Re: (DMARC) Why mailing lists are only sort of special

Miles Fidelman <mfidelman@meetinghouse.net> Thu, 17 April 2014 15:31 UTC

Return-Path: <mfidelman@meetinghouse.net>
X-Original-To: ietf@ietfa.amsl.com
Delivered-To: ietf@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4CD331A0271 for <ietf@ietfa.amsl.com>; Thu, 17 Apr 2014 08:31:00 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -0.281
X-Spam-Level:
X-Spam-Status: No, score=-0.281 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, J_CHICKENPOX_65=0.6, MISSING_HEADERS=1.021, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 0hJR_MyKbv0x for <ietf@ietfa.amsl.com>; Thu, 17 Apr 2014 08:30:56 -0700 (PDT)
Received: from server1.neighborhoods.net (server1.neighborhoods.net [207.154.13.48]) by ietfa.amsl.com (Postfix) with ESMTP id 4AA7A1A01DE for <ietf@ietf.org>; Thu, 17 Apr 2014 08:30:53 -0700 (PDT)
Received: from localhost (localhost.localdomain [127.0.0.1]) by server1.neighborhoods.net (Postfix) with ESMTP id 23851CC091 for <ietf@ietf.org>; Thu, 17 Apr 2014 11:30:50 -0400 (EDT)
X-Virus-Scanned: by amavisd-new-2.6.2 (20081215) (Debian) at neighborhoods.net
Received: from server1.neighborhoods.net ([127.0.0.1]) by localhost (server1.neighborhoods.net [127.0.0.1]) (amavisd-new, port 10024) with LMTP id EGnMhBeWtu6P for <ietf@ietf.org>; Thu, 17 Apr 2014 11:30:45 -0400 (EDT)
Received: from new-host.home (pool-173-76-155-14.bstnma.fios.verizon.net [173.76.155.14]) by server1.neighborhoods.net (Postfix) with ESMTPSA id 97753CC094 for <ietf@ietf.org>; Thu, 17 Apr 2014 11:30:44 -0400 (EDT)
Message-ID: <534FF3A3.2070504@meetinghouse.net>
Date: Thu, 17 Apr 2014 11:30:43 -0400
From: Miles Fidelman <mfidelman@meetinghouse.net>
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:28.0) Gecko/20100101 Firefox/28.0 SeaMonkey/2.25
MIME-Version: 1.0
CC: "ietf@ietf.org" <ietf@ietf.org>
Subject: Re: (DMARC) Why mailing lists are only sort of special
References: <20140417131134.5CEFC1ACCF@ld9781.wdf.sap.corp> <3DA69075-C8DB-4E40-8B2C-849AE05CCFF1@gmail.com> <CE39F90A45FF0C49A1EA229FC9899B0507D491B9@USCLES544.agna.amgreetings.com>
In-Reply-To: <CE39F90A45FF0C49A1EA229FC9899B0507D491B9@USCLES544.agna.amgreetings.com>
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
Archived-At: http://mailarchive.ietf.org/arch/msg/ietf/8xaAd4ibs6YN9pZsqNTM8a9B-Ts
X-BeenThere: ietf@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: IETF-Discussion <ietf.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/ietf>, <mailto:ietf-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/ietf/>
List-Post: <mailto:ietf@ietf.org>
List-Help: <mailto:ietf-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/ietf>, <mailto:ietf-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 17 Apr 2014 15:31:00 -0000

MH Michael Hammer (5304) wrote:
>
>> -----Original Message-----
>> From: ietf [mailto:ietf-bounces@ietf.org] On Behalf Of Yoav Nir
>> Sent: Thursday, April 17, 2014 9:27 AM
>> To: mrex@sap.com
>> Cc: ietf@ietf.org
>> Subject: Re: (DMARC) Why mailing lists are only sort of special
>>
>>
>> On Apr 17, 2014, at 4:11 PM, Martin Rex <mrex@sap.com> wrote:
>>
>>> Yoav Nir wrote:
>>>> On Apr 17, 2014, at 9:35 AM, Dave Cridland <dave@cridland.net> wrote:
>>>>> Right now, my MUA treats this as a message "From John R Levine
>>>>> <johnl@taugh.com>"m>". This means that any policy on the message
>>>>> origination comes from looking solely at the taugh.com domain. We'll
>>>>> pretend it has a DMARC policy. Herein lies the Yahoo/DMARC issue,
>>>>> because unless your policy essentially stipulates that the IETF is
>>>>> allowed to spoof you, we're stuck.
>>>> Then perhaps this is what needs to change. John R Levine did not send
>>>> you a message. He sent a message to the list. It is the list software
>>>> that sent you a message. So perhaps the From field should have been
>>>> ?From: IETF Mailing list on behalf of John R Levine <ietf@ietf.org>?g>?.
>>> But that is EXACTLY what the IETF mailing list exploder *IS* doing
>>> exactly as it has been specified for ages:
>>>
>>> https://tools.ietf.org/html/rfc822#section-4.4.2
>>> https://tools.ietf.org/html/rfc822#appendix-A.2
>>>
>>> https://tools.ietf.org/html/rfc5322#section-3.6.2
>>>
>>>             The "From:" field specifies the author(s) of the message,
>>>    that is, the mailbox(es) of the person(s) or system(s) responsible
>>>    for the writing of the message.  The "Sender:" field specifies the
>>>    mailbox of the agent responsible for the actual transmission of the
>>>    message.
>>>
>>>   From: Yoav Nir <ynir.ietf@gmail.com>
>>>   Subject: Re: (DMARC) Why mailing lists are only sort of special
>>>   Errors-To: ietf-bounces@ietf.org
>>>   Sender: ietf <ietf-bounces@ietf.org>
>>>   Date: Thu, 17 Apr 2014 13:50:30 +0300
>>>   Message-ID: <B3467912-BDCA-4AE8-9939-60013DA99267@gmail.com>
>>>   To: Dave Cridland <dave@cridland.net>
>>>   CC: "ietf@ietf.org" <ietf@ietf.org>
>>>
>>>
>>> Something as old as Outlook 2003 will properly display a message that
>>> is received with a "Sender:" as "<Sender> on behalf of <From>"
>> A client as new as Mail.app on Mac OS X 10.9 does not.
>>
>> Obviously the Sender: field is not where the DMARC implementations use
>> for checking policy.
>>
> Yoav, this is by design.
>
> There is no reliable way to determine the relationship between the Sender:field and the From: field from an authentication and authorization perspective at the domain level unless both are within the same domain space. Other than "I say so", how do we know that the Sender IS truly acting on behalf of the author in the From

Well - if the originating system were to include To: in the signature, 
and it matched Sender: that would go a long way.

Miles Fidelman

-- 
In theory, there is no difference between theory and practice.
In practice, there is.   .... Yogi Berra