Re: DMARC methods in mailman --- [LEDE-DEV] DMARC related mass bounces / disabled subscriptions (fwd) Jo-Philipp Wich: [LEDE-DEV] DMARC related mass bounces / disabled subscriptions

John C Klensin <> Sun, 18 December 2016 19:04 UTC

Return-Path: <>
Received: from localhost (localhost []) by (Postfix) with ESMTP id 9D354129675 for <>; Sun, 18 Dec 2016 11:04:12 -0800 (PST)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: -5
X-Spam-Status: No, score=-5 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RP_MATCHES_RCVD=-3.1] autolearn=ham autolearn_force=no
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id sSTNrDnzj6Za for <>; Sun, 18 Dec 2016 11:04:11 -0800 (PST)
Received: from ( []) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by (Postfix) with ESMTPS id E94F7129673 for <>; Sun, 18 Dec 2016 11:04:10 -0800 (PST)
Received: from [] (helo=PSB) by with esmtp (Exim 4.82 (FreeBSD)) (envelope-from <>) id 1cIgkh-000Abu-KE; Sun, 18 Dec 2016 14:04:07 -0500
Date: Sun, 18 Dec 2016 14:04:01 -0500
From: John C Klensin <>
To:, Theodore Ts'o <>
Subject: Re: DMARC methods in mailman --- [LEDE-DEV] DMARC related mass bounces / disabled subscriptions (fwd) Jo-Philipp Wich: [LEDE-DEV] DMARC related mass bounces / disabled subscriptions
Message-ID: <CE27ED58B7A503683C57E125@PSB>
In-Reply-To: <>
References: <> <> <> <> <> <> <> <> <> <> <> <>
X-Mailer: Mulberry/4.0.8 (Win32)
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
X-SA-Exim-Scanned: No (on; SAEximRunCond expanded to false
Archived-At: <>
Cc: IETF discussion list <>
X-Mailman-Version: 2.1.17
Precedence: list
List-Id: IETF-Discussion <>
List-Unsubscribe: <>, <>
List-Archive: <>
List-Post: <>
List-Help: <>
List-Subscribe: <>, <>
X-List-Received-Date: Sun, 18 Dec 2016 19:04:12 -0000

--On Sunday, December 18, 2016 09:05 -0800 Dave Crocker
<> wrote:

>> That's been clear.  To the extent that though that some
>> service providers might want to have developers stay on their
>> platform because they might be powerful influencers, there
>> might be *some* influence, but it is admittedly very little.
> The world of consumer-oriented email deals with scale that
> makes the 'developer' market segment almost unmeasurably
> small.  It is unlikely any consumer service is going to want,
> or be able, to make adjustment for the developer segment.


While I agree with your analysis, let me suggest a slightly
different formulation (and note this is straying away from the
question, which I understood to be about IETF mailing lists and
DMARC workarounds.  In the fourth quadrant of a conceptual
matrix, there are people whose use of, and dependency on, email
are mission-critical or personally critical and whose daily
email volume is very high.  In the diagonally-opposite first
quadrant are those who may find email very useful but not
actually critical to their lives or work and whose volume is
relatively low.  For simplicity, I'll leave the other two
quadrants as an exercise.

One important thing about that matrix is that the number of
people in the first quadrant is hugely larger than the number of
people in the fourth, to the point that almost any argument
based on number of users, eyeballs, etc., can justify ignoring
the fourth quadrant (and maybe the other two).  In particular,
small inconveniences, or even larger ones for a small fraction
of the already-small number of messages received, are likely to
be accepted in return for a convenient and free email service.
The people in that quadrant typically don't need sophisticated
mail management facilities (except maybe for personal archival
purposes) -- they just don't get enough mail and/or it isn't
important enough.  It might be an exaggeration, but arguments
that everyone should just use Webmail or even proprietary
systems interconnected by gateways that more or less work, are
not far away (such systems can, among other things, easily
develop really effective anti-spam systems if the proprietors
actually find that to be in their business interests.  

The number of Ted's developers or subscribers to IETF lists in
the first quadrant is insignificant, not only because there are
some of them in the other quadrants but because there just
aren't very many of them relative to the total population of
that quadrant.

Now, the questions become one of who is in the fourth quadrant,
how large that quadrant's population is, what features they
need, and how should they get them.  Part of the answer to the
latter is that, while "free" is nice, many of us would happily
pay for better mail management capability and other features
(see recent discussions about IMAP capabilities and
alternatives).  Simply because of mail volume and management
issues, we are probably much more sensitive to standards
conformance, predictability of header field content, etc.  We
might also be less tolerant of systems that simply lose messages
that they consider suspicious than the folks in the first
quadrant (at least if it isn't from someone's easily-whitelisted
grandmother).   If nothing else, a small inconvenience
multiplied by 500 or 1000 or more legitimate messages a day
isn't a small inconvenience any more.   Many of us do pay by
insisting in controlling/ running our own mail servers at
effective costs (including the marginal cost of Internet
connections that allow servers) of hundreds of dollars a month.
As a percentage, I'd guess that the concentration of developers
and active IETF participants in that fourth quadrant is

So... do we need different sets of standards (or even best
practices) for the first quadrant and the fourth?   Are we
willing to leave the practices of the suppliers for the first
quadrant users to whatever those large providers decide to do,
such that community consensus-based standards may not even be
relevant?  If we are not willing, do we actually have a
choice... several of the comments in recent days suggests that
the situation is just our new reality and we need to adjust to

My suggestion is that, if we really cannot affect the behavior
of the service providers for the first quadrant, we should
concentrate our efforts on the fourth, making sure that, if
email use and dependency rises in the general population, we
have appropriate working systems and that, in determining IETF
procedures, we should be paying a lot more attention to the
fourth quadrant rather than concentrating on the needs and
preferences of the users in the first quadrant, no matter how
many of them there are.   

I would feel somewhat differently about this if I thought IETF
decisions would have a significant design or decision-making
impact on those large-scale first quadrant providers, but the
evidence, reinforced by the DMARC experience, is that they are
more likely to make decisions that work well for them and their
systems, users, and business models and then leave us to
compensate for any damage as best we can.    Maybe, but just
maybe, we should be thinking more about encapsulating messages
for those cases, as some of us thought would be the MIME remedy
for mail passed through gateways with significant potential for
information loss.