Re: [dmarc-ietf] A policy for direct mail flows only, was ARC questions

[Michael Thomas <[e-mail]>]

On 12/1/20 6:21 PM, Brandon Long wrote:
>
>
> On Tue, Dec 1, 2020 at 10:07 AM Michael Thomas <[e-mail] 
> <mailto:[e-mail]>> wrote:
>
>
>     On 11/30/20 8:56 PM, Brandon Long wrote:
>>     Right, some of the other dkim-light or diff concepts we discussed
>>     would be better than using l=
>>
>>     We again got hung up on the 100% solution, though... something
>>     that handled subject-prefix and
>>     footer in a transport agnostic way might have worked.  The fact
>>     that DKIM isn't transport agnostic
>>     is an achilles heel to even that, though, since we'd have to come
>>     up with a new canonicalization
>>     and get it to widespread adoption before the simple diff could
>>     work.  Or require mailing lists to
>>     be a lot more strict in how they do their email rewriting, but I
>>     imagine that's harder work than
>>     even ARC.
>>
>     Frankly all it would take is a google or another large mail
>     provider to publicly state that unless a mailing list supports BCP
>     XYZ, your mail will be subject to very strict scrutiny and likely
>     not delivered to get the attention of mailing list providers. That
>     was my suggestion back in the day but it was scoffed at because
>     people could point to some edge case that generates .001% of list
>     traffic and thus invalidating the entire approach. The best is
>     definitely the enemy of the good here.
>
>     People really need to keep in mind that service provider email is
>     not the only game in town. That point keeps getting lost.
>
> arguably we're all here because a large mail provider did make such a 
> change (though to be fair, there were plenty of others who wanted to 
> make that change).
>
> While Google might be able to help move things along, there would need 
> to be strong community support for that, no one wants to go this alone 
> and look like the big bully.
>
> I also think that you're overestimating what we could do. Ultimately, 
> we serve our customers, and they want their legitimate email, even if 
> it doesn't support BCP XYZ.
>

Well obviously the BCP would have to come first and there would have to 
be community buy-in to create such a BCP, but a Google participating in 
creating such a BCP ought pique the interests of people who make mailing 
list software who obviously have the biggest stake in this.

It occurs to me that it might not even be a BCP. Maybe mailing lists can 
just create a header with sed commands to undo its changes :)

Mike