Re: [dmarc-ietf] Call for Adoption: DMARC Use of the RFC5322.Sender Header Field

[Laura Atkins <[e-mail]>]

> On 19 Aug 2020, at 00:21, Brandon Long <blong=[e-mail]> wrote:
> 
> 
> 
> On Mon, Aug 17, 2020 at 5:22 AM Laura Atkins <[e-mail] <mailto:[e-mail]>> wrote:
> 
> 
>> On 17 Aug 2020, at 12:25, Alessandro Vesely <[e-mail] <mailto:[e-mail]>> wrote:
>> 
>> On Mon 17/Aug/2020 11:46:55 +0200 Laura Atkins wrote:
>>> 
>>> The forum page is off the FTC website, but the document links are 
>>> still accessible:
>> 
>> 
>> A copy is here:
>> https://web.archive.org/web/20120603201012/https://www.ftc.gov/bcp/workshops/e-authentication/ <https://web.archive.org/web/20120603201012/https://www.ftc.gov/bcp/workshops/e-authentication/>
>> 
>> A sentence says:
>> 
>>    The Report, however, identified domain-level authentication as a
>>    promising technological development that would enable Internet
>>    Service Providers (‘‘ISPs’’) and other domain holders to better
>>    filter spam, and that would provide law enforcement with a potent
>>    tool for locating and identifying spammers.
> 
> And, 17 years on, we know that domain level authentication doesn’t actually help filter spam nor does it provide law enforcement with a potent tool for locating and identifying spammers. It was promising, it didn’t live up to the promise. 
> 
> I don't understand this.  Virtually every spam rule we write these days depends on information attached to the domain level authentication of an email message.

I was thinking more that simply adding authentication doesn’t do anything to identify spam vs. not-spam. Authentication give you a valid identifier to hang a reputation on, but spammers are great at implementing authentication.  

> I mean, it's not some simple binary thing, but it also very clearly helps us filter spam.

You are correct and I wasn’t thinking. 

> We know, now, that turning on domain level protection does not stop phishing attacks against that company. It stops direct spoofing of the domain, but the phishers simply use a completely different domain. Just this weekend I got a PayPal phish. PayPal who helped invent DMARC are still getting spoofed and phished. Sure, the phishers aren’t using the paypal..com <http://paypal.com/> domain, but that doesn’t seem to have any effect on their success at stealing money from people. 
> 
> Do we have stats on that?

Stats, no. But the fact that they’re still doing it tells me it still works. If it wasn’t making them some level of money, they’d move on to something else. 

> I know that we've increased our resources towards anti-phishing over the years, so there's no apples to apples comparison here, and it would be hard to tease out the specifics anyways... but we've certainly had success in catching more of it.

No argument here. But as much of the world’s email you handle you don’t handle all of it. And I have spoken with some of the less savory end of mailers who actively avoid mailing your network and target folks outside of it. 

laura 


-- 
Having an Email Crisis?  We can help! 800 823-9674 

Laura Atkins
Word to the Wise
[e-mail]
[phone]		

Email Delivery Blog: https://wordtothewise.com/blog