Re: Weird messages from IETF/Google Mailservers (WG: PALS WG Adoption poll draft-schmutzer-pals-ple)

[Toerless Eckert <[e-mail]>]

Thanks, Barry

As i said i did not have the time to read up on all that mail "security".
Its nice to hear that DMARC is not standard, but i wouldn't even want to
voice a strong opinion wheter or not it should become one without understanding
this all better. Alas, as said: reading all the RFCs around it is a lot less
efficient than some more operator centric representation, that i can't find
(operational issues).

In any case, it would be nice if there would be a BCP in due time about the
actual operational practices including warnings about the severe implications
of what you call "overstepping" below.


Cheers
    toerless


On Thu, Jun 01, 2023 at 10:46:51AM -0400, Barry Leiba wrote:
> But we *are* finishing work to standardize DMARC:
> https://datatracker.ietf.org/doc/draft-ietf-dmarc-dmarcbis/
> ...and there is a huge controversy in the working group about what
> normative things to say about this, and whether we should say anything
> normative at all.
> 
> But this is something different; gmail appears to be seriously
> overstepping.  I checked the DMARC record for telekom.de (TXT record
> in _dmarc.telekom.de), and here it is:
>    v=DMARC1;p=none;rua=mailto:[e-mail];ruf=mailto:[e-mail];
> 
> They are publishing a "p=none" policy, which should *not* trigger a
> rejection because of failure to authenticate.  Yet gmail is rejecting
> it anyway (as if the policy were p=reject).  I will ask my gmail
> contact about this.
> 
> Barry (chair of the DMARC working group)
> 
> On Thu, Jun 1, 2023 at 10:38 AM Jim Fenton <[e-mail]> wrote:
> >
> > On 1 Jun 2023, at 7:12, Toerless Eckert wrote:
> >
> > > Please complain with the ART email folks. It is the IETF that standardized all those
> > > email "security" mechanisms such DMARC that google is now using to effectively make
> > > email unusable for many people (and this is primarily what i heard from outside the IETF).
> >
> > IETF did not standardize DMARC: RFC 7489 is an informational specification published via the independent submission track.
> >
> > Unfortunately many people and organizations, including some that are mandating the deployment of DMARC and publication of “reject” policies, so not understand the difference between informational and standards-track.
> >
> > -Jim
> >

-- 
---
[e-mail]