Re: [Tools-discuss] Weird messages from IETF/Google Mailservers (WG: PALS WG Adoption poll draft-schmutzer-pals-ple)

If this upcoming book is as good as his other books, you will find Michael W. Lucas’ new book “How to run your own mail server” very helpful when it is released:

https://mwl.io/archives/22649

While you may not run your own mail server, the techniques and best practices will be explained.

Thanks,
Tom

> On Jun 1, 2023, at 7:05 PM, Toerless Eckert <tte@cs.fau.de> wrote:
> 
> Thanks, Barry
> 
> As i said i did not have the time to read up on all that mail "security".
> Its nice to hear that DMARC is not standard, but i wouldn't even want to
> voice a strong opinion wheter or not it should become one without understanding
> this all better. Alas, as said: reading all the RFCs around it is a lot less
> efficient than some more operator centric representation, that i can't find
> (operational issues).
> 
> In any case, it would be nice if there would be a BCP in due time about the
> actual operational practices including warnings about the severe implications
> of what you call "overstepping" below.
> 
> 
> Cheers
>    toerless
> 
> 
>> On Thu, Jun 01, 2023 at 10:46:51AM -0400, Barry Leiba wrote:
>> But we *are* finishing work to standardize DMARC:
>> https://datatracker.ietf.org/doc/draft-ietf-dmarc-dmarcbis/
>> ...and there is a huge controversy in the working group about what
>> normative things to say about this, and whether we should say anything
>> normative at all.
>> 
>> But this is something different; gmail appears to be seriously
>> overstepping.  I checked the DMARC record for telekom.de (TXT record
>> in _dmarc.telekom.de), and here it is:
>>   v=DMARC1;p=none;rua=mailto:dmarc@telekom.de;ruf=mailto:dmarc@telekom.de;
>> 
>> They are publishing a "p=none" policy, which should *not* trigger a
>> rejection because of failure to authenticate.  Yet gmail is rejecting
>> it anyway (as if the policy were p=reject).  I will ask my gmail
>> contact about this.
>> 
>> Barry (chair of the DMARC working group)
>> 
>>> On Thu, Jun 1, 2023 at 10:38 AM Jim Fenton <fenton@bluepopcorn.net> wrote:
>>> 
>>>> On 1 Jun 2023, at 7:12, Toerless Eckert wrote:
>>> 
>>>> Please complain with the ART email folks. It is the IETF that standardized all those
>>>> email "security" mechanisms such DMARC that google is now using to effectively make
>>>> email unusable for many people (and this is primarily what i heard from outside the IETF).
>>> 
>>> IETF did not standardize DMARC: RFC 7489 is an informational specification published via the independent submission track.
>>> 
>>> Unfortunately many people and organizations, including some that are mandating the deployment of DMARC and publication of “reject” policies, so not understand the difference between informational and standards-track.
>>> 
>>> -Jim
>>> 
> 
> -- 
> ---
> tte@cs.fau.de
> 
> ___________________________________________________________
> Tools-discuss mailing list - Tools-discuss@ietf.org - https://www.ietf.org/mailman/listinfo/tools-discuss