Re: DMARC: perspectives from a listadmin of large open-source lists

[Scott Kitterman <[e-mail]>]

On Monday, April 14, 2014 10:26:44 Murray S. Kucherawy wrote:
> On Mon, Apr 14, 2014 at 8:09 AM, Miles Fidelman
> 
> <[e-mail]>wrote:
> > Is it perhaps also incumbent on the folks promulgating DMARC (and its
> > predecessors, and its sure-to-be successors) to work cooperatively with
> > mailing list developers, rather than taking the position "nope, we break
> > mailing lists, not our problem?"
> 
> The DMARC proponents did engage mailman.   Version 2.1.16 includes support
> for a setting that makes the operation of the list DMARC-friendly, though
> likely in a way some people will find unpalatable.  Either way, it was not
> done entirely in a vacuum.
> 
> > I'm kind of coming to the conclusion that what we need to be looking at is
> > defining an SMTP extension that addresses BOTH sets of concerns - and
> > doing
> > so in a cooperative manner that engages not just the community behind DKIM
> > and DMARC, but also the developers and operators of mailman, sympa,
> > majordomo, listserv - and ideally the sendmail, postfix, exim, qmail
> > community.
> > 
> > Dare I suggest that this calls for an IETF working group?
> 
> I mentioned in another thread that the DMARC people did come to the IETF to
> ask for a working group to complete development of the work on the
> standards track.  This request was denied on the grounds that DMARC was
> essentially already done, and thus the IETF had nothing engineering-wise to
> contribute.  There were also too few people that were not already DMARC
> proponents that would commit to working on it.
> 
> (And as I said on that other thread, I'm happy to stand corrected if I've
> mischaracterized any of that.)

My perception (and it may also be wrong) is that anyone who claimed there was 
work yet to be done was shouted down.  It was either prove there was work to 
be done by going off and doing it on your own, or clearly it was done and no 
more work needed doing.

The DMARC spec has certainly improved since it's been public, but I certainly 
don't think it's done and have said so multiple times.  I'm also willing to 
work on it.

As I said in the other thread, I think the only reason it was perceived as 
done is that the private group that developed the spec declared it done and 
fought against any WG charter language that would have permitted changes to 
the core protocol.    Based on that approach, no wonder it was declined.

Scott K