IETF Logo Mail Archive

Re: [dmarc-ietf] easier DKIM, DMARC2 & SPF Dependency Removal

Hector Santos <hsantos@isdg.net> Fri, 30 June 2023 20:03 UTC

Return-Path: <hsantos@isdg.net>
X-Original-To: dmarc@ietfa.amsl.com
Delivered-To: dmarc@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E10D6C1519B3 for <dmarc@ietfa.amsl.com>; Fri, 30 Jun 2023 13:03:11 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.097
X-Spam-Level:
X-Spam-Status: No, score=-2.097 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HTML_MESSAGE=0.001, RCVD_IN_ZEN_BLOCKED_OPENDNS=0.001, SPF_PASS=-0.001, URIBL_DBL_BLOCKED_OPENDNS=0.001, URIBL_ZEN_BLOCKED_OPENDNS=0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=isdg.net header.b="ME1owV/S"; dkim=pass (1024-bit key) header.d=beta.winserver.com header.b="H0eL/Zfa"
Received: from mail.ietf.org ([50.223.129.194]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id vshlNIeqECAj for <dmarc@ietfa.amsl.com>; Fri, 30 Jun 2023 13:03:07 -0700 (PDT)
Received: from mail.winserver.com (mail.winserver.com [3.137.120.140]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 23C8EC1519AF for <dmarc@ietf.org>; Fri, 30 Jun 2023 13:03:06 -0700 (PDT)
DKIM-Signature: v=1; d=isdg.net; s=tms1; a=rsa-sha256; c=simple/relaxed; l=4430; t=1688155379; atps=ietf.org; atpsh=sha1; h=Received:Received:Received:Received:From:Subject:Date: Message-Id:To:Organization:List-ID; bh=ORCGoVU1Pq66f/lBZNm9CbWPX 2ILXFvJA+v/itcv6EI=; b=ME1owV/SGL2u/gWFNebWI4c45+jKDjiHwAs0ImBww c0xkM74rBh1aAxuAR9OoevWoFkJoNgapCIy+stVccPXBlvvNl+pvjqH6BgP/5hSC 6Oh5xfnHMe9vuwEOYTAu3+5lJEiWKebXcBqwQz0eochXsNGzKJl/QLb59cUODTEB t4=
Received: by winserver.com (Wildcat! SMTP Router v8.0.454.13) for dmarc@ietf.org; Fri, 30 Jun 2023 16:02:59 -0400
Authentication-Results: dkim.winserver.com; dkim=pass header.d=beta.winserver.com header.s=tms1 header.i=beta.winserver.com; adsp=none author.d=isdg.net signer.d=beta.winserver.com; dmarc=pass policy=reject author.d=isdg.net signer.d=beta.winserver.com (atps signer);
Received: from beta.winserver.com ([3.132.92.116]) by winserver.com (Wildcat! SMTP v8.0.454.13) with ESMTP id 4253085630.1.6052; Fri, 30 Jun 2023 16:02:58 -0400
DKIM-Signature: v=1; d=beta.winserver.com; s=tms1; a=rsa-sha256; c=simple/relaxed; l=4430; t=1688155376; h=Received:Received:From: Subject:Date:Message-Id:To:Organization:List-ID; bh=ORCGoVU1Pq66 f/lBZNm9CbWPX2ILXFvJA+v/itcv6EI=; b=H0eL/Zfa0FILyrvMOv9cXfZOrZCY uktHnYI5eVsPsZXcFKVFyZjF3p7BV9FxT609T6FYag70SvJvLw3MtGN1ZnCl0gzf NPIOdqHchEKTQk+loEpL3VJGvfUJ0Lgs5aksIqHIkkW6ljjzTwsO9gHn+O8epsfL OhQ0m3gn15x8xyw=
Received: by beta.winserver.com (Wildcat! SMTP Router v8.0.454.12) for dmarc@ietf.org; Fri, 30 Jun 2023 16:02:56 -0400
Received: from smtpclient.apple ([99.122.210.89]) by beta.winserver.com (Wildcat! SMTP v8.0.454.12) with ESMTP id 404174209.1.4132; Fri, 30 Jun 2023 16:02:55 -0400
From: Hector Santos <hsantos@isdg.net>
Content-Type: multipart/alternative; boundary="Apple-Mail=_08FB8A23-9FE9-4C0A-9140-EEE9DB96EDE7"
Mime-Version: 1.0 (Mac OS X Mail 16.0 \(3731.400.51.1.1\))
Date: Fri, 30 Jun 2023 16:02:44 -0400
In-Reply-To: <CAL0qLwZ_BpLegRFtU_E=rgkh+nV_hK6TCh0TEOCg-gbTP3B_2A@mail.gmail.com>
Cc: IETF DMARC WG <dmarc@ietf.org>
References: <20230623021810.E5F8DF9B3B94@ary.qy> <6495D504.4090809@isdg.net> <839aa10b-f7fa-c7a2-76db-6441189afca2@dusatko.org> <CALaySJ+gcVvpzJcrpUbOkOvjUFAhzw=pZovpZC7BhW_x7VW7nA@mail.gmail.com> <CAL0qLwasxzqJt7Hr7gZd86C=ivCrDUci_i6pkJJUTnqzL1pHMA@mail.gmail.com> <CALaySJ+gjR6D-OSE_07iSH2zXa7wypUQwPN1cL-1s+NC2S4L8g@mail.gmail.com> <99e1ef2d-053b-8cfe-f369-fa8475d142ae@tana.it> <CALaySJKZoAPTT-+cZEww+y2eUsDbNXcybb=Z7RxNLyfzPMr7ng@mail.gmail.com> <d3986316-02f9-9d73-be81-37af7cfd40a7@tana.it> <CALaySJLtUtKNtP4__pOryFLaAODjiEx-nbdvF9tL6wYhcRCe_g@mail.gmail.com> <877A1137-3A55-424A-A9C5-FCCA4F2D5436@kitterman.com> <c3adb721-fa6c-a285-a7db-067260d83f41@dusatko.org> <CAL0qLwZ_BpLegRFtU_E=rgkh+nV_hK6TCh0TEOCg-gbTP3B_2A@mail.gmail.com>
Message-Id: <E53E9050-3086-4C94-AFD3-38DFD7391C3E@isdg.net>
X-Mailer: Apple Mail (2.3731.400.51.1.1)
X-Comment: Missing recipient address appended by wcSMTP router.
To: dmarc@ietf.org
Archived-At: <https://mailarchive.ietf.org/arch/msg/dmarc/bkrLul0cwJJsbMTE-nNAFzPMNYw>
Subject: Re: [dmarc-ietf] easier DKIM, DMARC2 & SPF Dependency Removal
X-BeenThere: dmarc@ietf.org
X-Mailman-Version: 2.1.39
Precedence: list
List-Id: "Domain-based Message Authentication, Reporting, and Compliance \(DMARC\)" <dmarc.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/dmarc>, <mailto:dmarc-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/dmarc/>
List-Post: <mailto:dmarc@ietf.org>
List-Help: <mailto:dmarc-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/dmarc>, <mailto:dmarc-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 30 Jun 2023 20:03:12 -0000

