[dmarc-ietf] Re: New Tack - Learning from ARC Experiment

[Richard Clayton <[e-mail]>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

In message <[e-mail]>, Alessandro
Vesely <[e-mail]> writes

>On Sat 16/May/2026 19:27:05 +0200 John R Levine wrote:
>> On Sat, 16 May 2026, Alessandro Vesely wrote:
>>>
>>> Mainly to understand whether the ARC experiment revealed a missing 
>>> authorization semantic.
>>>
>>> ARC can preserve authentication results across intermediaries, but that 
>>> is not quite the same thing as establishing whether a mediation path is 
>>> acceptable.
>>
>> It can't even do that, since you can't tell whether links in the ARC chain 
>> beyond the most recent are real or fake.
>
>
>I agree that, operationally, the receiver can only act on the most recent ARC 
>set.

Worse than that -- unless the hashes match, you can only act on the most
recent ARC set if you have received it directly from the entity that
added the header fields   (and good luck with the general problem of
establishing that "directly" property)

- -- 
richard @ highwayman . com                       "Nothing seems the same
                          Still you never see the change from day to day
                                And no-one notices the customs slip away"

-----BEGIN PGP SIGNATURE-----
Version: PGPsdk version 1.7.1

iQA/AwUBagmz82HfC/FfW545EQI1SQCfVeSCtG6DdftJVBb0hzZwNZYOzWEAn3qk
GiJ33TMjAwG8fzCS896lQRgE
=urv9
-----END PGP SIGNATURE-----