Re: [dmarc-ietf] Response to a claim in draft-crocker-dmarc-author-00 security considerations

[Dave Crocker <[e-mail]>]

On 7/21/2020 8:48 AM, Jesse Thompson wrote:
> On 7/20/20 7:55 AM, Douglas E. Foster wrote:
>> I am advocating for MLMs to stop spoofing and make their peace with DMARC.
> Maybe the recommendation should be that MLMs (or any ESP, for that matter) should never send as a domain they do not directly own unless it's authorized to send aligned mail as that domain.  (I say this as I have a distinguished PhD (not of CS) complaining to me that when he sends spoofed email from his Gmail account the messages go into spam because of DMARC.  Why do these ESPs even allow it in the first place, putting the domain owner's decision to adopt DMARC as the boogieman?)


This being a technical forum, we need to be careful and precise about 
terminology and history and, well, quite a bit more.

The mail is not spoofed.  Consider the definition of the word. Then 
consider that the MLM is authorized by the user with the address in the 
original From field.

Also then consider that the existing MLM behavior has existed and been 
useful for roughly 45 years.

The problem, here, is DMARC's imposing a change in email semantics.

d/

-- 

-- 
Dave Crocker
Brandenburg InternetWorking
bbiw.net