Re: [dmarc-ietf] IETF Mailing Lists and DMARC

[Theodore Ts'o <[e-mail]>]

On Wed, Nov 02, 2016 at 02:58:31PM -0700, Brandon Long wrote:
> If this is a problem for you as a receiver, you can choose to attempt to
> whitelist the ietf mailing list mail from DMARC enforcement.  You may not
> be able to do so, just like the sender may not be able to change their
> organizations DMARC record.
> 
> The middle man, ietf, can work around this today.  They need to run a new
> enough version of mailman and enable one of the workarounds.  For mailman,
> this means munging the mail, usually the From header.  It's not pretty, but
> it works, it works now, and it will work for everyone.  The difference is
> mostly cosmetic, though depending on your mail client, there may be other
> downsides.  And it may violate RFC 5322.
> 
> I don't think this is possible with mailman, but theoretically it is also
> possible for a mailing list to pass the message through without breaking
> the DKIM signature.  This means no footers and no subject tags.  Which of
> these a list would choose is probably dependent on the list members.
> 
> mailman should also know how to tell the difference between a message
> specific policy bounce, and particular DMARC bounces, and should apply
> different heuristics to handling them.  I have no idea if that existing in
> any version of mailman or is a planned feature.
> 
> There is a proposed standard, ARC, that would allow mail receivers to do
> more intelligent whitelisting.  It's not ready yet.

There is a third option --- which is that if you want to participate
on certain mailing lists, you have to use a non-DMARC e-mail address.
There are people with google.com addresses that need to use non-Google
addresses in order to participate on the Linux Kernel Mailing List.

On Wed, Nov 02, 2016 at 04:00:36PM -0600, Cullen Jennings wrote:
> 
> So how do we get this fixed ? Has someone talked to the IESG about
> this? Right now as a chair, I am making consensus calls that are
> probably ignoring any emails from people from google.com - and other
> - because I am not getting their email. That seems like a serious
> process problem.

I would expect that most folks at Google.com who need to interact with
external communities are painfully aware of the DMARC brain-damage,
and at least with respect to the Googlers who work on the Linux
kernel, so it shouldn't be coming as a surprise.

I would expect that it would easy to determine how many who are on
DMARC-hobbled domains on the IETF working gorup mailing lists, and it
should be easy to create tools to send last-call announcements to
those people to at least solve the process problem.

But given that at the IETF attendees represent themselves, and not
their companies, if it means that people at certain companies need to
get alternate e-mail arrangements, I don't think that's a fatal issue.
It certainly hasn't bothered the LKML administrators, which has a
similar "we're all engieners, not corporate representatives" ethos.

Cheers,

						- Ted