Re: [dmarc-ietf] ARC questions

[Brandon Long <[e-mail]>]

On Mon, Nov 23, 2020 at 11:46 AM Michael Thomas <[e-mail]> wrote:

>
> On 11/23/20 11:28 AM, John R Levine wrote:
> >> From what I can tell, the main thing that ARC is doing is binding an
> >> auth-res to a dkim signature-like thing. But as I recall -- it's been
> >> a long time -- there were ordering requirements ala received headers
> >> for where new dkim-signatures and auth-res go in the header. Assuming
> >> my memory is correct, that means you can reconstruct "what this
> >> looked like before i messed with it" already by signing the incoming
> >> auth-res as part of the new DKIM signature.
> >>
> >> Is there something more going on here?
> >
> > Not really.  There are ordering rules but mail systems do not follow
> > them reliably, DKIM signatures in practice are not ordered.  Also, A-R
> > can be deleted in some situations, so ARC makes copies of them to be
> > more robust in transit.
> >
> If auth-res is sometimes deleted, why wouldn't we expect the arc
> auth-res to not be deleted too?
>
> I imagine that the vast majority of intermediaries that break signatures
> number exactly one extra domain, so it's not very hard to reconstruct
> the chain of custody from origin to destination. Assuming the
> intermediary resigns with the incoming auth-res, the destination can
> choose to believe that auth-res or not, right? Since this is an
> experiment, do we have an idea of what the rest of the problem is after
> the typical mailing list-like signature breakers are excluded?
>

No, as in the RFC says to remove them, so it's a standard part of
implementation.

RFC 7601 4.1:

> instances of the header field that appear to originate within the ADMD but

are actually added by foreign MTAs will be removed before delivery.


That's very different than "just maybe it might be removed"

Brandon