IETF Logo Mail Archive

Re: [dmarc-ietf] DMARC2 & SPF Dependency Removal

"Murray S. Kucherawy" <superuser@gmail.com> Fri, 09 June 2023 14:07 UTC

Return-Path: <superuser@gmail.com>
X-Original-To: dmarc@ietfa.amsl.com
Delivered-To: dmarc@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 84732C151B18 for <dmarc@ietfa.amsl.com>; Fri, 9 Jun 2023 07:07:26 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.097
X-Spam-Level:
X-Spam-Status: No, score=-2.097 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_ZEN_BLOCKED_OPENDNS=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com
Received: from mail.ietf.org ([50.223.129.194]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 9RpZFow0o0O8 for <dmarc@ietfa.amsl.com>; Fri, 9 Jun 2023 07:07:22 -0700 (PDT)
Received: from mail-ej1-x630.google.com (mail-ej1-x630.google.com [IPv6:2a00:1450:4864:20::630]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 0D5FDC151B15 for <dmarc@ietf.org>; Fri, 9 Jun 2023 07:07:22 -0700 (PDT)
Received: by mail-ej1-x630.google.com with SMTP id a640c23a62f3a-94ea38c90ccso46291666b.1 for <dmarc@ietf.org>; Fri, 09 Jun 2023 07:07:21 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20221208; t=1686319640; x=1688911640; h=cc:to:subject:message-id:date:from:in-reply-to:references :mime-version:from:to:cc:subject:date:message-id:reply-to; bh=HhhkXiF2VQ0UsswaVr6aI5bIh4V4KdGv7mOfyfkvrtc=; b=O0oDsyhdL2LIE2PkEX7C4/2Ovwi4Tis7poJFL38OKGFZ8eVDN8nNIEnY6xVlEM79hZ U5aWqvYzQn4CUHX2eixBXkdPYxFFxRrt2X5cxDTzMAvpSUUlxXZ7tMt5AQ6A8wip2yzA GEX2z1h/mV508f4zo5YvVUHMIWgX5h3cSjEBcB1AGWDPh6py5NB9g1kfMQqVt+i+cULa gpOT3Bajz1kjKMXgc0xolUIgAXn52mjmZsEgTXnIQmKpxqw13v6KPMvaKEFkHSp5EERO lTdDWdapcFv9gpyk4gaDFK4LLG2T6hetB+qsxCD4VOA7DUkCERve4Y1+tY+/Xo5oC0zJ HcSQ==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20221208; t=1686319640; x=1688911640; h=cc:to:subject:message-id:date:from:in-reply-to:references :mime-version:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to; bh=HhhkXiF2VQ0UsswaVr6aI5bIh4V4KdGv7mOfyfkvrtc=; b=eg7yNyNRjOElTBKI9wre5TXnxfaSsmVnBDwGEj0ZWIDgyZQW8irXG78b134Ns0B4yw xBdP+qyfQOnFdXyh7wB5TrSGUEweptQmWCEpDdUMU/nAFHNPV84bKDBV1U2wXM6CZ2e8 OqdHGqi8lodhmcQelkPvlwyAbnUb+XRQpJuINXqBeOSSlF3fYk1XCqa4Ya0e8sENeXHL 5uNySiwI160sFgedxDYwmCquNEHwZnsdCDnDGWYWvn8WZ2dJf3PeIaK0Rkjl602UzlFn NpbYIekhyOdB10QoV1hrKDaldnaMEJrSZP6yUY0mRFNeMGhC4Rc7R3Ap+ZfuxK7ZWsmR Ab9A==
X-Gm-Message-State: AC+VfDw68vVkGF+0i2JK/jHYycYPBvRpAa0nBNS9V2kOIMFBLc0S2qtI kYBHeuHtBi9TTHeW2FUUq73BHnTpYvdMdCgbzh73Y+Ni
X-Google-Smtp-Source: ACHHUZ7YunD5PSdRAPUy/VM05/IAnWD8EtLJFKyEMZcQ1Eo9PSEehnrm6/b760KfZ/L8Xmvdque09PB6TaRossHoAys=
X-Received: by 2002:a17:906:7a41:b0:977:c853:fba6 with SMTP id i1-20020a1709067a4100b00977c853fba6mr1500980ejo.2.1686319640199; Fri, 09 Jun 2023 07:07:20 -0700 (PDT)
MIME-Version: 1.0
