Subject: Re: [dmarc-ietf] Response to a claim in draft-crocker-dmarc-author-00 security considerations
From: Jesse Thompson <[email-masked]>
To: [email-masked]
Date: Wed, 22 Jul 2020 17:38:25 -0500
List-Id: "Domain-based Message Authentication, Reporting, and Compliance \(DMARC\)" <dmarc.ietf.org>

On 7/22/20 12:05 PM, John Levine wrote:
> I don't believe we have a charter to tell mailing list operators what
> to do, even if we believed, against all experience, that they would
> take our advice.

https://cyber.dhs.gov/bod/18-01/ references https://dmarc.org/wiki/FAQ#I_operate_a_mailing_list_and_I_want_to_interoperate_with_DMARC.2C_what_should_I_do.3F

Who should be giving them advice?

> As may have been pointed out a few times, mailing lists had been
> serving their users perfectly well for decades before AOL and Yahoo made them
> DMARC roadkill.

Given that the email security industry's marketing now shames domain owners for not adopting DMARC, I think that the statute of limitations for AOL and Yahoo has passed.

Jesse