Re: [dmarc-ietf] Response to a claim in draft-crocker-dmarc-author-00 security considerations

[Dotzero <[e-mail]>]

On Sun, Jul 26, 2020 at 9:42 AM Dave Crocker <[e-mail]> wrote:

> On 7/21/2020 12:32 PM, Dotzero wrote:
>
> The original DMARC effort was, in fact, to detect actual cases of
>> spoofing, namely unauthorized use of a domain name by outside actors.
>>
>> Different problem.
>>
>
> Actually, part of the effort was to enable Sending domains to identify
> their own mail that was being sent without aligned DKIM signing or from
> places not authorized through SPF - in other words, not properly authorized
> but legitimate, hence feedback loops.
>
>
> As I recall, this was /not/ part of the original purpose of DMARC, which
> was discussed strictly in terms of mail from bulk senders.
>
> What you describe was,  rather, the basis for the later use, which is what
> then started causing problems for mail going through Mediators.
>

Notice I didn't use the word "users" Many of the sending domains in the
original effort had/have a complex number of mail streams for transactional
mail from multiple domains (in some cases thousands), including through
multiple 3rd parties. This is what I was referring to.

Michael Hammer.