Re: [dmarc-ietf] Call for Adoption: DMARC Use of the RFC5322.Sender Header Field

[Brandon Long <[e-mail]>]

On Mon, Aug 17, 2020 at 5:22 AM Laura Atkins <[e-mail]>
wrote:

>
>
> On 17 Aug 2020, at 12:25, Alessandro Vesely <[e-mail]> wrote:
>
> On Mon 17/Aug/2020 11:46:55 +0200 Laura Atkins wrote:
>
>
> The forum page is off the FTC website, but the document links are
> still accessible:
>
>
>
> A copy is here:
>
> https://web.archive.org/web/20120603201012/https://www.ftc.gov/bcp/workshops/e-authentication/
>
> A sentence says:
>
>    The Report, however, identified domain-level authentication as a
>    promising technological development that would enable Internet
>    Service Providers (‘‘ISPs’’) and other domain holders to better
>    filter spam, and that would provide law enforcement with a potent
>    tool for locating and identifying spammers.
>
>
> And, 17 years on, we know that domain level authentication doesn’t
> actually help filter spam nor does it provide law enforcement with a potent
> tool for locating and identifying spammers. It was promising, it didn’t
> live up to the promise.
>

I don't understand this.  Virtually every spam rule we write these days
depends on information attached to the domain level authentication of an
email message.

I mean, it's not some simple binary thing, but it also very clearly helps
us filter spam.

We know, now, that turning on domain level protection does not stop
> phishing attacks against that company. It stops direct spoofing of the
> domain, but the phishers simply use a completely different domain. Just
> this weekend I got a PayPal phish. PayPal who helped invent DMARC are still
> getting spoofed and phished. Sure, the phishers aren’t using the
> paypal.com domain, but that doesn’t seem to have any effect on their
> success at stealing money from people.
>

Do we have stats on that?

I know that we've increased our resources towards anti-phishing over the
years, so there's no apples to apples comparison here, and it would be hard
to tease out the specifics anyways... but we've certainly had success in
catching more of it.

Brandon