IETF Logo Mail Archive

Re: [dmarc-ietf] DMARC2 & SPF Dependency Removal

Scott Kitterman <sklist@kitterman.com> Thu, 08 June 2023 21:32 UTC

Return-Path: <sklist@kitterman.com>
X-Original-To: dmarc@ietfa.amsl.com
Delivered-To: dmarc@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id F2A98C151531 for <dmarc@ietfa.amsl.com>; Thu, 8 Jun 2023 14:32:06 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -4.397
X-Spam-Level:
X-Spam-Status: No, score=-4.397 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_MED=-2.3, RCVD_IN_ZEN_BLOCKED_OPENDNS=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001, URIBL_DBL_BLOCKED_OPENDNS=0.001, URIBL_ZEN_BLOCKED_OPENDNS=0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=neutral reason="invalid (unsupported algorithm ed25519-sha256)" header.d=kitterman.com header.b="px78nPMA"; dkim=pass (2048-bit key) header.d=kitterman.com header.b="Fl8BmqpE"
Received: from mail.ietf.org ([50.223.129.194]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id zyNtpiL-I3qI for <dmarc@ietfa.amsl.com>; Thu, 8 Jun 2023 14:32:01 -0700 (PDT)
Received: from interserver.kitterman.com (interserver.kitterman.com [64.20.48.66]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 11F1BC15154D for <dmarc@ietf.org>; Thu, 8 Jun 2023 14:32:00 -0700 (PDT)
Received: from interserver.kitterman.com (interserver.kitterman.com [64.20.48.66]) by interserver.kitterman.com (Postfix) with ESMTPS id A400CF8020B; Thu, 8 Jun 2023 17:31:50 -0400 (EDT)
DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/simple; d=kitterman.com; i=@kitterman.com; q=dns/txt; s=201903e; t=1686259896; h=date : from : to : subject : in-reply-to : references : message-id : mime-version : content-type : content-transfer-encoding : from; bh=eWI5dI9IY8ioDn94hpEPmvWW6yxlbPFg5yuhl3KHURw=; b=px78nPMAsBpozmnTCB/1iE2SN8pQZz3++04rAg4Mw/YwTR9a4n9kn762CeU+iF1OIUALW 9p8aKrN00l0WnwYDw==
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kitterman.com; i=@kitterman.com; q=dns/txt; s=201903r; t=1686259896; h=date : from : to : subject : in-reply-to : references : message-id : mime-version : content-type : content-transfer-encoding : from; bh=eWI5dI9IY8ioDn94hpEPmvWW6yxlbPFg5yuhl3KHURw=; b=Fl8BmqpERkiq0nccomR7wDrwgBzv3ZfmJKDEcdXt3OhFJK5T5QBgDC/83etGOJ2SIMQI9 jjr33SQQOVHrIc5B2aJhCGJB/efUaFtCRmM8ZV4XVHcq/WkcuTWjOputJNxYrmoy4BLwaQr f3+EQHhhapg2B2dkHnbkmTwrjuCajgwuqQIWd+X2hyXj3O1UnRWnhL1g1H4pEBURM0XhSr7 uUEhqiJhfAXLou2c1RKfXwgbFo+XjHdQAGV1hVQnvCpR1TKh5KpaU+y4CcI/yJ0sGSAhdHr rJxpcJhkxYwL5/S/btSaFDUWwS0/KawUielnkCMgqPclL1VLkCiChPf9Z9Rg==
Received: from [127.0.0.1] (mobile-166-171-56-204.mycingular.net [166.171.56.204]) by interserver.kitterman.com (Postfix) with ESMTPSA id 214EFF801C3; Thu, 8 Jun 2023 17:31:36 -0400 (EDT)
Date: Thu, 08 Jun 2023 21:31:31 +0000
From: Scott Kitterman <sklist@kitterman.com>
To: dmarc@ietf.org
In-Reply-To: <CALaySJJU+AAbfYnzm2vHGNzo-BpEHAVUxTw_HmrvDo414MKq+g@mail.gmail.com>
References: <30BB83B2-B454-41B8-992B-8E2569802D9C@1und1.de> <CAL0qLwbx6Y=kmB5pQZx8gNqD=rLBYz1vLOX6ngL=wUHHUm0Hjw@mail.gmail.com> <CAOZAAfMtsjcp+aCrwQ2QRc+SHsw3rhwMuTBugRYe44NeiMeKyg@mail.gmail.com> <CALaySJKrXJJXz3pgp85BPswoirhPJtD=uuefVfc9sX1fGkj-iA@mail.gmail.com> <CAJ4XoYc++Ossx-1oAX6fK12a3v=yz8XhoXKHdNF7-e8p=O3OCA@mail.gmail.com> <CALaySJJU+AAbfYnzm2vHGNzo-BpEHAVUxTw_HmrvDo414MKq+g@mail.gmail.com>
Message-ID: <2AC14310-16EC-43A9-B95E-BAE7E5C78FDA@kitterman.com>
MIME-Version: 1.0
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: quoted-printable
Archived-At: <https://mailarchive.ietf.org/arch/msg/dmarc/tUlPUcP9L_inn-XTGsOj2Dpv9zk>
Subject: Re: [dmarc-ietf] DMARC2 & SPF Dependency Removal
X-BeenThere: dmarc@ietf.org
X-Mailman-Version: 2.1.39
Precedence: list
List-Id: "Domain-based Message Authentication, Reporting, and Compliance \(DMARC\)" <dmarc.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/dmarc>, <mailto:dmarc-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/dmarc/>
List-Post: <mailto:dmarc@ietf.org>
List-Help: <mailto:dmarc-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/dmarc>, <mailto:dmarc-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 08 Jun 2023 21:32:07 -0000


On June 8, 2023 8:35:24 PM UTC, Barry Leiba <barryleiba@computer.org> wrote:
>> A sender using both SPF and DMARC will see a slight
>> boost in validation rates due to increased resiliency when there are
>> transient DNS failures and other problems.
>
>Do you mean "both SPF and DKIM", perhaps?
>
>I don't see how that makes sense: if there's a transient DNS failure,
>then neither the SPF nor the DKIM (nor the DMARC) records can be
>retrieved.
>
>I also don't see how using an unreliable mechanism is a benefit.  It
>demonstrably hurts validation rates related to relayed/forwarded mail,
>and can cause *false* validations in cases of overly-broad SPF
>configurations (as when a large provider that also hosts many spammers
>is used).

I'm pretty sure he meant SPF and DKIM.  His statement is consistent with my observations.

There are DKIM verification failures for reasons unrelated to DNS failures.  As an example, I recently fixed a DKIM validation bug in the library I maintain which was causing a small fraction of valid signatures to fail verification since at least 2011.  SPF + DKIM reduces DMARC failures.  

It's true that SPF is not particularly helpful for indirect mail flows, but I read your message as claiming using SPF with DKIM causes DMARC verification to be worse for indirect mail flows than when using DKIM alone.  Is that right?  If so, please expand on that because I don't understand it.

Scott K

v2.23.0 | Report a Bug | By Email