Subject: [Ietf-dkim] Re: Malicious Modification was: My concerns
From: "John Levine" <[email-masked]>
To: [email-masked]
Cc: [email-masked]
Date: 16 Apr 2025 17:22:44 -0400
List-Id: IETF DKIM List <ietf-dkim.ietf.org>

It appears that Larry M. Smith  <[email-masked]> said:
>You are correct and I agree completely that the exact same problem 
>exists for current and historical mail flows.
>
>I just wish that things like mailing lists didn't do that.  In fact, I 
>have been told recently that some will formulate messages differently 
>based on the sender's envelope's DMARC policy.  I have not been able to 
>verify this yet.

Not the envelope but the From: header domain's DMARC policy. Lots of lists do
that including this one, rewriting the From: address into one that will survive
DMARC handling.

>I would like to make the argument that such modification to the end-user 
>viewable parts of the message, like what is happening on this list, is 
>superfluous E.g.;
>
> > Subject: [Ietf-dkim] [...]
>[...]
>> _______________________________________________
>> Ietf-dkim mailing list -- [email-masked]
>> To unsubscribe send an email to [email-masked]
>
>Superfluous because of RFCs 2369, 2919, and 8058...  I'm sure that there 
>are others.

The problem is that recipients apply the From: domain's DMARC policy without
regard to whether the message might have come through a list.

When ARC came along I asked someone at a large mail provider why they don't just
whitelist familiar mailing lists. The answer was basically that lists do a lousy
job of spam filtering, and it is unfortunately common for an otherwise benign
list to start gushing spam when spammers buy stolen address books. use pairs of
(to, from) from an address book that happens to include the list and some
subscribers.

ARC was supposed to fix that by providing a look back at the authentication
results before the list did what it did, but that turned out not to work because
you had to believe that the ARC signers were telling the truth. The plan here is
to show their work so you don't have to trust them, you can unwind the changes
and see what they did.

R's,
John