> On Jun 30, 2023, at 3:32 PM, Murray S. Kucherawy <superuser@gmail.com> wrote:
> 
> On Fri, Jun 30, 2023 at 12:21 AM Jan Dušátko <jan=40dusatko.org@dmarc.ietf.org <mailto:40dusatko.org@dmarc.ietf.org>> wrote:
>> Scott, Barry,
>> as far as I understand, SPF are historic technology,
> 
> Not in any official capacity.  RFC 7208 is a Proposed Standard.  In fact, in IETF terms, it enjoys higher status than DMARC does right now.
> 
> The status of these protocols is not under discussion.  The only question is whether DMARC should continue to factor SPF results into its output.


If I am reading the group right, using the suggested `auth=` tag for explanation, it appears the editor wants the new DMARCbis default to be:

	auth=dkim

And it would required an explicit tag like;

	auth=spf,dkim

to express a desire for spf to be in the evaluation.  This offers DMARCbis backward compatibility.   This would be the one “upgrade” change a domain would need to make, an optional “extended behavior” to make it behave like DMARC today.  The default behavior today is auth=spf,dkim.  DMARCbis’s default would be auth=dkim.

I am saying it sounds like this.  

Overall, imo, it is never a good idea to exerted changes on domains with bis specs, requiring them to change their current DMARC record to reinforce the security level they want using SPF in DMARC evaluation. 

—
HLS

v2.23.0 | Report a Bug | By Email