Re: What I've been wondering about the DMARC problem

Theodore Ts'o <> Thu, 17 April 2014 20:53 UTC

Return-Path: <>
Received: from localhost ( []) by (Postfix) with ESMTP id 66C3E1A0192 for <>; Thu, 17 Apr 2014 13:53:42 -0700 (PDT)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: -0.274
X-Spam-Status: No, score=-0.274 tagged_above=-999 required=5 tests=[BAYES_20=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RP_MATCHES_RCVD=-0.272, SPF_PASS=-0.001] autolearn=ham
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id iWUORYI1YUBS for <>; Thu, 17 Apr 2014 13:53:37 -0700 (PDT)
Received: from ( [IPv6:2600:3c02::f03c:91ff:fe96:be03]) by (Postfix) with ESMTP id 673741A0109 for <>; Thu, 17 Apr 2014 13:53:37 -0700 (PDT)
Received: from root ( by with local-esmtp (Exim 4.80) (envelope-from <>) id 1WatJM-0002wG-Rb; Thu, 17 Apr 2014 20:53:32 +0000
Received: by (Postfix, from userid 15806) id 39093580598; Thu, 17 Apr 2014 16:53:32 -0400 (EDT)
DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple;; s=ef5046eb; t=1397768012; bh=NBhUUztUX8k895F9skyxuSEdN2+pmWZcXL44mLFA2IA=; h=Date:From:To:Cc:Subject:References:In-Reply-To:From; b=AT0rv0Aucrkc1ny/VDppe/c6qsqznwzesp46H4I9iUkSjjZ60Du4h1imD12EsXZE7 H5/YEGxuIypGbdGokBnU6ltk4o7INholHM65faNk6Nh8lLpnTLqyfEKDErrDTSJLLt CHE+z/zMDpdglMOv7llqoeAuUVpYRbSTznylRNmI=
Date: Thu, 17 Apr 2014 16:53:32 -0400
From: Theodore Ts'o <>
To: Brian E Carpenter <>
Subject: Re: What I've been wondering about the DMARC problem
Message-ID: <>
References: <> <> <> <> <> <> <> <> <> <>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <>
User-Agent: Mutt/1.5.23 (2014-03-12)
X-SA-Exim-Connect-IP: <locally generated>
X-SA-Exim-Scanned: No (on; SAEximRunCond expanded to false
Cc: Jim Fenton <>, IETF discussion list <>
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: IETF-Discussion <>
List-Unsubscribe: <>, <>
List-Archive: <>
List-Post: <>
List-Help: <>
List-Subscribe: <>, <>
X-List-Received-Date: Thu, 17 Apr 2014 20:53:42 -0000

On Fri, Apr 18, 2014 at 08:06:35AM +1200, Brian E Carpenter wrote:
> > 
> > The Reply-To: field is adjusted to be the author's address, 
> Oh, OK. Most UAs will probably do what you describe, but I think
> there are exceptions. However, if I want to reply to the author
> alone, it's now the simple Reply that will fail me, because it
> will reply to the list. And in my mail folders, messages will
> all appear to come from the list; if I want to find the message
> that Sabahattin sent me two years ago, I can't, because my UA
> doesn't allow for searching on the Reply-To field.
> It's still got very poor semantics.

It's all about semantics, isn't?

Suppose we made the mailing list software take the contents of the
>From field, and moved it to something like "X-Originally-From: ", and
changed the From field to be "".org".  That would be what the
DMARC people would want, right?

Except then, a couple of years later, because users might actually
want to find the message that was written by "Brian Carpenter", or
"Sabahattin Gucukoglu", and not from "".org", MUA's might
start using the Originally-From field in the summary field, and start
emphasizing the "Originally-From" from field in the UI.  At which
point, the spammer/scammer/whatever could start forging the the
"Originally-From" field, and then Lo!  There will be a DMARC II,
demanding that "Originally-From" field be aligned with the From field,
and we're right back to where we started.

It was the same argument about why a DKIM or DMARC couldn't just
verify the Sender field, and call it a day.  The problem is that the
>From field is what people pay attention to.

And this is true of whatever solution we want to better support
mailing lists.  Suppose the answer is to rewrite the from field to
something like this:


Or this:

From: (Originally from Brian E Carpenter:

It doesn't matter.  Eventually, the UA's will start emphasizing and
parsing out the original From field information, because that's what
people will want to be automatically added to their address book, and
not, and that's what they will want to see in their
e-mail summary.  And then the DMARC folk will say, "Oh, Noes!
Spammers and scammers and bears, oh my!  They are using this loophole
to fool the naive user."  We must have DMARC II... and DMARC
III.... and DMARC IV.... and it will never end.

					- Ted