[dmarc-ietf] Re: Review of draft-ietf-dmarc-arc-to-historic

[Douglas Foster <[e-mail]>]

The view of IETF has been clear in our discussions:

   - Email lists existed before email fraud existed and even longer before
   DMARC existed, so fraud and DMARC are not their problem.   The people who
   created the problem should solve the problem.
   - DMARC is a transaction between sender and receiver; mailing list
   operators are not a party to the transaction,   Lists have no role in
   creating a problem, and they need have no role in solving the problem.

This was made most clear when Ale exposed the fact that this list has no
protection against impersonation fraud.   Even the most detectable fraud
associated with DMARC p=reject is ignored.

IETF published the ARC specification, but they never implemented ARC
because they don't care about protecting subscribers from fraudulent
impersonation.   It is not their problem.
To the extent that ARC forces a mailing list to care about impersonation,
IETF never intended ARC to succeed.

Outside of ARC, it is likely that lack of uptake includes the above factors
and others:

   - ARC is implemented at the server level, not at the mailing list
   level.   Lack of communication between those roles may have limited ARC
   participation by mailing list operators.
   - Lack of sophistication by participants can also be a problem for
   every email enhancement.

Doug


On Fri, Jul 3, 2026 at 6:29 AM Alessandro Vesely <[e-mail]> wrote:

> On Wed 01/Jul/2026 21:33:01 +0200 Murray S. Kucherawy wrote:
> > I would argue that a failure criterion, whether express or inferred, is
> a lack
> > of uptake.
>
>
> Somewhat agreed.
>
>
> > I think the more interesting line of inquiry is why uptake didn't
> happen. Maybe
> > it was complexity, maybe it was a lack of endorsement by large mailbox
> > operators, maybe it made headers too ugly, maybe making the users take
> extra
> > manual steps is unacceptable, maybe a mix of those, maybe something else.
>
>
> Asking the operators of the various IETF lists would provide some real
> answers.
>
>
> > Knowing that might also help improve the chances of something like DKIM2
> > succeeding.
>
>
> Ending mailing list munging of the From: field was not a stated goal of
> ARC,
> and it won't be of DKIM2.  In what sense would DKIM2 succeed, then?  That
> it
> will succeed to DKIM1?
>
>
> Best
> Ale
> --
>
>
>
>
> _______________________________________________
> dmarc mailing list -- [e-mail]
> To unsubscribe send an email to [e-mail]
>