[dmarc-ietf] Re: Evaluating consensus on the idea of making ARC "Historic"

[Alessandro Vesely <[e-mail]>]

Hi,

it is not easy to understand what happened at Yahoo.  The statement relayed by 
Richard (and quoted below) may shred some further light after John's summary:

     Y tells us that they had to ignore G's ARC chains because they signed
     messages that took insecure routes and were silently modified.
     https://mailarchive.ietf.org/arch/msg/dmarc/ZTIYuQG9oCOP7bmc7WoYAWIgicM

and Richard's quote of draft-adams-arc-experiment-conclusion-01:

    *  Abuse of trusted chains: Attackers have been leveraging situations
       where recipients trusted ARC chains by modifying email after an
       initial attestation and then passing it to another entity which
       trusted that attestation.  Assessing whether the email came
       directly from the entity at the head of the ARC chain is complex
       and assessing whether or not any changes to the email were made by
       a trusted signer or a malicious third party has proved to be
       impossible.
     https://mailarchive.ietf.org/arch/msg/dmarc/pfleAeQo_bacxA9a4yhs7gEuDWI

Messages apparently followed a path like:

     Originator -> G (adding an ARC set) -> bad guy (modifying the message) -> Y

However, it is not explained whether the bad guy added a second ARC set or how 
the message could have been modified without invalidating G's signature.


Best
Ale


On Thu 30/Jul/2026 20:07:34 +0200 Richard Clayton wrote:
> In message <CALaySJK-X0XtA8ODbA-9KbzTxDth_pKc5fqWU6tbq3h+tizJ=[e-mail]
> il.com>, Barry Leiba <[e-mail]> writes
> 
>>The next step is for those who still want to proceed with making ARC
>>Historic *now*... to respond to these objections and either accept the
>>suggestion to wait, or to address reasons we should not.
> 
> I would like to relay a statement (sorry for the delay, but these things
> need some approvals):
> 
> ----
> 
> At Yahoo we have read with interest the recent discussions about
> documenting the end of the ARC experiment.
> 
> We have not been applying ARC headers to any email and we will not be
> doing so in the future.
> 
> We have experimented with accepting ARC information from other senders.
> Our experience has been that this has DECREASED our ability to identify
> email that our users do not wish to receive. It has not improved our
> ability to identify valid email that has been forwarded by others,
> instead our trust in senders to report useful and valid information to
> us has been misplaced on several occasions. We have taken several large
> senders off our "trusted list" as a result, and we will not be spending
> any effort in adding any new senders to our (now extremely short) list.
> 
> Counting by domain we currently see about 12,000 users of ARC -- which
> may sound a lot but it is rather less than half of one percent of the
> domains sending us email each day. That is we conclude that, even after
> about 10 years, adoption has been very low indeed.
> 
> We would not encourage any other senders to bother with ARC, instead
> they should engage with the DKIM2 initiative which we believe will be of
> significant use in improving our ability to identify mail which our
> users want.
> 
> 
> _______________________________________________
> dmarc mailing list -- [e-mail]
> To unsubscribe send an email to [e-mail]