Re: WG Review: Domain-based Message Authentication, Reporting & Conformance (dmarc)

[Viktor Dukhovni <[e-mail]>]

On Mon, Jul 14, 2014 at 04:47:19PM -0400, Scott Kitterman wrote:

> > >    However, DMARC is problematic for mail that does not flow from
> > >    operators having a relationship with the domain owner, directly to
> > >    receivers operating the destination mailbox. Examples of such
> > >    "indirect" flows are mailing lists, publish-to-friend functionality,
> > >    mailbox forwarding (".forward"), and third-party services that send
> > >    on behalf of clients. The working group will explore possible updates
> > >    and extensions to the specifications in order to address limitations
> > >    and/or add capabilities. It will also provide technical
> > >    implementation guidance and review possible enhancements elsewhere in
> > >    the mail handling sequence that could improve could DMARC
> > >    compatibility.

This is a solved problem, the "Rfc822.Sender" field should have
from the outset trumped the "Rfc822.From" field when determining
message origin, and the DMARC policy should be that of the "Sender"
domain.  Some MUAs already expose "Sender != From" by displaying
"From <sender> on behalf of <author>".  This needs to become standard
MUA behaviour.

-- 
	Viktor.