Re: [ietf-822] A permission to re-sign header

["John R Levine" <[e-mail]>]

>> Do you mean that every DMARC publisher would have its own exception
>> whitelist, and the adjustment would be to assume the whitelist is credible
>> if its name matches the From: domain?  I suppose that could work, although
>> expecting every domain to publish its own whitelist seems unlikely to
>> scale.  A domain could indirectly use someone else's domain whitelist via
>> DNAME, but urrghh.
>
> Right, maybe that's what I had in mind.  It seems as though you're
> essentially suggesting we need a way to confirm a relationship between X
> and Y, and VBR pretty much does that.

It does, although it's a global relationship.  Pete's M-R thing is per 
message, but it's hard to think of a realistic situation with a forwarder 
that's reliable enough to allow to rewrite some messages but not others.

>> If we expect there to be a handful of widely used DMARC exception
>> whitelists, a mailing list could certainly use VBR as defined to point at
>> the whitelist(s) in which its signing domain is included.
>
> Also, it is both the "go look at the whitelist" hint and the specification
> of how the whitelist is published.

Yup.  No point reinventing something different.

Regards,
John Levine, [e-mail], Taughannock Networks, Trumansburg NY
Please consider the environment before reading this e-mail.