Re: [dmarc-ietf] [ietf-dkim] a slightly less kludge alternative to draft-kucherawy-dmarc-rcpts

[Scott Kitterman <[e-mail]>]

On Monday, November 21, 2016 12:48:06 PM Vladimir Dubrovin wrote:
> 17.11.2016 17:30, Hector Santos пишет:
> > On 11/16/2016 1:09 PM, Terry Zink wrote:
> >>> This means ARC will be needed not only for mailing lists which
> >>> modify the header or
> >>> body of an email, but for EVERY mailing list and EVERY forwarded
> >>> email or EVERYTIME
> >>> the recipient has been modified and the email leaves the ADMD
> >>> boundary. From a
> >>> DMARC point of view DKIM will not be needed anymore because it has
> >>> now the same
> >>> function as SPF - verifiying the origin of direct emails - and SPF
> >>> is easier to implement
> >>> for most administrators.
> >> 
> >> +1.
> >> 
> >> It basically (almost) turns DKIM into SPF. That's not that appealing
> >> a solution.
> > 
> > For exclusive policies (SPF -ALL), you really don't need DKIM, DMARC
> > or ARC for that matter since the receiver (at least ours) will never
> > accept the payload anyway, i.e. it never gets to the SMTP "DATA"
> > state.  SPF does not require you to accept the mail for the hard
> > reject policy (-ALL).
> 
> SPF "-all" doesn't protect against spoofing attack, SPF only protects
> SMTP envelope which is normally not visible to user. DMARC does.
> 
> P.S. Murray, may be it's better to add an option to DKIM-Signature or to
> _dmarc DNS record to indicate some mechanism (DKIM or SPF) should not be
> used for DMARC verification? It will work in absolutely same way.
> draft-kucherawy-dmarc-rcpts  is an equivalent to DMARC with disabled
> DKIM authentication.

Or, if you don't want people to use DKIM for DMARC, don't sign the message.

Scott K