Re: [dmarc-ietf] DMARC alignment conflicts with RFC 5322 on the use of the From and Sender header fields

[Scott Kitterman <[e-mail]>]

On Friday, June 5, 2020 5:26:19 PM EDT Jim Fenton wrote:
> On 6/4/20 10:39 PM, Dotzero wrote:
> > The goal of DMARC was (and is) to mitigate direct domain abuse.
> > Nothing more and nothing less. It helps receiving systems identify a
> > (correctly) participating domain's mail. That is why a DMARC policy is
> > often described as a sending domain's request and local policy is so
> > important (and can override that request).
> 
> I'm not clear on what kind of direct domain abuse you're referring to.
> If we accept that domain names are either not visible or are ignored by
> the recipient, the domain name doesn't matter much as long as the
> attacker can get their message delivered, and DMARC doesn't apply
> because they're using their domain.
> 
> > For attackers that deploy DMARC it simply means that they are self
> > identifying their malicious messages as theirs.
> 
> No, DKIM and SPF do that. DMARC doesn't have anything to do with
> identifying messages.
> 
> > For Sending domains, SPF/DKIM/DMARC is only one set of tools in
> > protecting their brand from abuse. It protects end users from abuse.
> > In fact, in many cases the individuals most susceptible to falling
> > prey to such abuse may not even be customers of that sending domain.
> > No, that greeting card you received isn't legit (Nobody loves you).
> > No, that retailer isn't giving you a $200 gift card. This is why other
> > tools like takedowns are so important and why the removal of
> > registrant information from domain registrations has enabled abusers.
> 
> So maybe the core question here is, does the identity in the domain name
> matter or not? It does to me personally because I look at it (whenever I
> can -- my iPhone doesn't make it easy to display) and I pay attention to
> it. But I know I'm not a typical user, and I also see increasing
> evidence of mail client software that doesn't show anything but the
> Friendly Name. So is there a "brand" associated with the email domain
> name any more?
> 
> If the domain name doesn't matter, the binding to the From/Signer
> address doesn't either.

If the domain name didn't matter, no one would bother to use 'real' domains in 
abusive mail.  They demonstrably do, so while one might have differences of 
opinion about how important they are (every MUA I use displays them, so let's 
also not draw too hasty conclusions about them not being displayed) I don't 
think it's a supportable that they don't matter.

Scott K