Re: [dmarc-ietf] Signaling MLMs

[Alessandro Vesely <[e-mail]>]

On Fri 14/Apr/2023 22:43:43 +0200 Hector Santos wrote:
> On Apr 14, 2023, at 3:20 PM, Murray S. Kucherawy <[e-mail]> wrote:
>> On Fri, Apr 14, 2023 at 10:20 AM Alessandro Vesely <[e-mail] <mailto:[e-mail]>> wrote:
>>> On Fri 14/Apr/2023 15:47:12 +0200 Scott Kitterman wrote:
>>>> On April 14, 2023 1:29:58 PM UTC, "Murray S. Kucherawy" <[e-mail] <mailto:[e-mail]>> wrote:
>>>>> On Fri, Apr 14, 2023 at 4:31 AM Alessandro Vesely <[e-mail] <mailto:[e-mail]>> wrote:
>>>>>
>>>>>> Heck, MLMs should start rejecting messages sent from domains that publish a 
>>>>>> blocking policy *when they fail authentication on entry*!!
>>>>>
>>>>> That's not enough to avoid the damage we're talking about.
>>>
>>> Agreed.  Yet, it is a sane half-way between crazy rejecting always and 
>>> completely ignoring ABUSE.
>>
>> Both DKIM (certainly) and SPF (I'm pretty sure) advocate against rejection of messages merely because they fail authentication on ingress.
>
> And respectfully, SPF always had a strong reject, hard fail policy concept since it's LMAP R&D upbringing — immediate rejection, 55z rejection code.
>
> Why Not?  It was optimized.  It served a purpose to address spoofs. Partial, Neutral and Unknown results were possible. That was suppose to be feed to a heuristics, highly subjective Reputation Engine. After exactly 20 years of data, SPF rejection rate is 6.3% of the incoming rejection reasons. https://winserver.com/public/spamstats.wct


SPF is rather a spade than a foil.  It can block tons of flagrant spam cheaply. 
  It presumes receivers check against a list of known forwarders; Appendix D of 
RFC 7208 is rather clear on that point.  I use an SPF record which explicitly 
requires whitelisting, among the many possibilities offered by that protocol.

DKIM does precisely one thing, allowing a domain to claim some responsibility 
for a message.  It is a cryptographic tool which puts no implied semantics on 
responsibility.  Section 6.3 of RFC 6376 clearly says that rejection based on 
dkim=fail can only make sense in case of prior agreements.

DMARC is different.  It precisely allows to establish policies on the From: 
domain.  Section 8.3 of DMARCbis is clear.  We cannot be vague on what 
circumstances can cause an exception.  I figure it's the reciprocal of DKIM: 
skipping to obey a DMARC policy can only make sense in case of prior agreement 
with the sender.


>>> I agree there are better solutions, but they're not yet developed.  As ugly as 
>>> it may be, From: munging is the emerged solution.  It is a _fact_.  Now repeat 
>>> again that the IETF standardized facts, not theories...
>>
>> Let's put the challenge back on you: Where's your evidence that From munging is the emerged consensus solution that this working group should standardize?  Where is this _fact_?  If we advance that as a Proposed Standard, the community will quite reasonably ask why we think this is true, and we're going to need to be able to answer them.  If working group consensus agrees, then away we go.
>
> As much as I am an original mail engineering purest (anyone here ever work with Fidonet?) and therefore consider it to be a fundamental taboo to destroy originating copyrighted authorship of anything, the MLS/MLM needs to evolve to handle the various 1::many broadcasting distributions under a new security umbrella.
>
> Because the current DMARCbis umbrella is not providing 100% coverage, for the MLS./MLM, it needs to do one of two things;  restrict subscription/submissions or strip the security and rewrite the copyrighting authorship, perpetuating a potential harm including legal.
>
> The latter is not preferred.  The former would be normal part of a protocol complete algorithm. You would do the former always.  It’s the easiest.  No need to modify the MLS.  Just the MLM low code provisional scripts.


I only know a handful of mailing lists, and they all do From: rewriting.  Some 
took years to adapt, but eventually adapted.  Are there any who don't?

I agree lists may also refuse participation and require posters to get gmail 
addresses.

In the case of IETF lists, copyright issues are addressed by the Note Well.  I 
see no violation in From: rewriting.

Anyway, there are also other kinds of agreements.  Whereas ATP considers 
agreements between author domains and MLMs, it is also possible to consider 
agreements between MLMs and subscriber domains.  The latter seems to be more 
promising to me.

Until then, there is some disruption.  We know it.  We can document it; we're 
not ignoring it.  We thought hard about it and concluded that it necessarily 
arises.  To timidly roll back doesn't seem to be a feasible option.  Making 
laws that cannot be followed, implying that every body is implicitly guilty, is 
an oldish governmental practice which sounds just silly when enacted by someone 
who does not even have a protocol police.


Best
Ale
--