IETF Logo Mail Archive

Re: [dmarc-ietf] Mandatory Sender Authentication

Dave Crocker <dhc@dcrocker.net> Tue, 04 June 2019 07:23 UTC

Return-Path: <dhc@dcrocker.net>
X-Original-To: dmarc@ietfa.amsl.com
Delivered-To: dmarc@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7EF461200F4 for <dmarc@ietfa.amsl.com>; Tue, 4 Jun 2019 00:23:35 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.701
X-Spam-Level:
X-Spam-Status: No, score=-2.701 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=dcrocker.net
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id lEza4OoVWyse for <dmarc@ietfa.amsl.com>; Tue, 4 Jun 2019 00:23:32 -0700 (PDT)
Received: from simon.songbird.com (simon.songbird.com [72.52.113.5]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C2D9B1200A4 for <dmarc@ietf.org>; Tue, 4 Jun 2019 00:23:32 -0700 (PDT)
Received: from [172.16.22.211] (80-64-77-66.static.acetelecom.hu [80.64.77.66]) (authenticated bits=0) by simon.songbird.com (8.14.4/8.14.4/Debian-4.1ubuntu1.1) with ESMTP id x547PWYP032637 (version=TLSv1/SSLv3 cipher=AES128-SHA bits=128 verify=NOT); Tue, 4 Jun 2019 00:25:33 -0700
DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=dcrocker.net; s=default; t=1559633134; bh=8J59xZ7+kttGnKiyCeRiQgo2EoscQwZu+cqqfv3mO3s=; h=Subject:To:References:From:Reply-To:Date:In-Reply-To:From; b=dn990k48WFbVPmvgMAGsJTFNEEzJsd2bud2OWz6e043EwhpYsAbdj/RT6lyl+fzmk re57v/wRlHkKKXshJuNJn1nRZgwjI3riD4um+0IS/KIpJ1x5zM6uvRfZSGSpIFLElw eEmcSQqlwYYOXYKoaa9U8tp733iw9AbdVM3+3XqQ=
To: "Douglas E. Foster" <fosterd@bayviewphysicians.com>, dmarc@ietf.org
References: <20190603142956.66B31120252@ietfa.amsl.com>
From: Dave Crocker <dhc@dcrocker.net>
Reply-To: dcrocker@bbiw.net
Message-ID: <45cdc0da-5243-3a62-b217-8d5e4ea9ea11@dcrocker.net>
Date: Tue, 04 Jun 2019 09:23:23 +0200
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:60.0) Gecko/20100101 Thunderbird/60.7.0
MIME-Version: 1.0
In-Reply-To: <20190603142956.66B31120252@ietfa.amsl.com>
Content-Type: text/plain; charset="utf-8"; format="flowed"
Content-Language: en-US
Content-Transfer-Encoding: 8bit
Archived-At: <https://mailarchive.ietf.org/arch/msg/dmarc/jUBSZscb60kULtPIMIaawRf6LJ4>
Subject: Re: [dmarc-ietf] Mandatory Sender Authentication
X-BeenThere: dmarc@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: "Domain-based Message Authentication, Reporting, and Compliance \(DMARC\)" <dmarc.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/dmarc>, <mailto:dmarc-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/dmarc/>
List-Post: <mailto:dmarc@ietf.org>
List-Help: <mailto:dmarc-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/dmarc>, <mailto:dmarc-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 04 Jun 2019 07:23:36 -0000

On 6/3/2019 4:29 PM, Douglas E. Foster wrote:
> 
> Our real goal needs to be mandatory sender authentication.    Any secure 
> email gateway must go through these steps:


1. By 'sender', which actor in the sequence do you mean?  The term is 
highly ambiguous.

2. Your certitude presumes an empirical foundation, given how often good 
theory does not make good practice.  People have been working in this 
space for a very long time and one might have expected the industry to 
have latched on such a simple requirement were it that clear it was 
/the/ essential requirement.  Please document the basis for your certitude.

3. What made you think that 'sender' authentication is not already 
happening at a sufficient level?  What is the basis for believing it 
isn't already being used by filtering agents well enough?

4. Consider the limitations to 'sender' authentication.

d/


-- 
Dave Crocker
Brandenburg InternetWorking
bbiw.net

v2.23.0 | Report a Bug | By Email