Re: [dmarc-ietf] making mail not work for your users, was the endless mailing list silliness

[Alessandro Vesely <[e-mail]>]

On Thu 18/Apr/2013 00:00:21 +0200 MH Michael Hammer (5304) wrote:
>> From: [e-mail] On Behalf Of J. Gomez
>> 
>> It's pretty clear by now that DMARC is not about protecting actual email
>> users, but about protecting big brands from email spoofing their brand.
> 
> Having seen the damage done to individuals clicking on those
> phishing or malware emails purporting to be from banks and other
> big brands I strongly disagree with your statement which appears
> somewhat dismissive.

Spoofing a bank's brand can damage the users who become victims of
phishing.  That's what we aim at protecting from, however we call it.

> I would argue that organizations not making these sorts of efforts
> are doing a disservice to their customers and the community at
> large.

If courts argued like that, then phishing victims would be able to
claim damages from non-compliant banks.  Possibly, victims would need
to prove that scam messages would have been blocked if the bank had
complied.  Therefore they had better choose receivers who enable DMARC
rejection.

That way, we can extend the argument that mailing list posters need a
different email address:  We'd need a different email address even for
lurking.  However, experience with RFC 6109 shows that even if people
is compelled by law to get certified email accounts, they tend to
forget them and use the ones that work instead.[1]

[1] http://www.digitpa.gov.it/pec/statistichepec (in Italian)