[dmarc-ietf] Re: Review of draft-ietf-dmarc-arc-to-historic

[Alessandro Vesely <[e-mail]>]

On Fri 17/Jul/2026 17:31:46 +0200 Murray S. Kucherawy wrote:
> On Wed, Jul 15, 2026 at 10:40 AM Alessandro Vesely <[e-mail]> wrote:
>
>> I think it's important to understand why the experiment didn't produce the 
>> expected results.  However, neither the I-D nor the RFC state exactly what 
>> results were expected.  Conveying original authentication assessments across 
>> trust boundaries, as a goal, was certainly achieved.  Fixing indirect mail 
>> flows certainly not.
>
> I thought the Abstract and Introduction sections of RFC 8617 clearly 
> described the expected result: ARC was meant to provide information 
> supplemental to DKIM enough to resolve the indirect mail flow problem.


I agree that this was the aspiration.  However, RFC 8617 does not actually say 
that the additional information resolves the mailing list problem.  It says 
that the additional information can be used to inform message disposition.  It 
does not claim that the additional information is, by itself, sufficient to 
justify overriding DMARC policy.  In practice, it is not.

In hindsight, this left a significant gap between the protocol mechanism and 
its operational use.  The RFC deliberately stops short of specifying how 
receivers should use ARC results in disposition decisions, apparently expecting 
operational practice to evolve separately.  That never really happened.  Ideas 
such as a broadly shared trust database did not materialize, and there was no 
common understanding of when ARC evidence should justify overriding a DMARC 
failure.


> Apparently, broadly, it didn't.


Without a shared operational model, deployment remained limited, and different 
implementations developed different interpretations of the protocol.  I would 
argue that what fell short was not so much the protocol as the operational 
ecosystem around it.


Best
Ale
--