Re: [dmarc-ietf] Proposed text for p=reject and indirect mail flows

["Murray S. Kucherawy" <[e-mail]>]

On Sun, Apr 9, 2023 at 6:33 AM Jesse Thompson <[e-mail]> wrote:

> As Todd previously stated, my preference is for language that acknowledges
> the primacy of the domain owner over interoperability. CISOs have been sold
> (arguably, by the DMARC deployment companies' marketing) on the idea that
> there are security benefits. Maybe oversold, but there are benefits and the
> motivation will not change. Let's not also overlook the primary benefit of
> _the process of deploying DMARC_ gives to an organization: increased
> management and governance (enabled by the observability from the reports).
> In any case, the domain owner is motivated to deploy DMARC and gain the
> perceived benefits. If we are going to tell these motivated domain owners
> to MUST do something, at least make it something they might consider doing.
>

I don't think the way DMARC has been marketed is germane to discussions
about interoperability, which is what "MUST NOT" type language seeks to
resolve.

Nobody is denying that there's a security problem to be dealt with here.
It's a question of whether the side effects are acceptable.  And given that
DMARC only addresses direct domain attacks, and not lookalikes or similar,
I suggest that there's a clear imbalance when comparing the net benefits to
the aggregate costs.  If we're going to argue that that's not true, the
document probably needs to give that a much more thorough treatment than it
currently does.


> "Before a general purpose domain publishes p=reject|quarantine, the domain
> owner MUST emit mail from, or provide to their stakeholders/end-users, an
> alternative domain or subdomain with a p=none policy for any email that
> needs to traverse a non-DMARC-mitigating MLM or (more generally) from any
> 3rd party that cannot be authorized by SPF or DKIM alignment."
>

I think something like this is worthy of consideration.  It (or something
like it) is the very least we can do.  It is the very least we must do.

-MSK, participating