References: <30BB83B2-B454-41B8-992B-8E2569802D9C@1und1.de> <CAL0qLwbx6Y=kmB5pQZx8gNqD=rLBYz1vLOX6ngL=wUHHUm0Hjw@mail.gmail.com> <CAOZAAfMtsjcp+aCrwQ2QRc+SHsw3rhwMuTBugRYe44NeiMeKyg@mail.gmail.com> <CALaySJKrXJJXz3pgp85BPswoirhPJtD=uuefVfc9sX1fGkj-iA@mail.gmail.com> <7f854d28-d3b5-fd00-4613-b8baa1217bd7@tana.it> <CALaySJLeJ0xproB6Eg-37sSrNS7XrewUmdKZYVPsVeWddJ90MQ@mail.gmail.com>
In-Reply-To: <CALaySJLeJ0xproB6Eg-37sSrNS7XrewUmdKZYVPsVeWddJ90MQ@mail.gmail.com>
From: "Murray S. Kucherawy" <superuser@gmail.com>
Date: Fri, 09 Jun 2023 07:07:07 -0700
Message-ID: <CAL0qLwaFNYr0kYPn9ssGQGrSjmTgZnx2u0cxW4UT7M6zSr-sGA@mail.gmail.com>
To: Barry Leiba <barryleiba@computer.org>
Cc: Alessandro Vesely <vesely@tana.it>, dmarc@ietf.org
Content-Type: multipart/alternative; boundary="00000000000021c8d605fdb2e322"
Archived-At: <https://mailarchive.ietf.org/arch/msg/dmarc/v6b4pL2Ex7fvo3zjQLHRDTHOXVE>
Subject: Re: [dmarc-ietf] DMARC2 & SPF Dependency Removal
X-BeenThere: dmarc@ietf.org
X-Mailman-Version: 2.1.39
Precedence: list
List-Id: "Domain-based Message Authentication, Reporting, and Compliance \(DMARC\)" <dmarc.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/dmarc>, <mailto:dmarc-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/dmarc/>
List-Post: <mailto:dmarc@ietf.org>
List-Help: <mailto:dmarc-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/dmarc>, <mailto:dmarc-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 09 Jun 2023 14:07:26 -0000

On Fri, Jun 9, 2023 at 2:14 AM Barry Leiba <barryleiba@computer.org> wrote:

> > One case I saw multiple times where DKIM fails while SPF verifies is
> when the
> > message contains a line starting with "from " which some agent changes to
> > ">from ".  Some signing software eliminates such lines before signing,
> but
> > that's not in the spec, so one cannot say a signer is defective if it
> doesn't
> > do it.
>
> Have you seen that happen in the MTA relay process (in transit), or
> only after final delivery?  I can see that an MDA or a recipient MUA
> might do that, but it should *not* happen in transit, so it shouldn't
> affect DMARC processing.  Do you have actual examples where an MTA is
> making that change and breaking the DKIM sig?
>

My impression is that this translation (from "From " to ">From " and back)
is only supposed to happen at the endpoints.  If done properly, the
signature would be generated after the translation on egress and verified
prior to the translation on ingress.  DKIM is supposed to be executed
against the content that will be "on the wire".  If it's being done in
flight, something is broken.

And signing software shouldn't be mutating messages ever (other than adding
signatures, of course).

-MSK, participating

v2.23.0 | Report a Bug | By Email