Re: [dmarc-ietf] Gaining Legitimacy

2023-05-01 Thread Murray S. Kucherawy
Replying to something almost two weeks old, apologies: On Tue, Apr 18, 2023 at 7:10 PM Douglas Foster < dougfoster.emailstanda...@gmail.com> wrote: > When John says that list members plead their case, but their pleas are > dismissed unsympathetically, it is evidence that mailing lists have a >

[dmarc-ietf] Third party signatures

2023-05-01 Thread Murray S. Kucherawy
Some thoughts about the third party signature discussion that happened over the last couple of weeks while I was away: I wrote ATPS as an experiment in 2012. At the time we were still finishing DKIM (RFC 6376 was only five months earlier), and still talking about whether a third party signing

Re: [dmarc-ietf] Add MLS/MLM subscription/submissions controls to DMARCbis

2023-05-01 Thread Hector Santos
Alex, I agree with a suggestion to have a separate document, a great starting point is to update the ATPS RFC document. However, DMARCbis MUST open up the door for it and address the potential new security issues with From Rewrite. 1) Address the MUST NOT p=reject with a new small section,

Re: [dmarc-ietf] Add MLS/MLM subscription/submissions controls to DMARCbis

2023-05-01 Thread Brotman, Alex
This sounds like a separate document to me. (yes, I see Ale's draft below) And IMO, I don't think we should hold up DMARCbis for that work. -- Alex Brotman Sr. Engineer, Anti-Abuse & Messaging Policy Comcast > -Original Message- > From: dmarc On Behalf Of Hector Santos > Sent: Monday,

Re: [dmarc-ietf] Add MLS/MLM subscription/submissions controls to DMARCbis

2023-05-01 Thread Hector Santos
On 5/1/2023 6:51 AM, Alessandro Vesely wrote: Been there, done that. For the message I'm replying to, I have: Authentication-Results: wmail.tana.it; spf=pass smtp.mailfrom=ietf.org; dkim=pass reason="Original-From: transformed" header.d=google.com; dkim=pass (whitelisted)

Re: [dmarc-ietf] Add MLS/MLM subscription/submissions controls to DMARCbis

2023-05-01 Thread Douglas Foster
Perhaps it should be the other way around. Addressing the mailing list problem was part of the prior milestone, which indicates its relative importance. ARC got us past the milestone but does not provide certainty for the list.operator. Your concept provides a reliable solution starting from

Re: [dmarc-ietf] Add MLS/MLM subscription/submissions controls to DMARCbis

2023-05-01 Thread Alessandro Vesely
On Mon 01/May/2023 04:25:17 +0200 Emanuel Schorsch wrote: I want to ask about the "hollow victory" aspect and what would turn it into a more meaningful victory. If fromHeader rewriting is the damage we want to avoid it seems there's two options: 1) Have the mailingList make a decision based on

Re: [dmarc-ietf] Add MLS/MLM subscription/submissions controls to DMARCbis

2023-05-01 Thread Douglas Foster
Yes, I think there is value in recommending a specific rewrite format, and recommending that the unmodified From be stored in an ORIGINAL-FROM: header. This solves the user problem, but does not provide feedback to the list. About feedback options: A feedback mechanism could be public or