cs6g==
X-Gm-Message-State: AOJu0YxLJDQrCAoOwY7mMpXWg2npnOdBMVw+B9h4wXdLljFAEEXlJlgk h73gkhImGr7HcoVb6lb2rhNKyUtbZUZ3uVwuVwAR3ng/zPF2IVxtX6hiDrCpyQfgy07Z67MQq2y cPJOEMXjLVMtB4UNiGmnAiYTETvUhYmac
X-Google-Smtp-Source: AGHT+IGGW9pLxD7v7BPpbKJlnWN7v8AnkDWQ9VjCGzdlOHZg2O5jbTmOOlm2XhjOMfOa4aiZv0oUAD1a4N+Ry55tiOU=
X-Received: by 2002:a05:6512:3125:b0:512:fe1f:b925 with SMTP id p5-20020a056512312500b00512fe1fb925mr1933546lfd.28.1709228897844; Thu, 29 Feb 2024 09:48:17 -0800 (PST)
MIME-Version: 1.0
From: Douglas Foster <dougfoster.emailstandards@gmail.com>
Date: Thu, 29 Feb 2024 12:48:06 -0500
Message-ID: <CAH48ZfxMZzu0YoVOOGgBrhNMMcrZcArpM=ygG7bRZ5fUM1x+zA@mail.gmail.com>
To: IETF DMARC WG <dmarc@ietf.org>
Content-Type: multipart/alternative; boundary="0000000000004bc51d061288dd81"
Archived-At: <https://mailarchive.ietf.org/arch/msg/dmarc/ZUt5QFIUlKjQfGlgrNSGIXooFno>
Subject: [dmarc-ietf] Break SPF response: DKIM Only
X-BeenThere: dmarc@ietf.org
X-Mailman-Version: 2.1.39
Precedence: list
List-Id: "Domain-based Message Authentication, Reporting, and Compliance \(DMARC\)" <dmarc.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/dmarc>, <mailto:dmarc-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/dmarc/>
List-Post: <mailto:dmarc@ietf.org>
List-Help: <mailto:dmarc-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/dmarc>, <mailto:dmarc-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 29 Feb 2024 17:48:21 -0000
I am surprised at the lack of feedback about Barry's research link. It is a devastating attack on our ability to trust SPF when shared infrastructure is involved. As a result of that document, I have switched camps and believe that we MUST provide a DKIM-only option for DMARC. The proposed workaround, of using a "?" modifier to force SPF Neutral instead of Pass, seems to lack both awareness and implementation, since it was not even mentioned in the research document as a mitigation. Doug Foster
- [dmarc-ietf] Break SPF response: DKIM Only Douglas Foster
- Re: [dmarc-ietf] Break SPF response: DKIM Only Benny Pedersen
- Re: [dmarc-ietf] Break SPF response: DKIM Only Scott Kitterman
- Re: [dmarc-ietf] Break SPF response: DKIM Only Richard Clayton
- Re: [dmarc-ietf] Break SPF response: DKIM Only Douglas Foster
- [dmarc-ietf] Fwd: Break SPF response: DKIM Only Chuhan Wang
- Re: [dmarc-ietf] Fwd: Break SPF response: DKIM On… Neil Anuskiewicz
- Re: [dmarc-ietf] Fwd: Break SPF response: DKIM On… Douglas Foster