IETF Logo Mail Archive

Re: dmarc damage, was gmail users read on... [bozo subtopic]

Scott Kitterman <scott@kitterman.com> Sun, 14 September 2014 14:58 UTC

Return-Path: <scott@kitterman.com>
X-Original-To: ietf@ietfa.amsl.com
Delivered-To: ietf@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 849C21A03F8 for <ietf@ietfa.amsl.com>; Sun, 14 Sep 2014 07:58:50 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.002
X-Spam-Level:
X-Spam-Status: No, score=-2.002 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Es-YVUH7NtV3 for <ietf@ietfa.amsl.com>; Sun, 14 Sep 2014 07:58:49 -0700 (PDT)
Received: from mailout03.controlledmail.com (mailout03.controlledmail.com [208.43.65.50]) (using TLSv1.1 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 6C2631A03EB for <ietf@ietf.org>; Sun, 14 Sep 2014 07:58:49 -0700 (PDT)
Received: from mailout03.controlledmail.com (localhost [127.0.0.1]) by mailout03.controlledmail.com (Postfix) with ESMTP id 9AC96D04706; Sun, 14 Sep 2014 10:58:48 -0400 (EDT)
DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=kitterman.com; s=2014-01; t=1410706728; bh=bJuNByI+du7sq2Pa9/YirMUrFy9VSS5DqF/aoTE6AMs=; h=In-Reply-To:References:Subject:From:Date:To:From; b=tAPk6ubYNma0xKm6lFPG/V3bMaauoBFuIXqKPAeBDuoBGc2WZHnXaWillksLmQzK5 gxAngu0TCXoBnzUyv9LL7lDMSCB2LfiQXDBIbAskFrLKzaduNiGkUX57QxManTlYfK RBOuJsDKg31hrjqk8LuQEKEn0oqx5/adEbMf6/TE=
Received: from [IPV6:2600:1003:b12c:eb76:a87a:dfe6:3aae:6730] (unknown [IPv6:2600:1003:b12c:eb76:a87a:dfe6:3aae:6730]) (using TLSv1 with cipher ECDHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by mailout03.controlledmail.com (Postfix) with ESMTPSA id 137DBD0420C; Sun, 14 Sep 2014 10:58:46 -0400 (EDT)
User-Agent: K-9 Mail for Android
In-Reply-To: <299EAC72-667A-46D5-9BB9-7ADFEF61A21E@isdg.net>
References: <20140913134907.2020.qmail@joyce.lan> <299EAC72-667A-46D5-9BB9-7ADFEF61A21E@isdg.net>
MIME-Version: 1.0
Content-Transfer-Encoding: 8bit
Content-Type: text/plain; charset="UTF-8"
Subject: Re: dmarc damage, was gmail users read on... [bozo subtopic]
From: Scott Kitterman <scott@kitterman.com>
Date: Sun, 14 Sep 2014 10:56:52 -0400
To: ietf@ietf.org
Message-ID: <ca0abd2c-9b8b-40a9-83e3-e884f81241c0@email.android.com>
X-AV-Checked: ClamAV using ClamSMTP
Archived-At: http://mailarchive.ietf.org/arch/msg/ietf/YjFr6U20vcX1o-CAkLoOqE6ArOU
X-BeenThere: ietf@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: IETF-Discussion <ietf.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/ietf>, <mailto:ietf-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/ietf/>
List-Post: <mailto:ietf@ietf.org>
List-Help: <mailto:ietf-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/ietf>, <mailto:ietf-request@ietf.org?subject=subscribe>
X-List-Received-Date: Sun, 14 Sep 2014 14:58:50 -0000


On September 14, 2014 10:40:51 AM EDT, Hector Santos <hsantos@isdg.net> wrote:
>
>On Sep 13, 2014, at 9:49 AM, "John Levine" <johnl@taugh.com> wrote:
>
>>> Agreed, but just wanted to add one thing- doesn't the details of the
>whether the sender
>>> has to align or not depends on whether SPF or DKIM is used as the
>authentication method?
>> 
>> No.  Neither DKIM nor SPF have any connection to either the From: or
>> Sender: header other than what DMARC is trying to do.
>
>DKIM has a required hash bind to the 5322.From field data -- the only
>5322 header signing requirement in DKIM.  It's burned into the now DKIM
>now STD level specification.  That's not a DMARC requirement, but one
>DMARC relies on having with DKIM.  
>
>Maybe an errata is in order?   

The field is required to be signed. It's not required to have any particular value. It's most certainly not required to be related to the signing domain in any way (which is what DMARC does).

Scott K

v2.23.0 | Report a Bug | By Email