Your comments mply that for non-MLM messages, the only purpose of rfc5322.From is trust. A related action would be attribution: after an attack, whom do I blame? Domain owners do not want to be attributed to someone else's crime.But obviously, there are other purposes, such as searching and sorting. These also depend on accurate values. Consequently, spoofing affects multiple functions which are important to domain owners and message readers. You asserted again that nearly all MUAs hide the From address, then ignored contrary data. Gmail and Outlook have significant user bases. No one has identified the long list of MUAs that hide, or indicated the market share of those MUAs.What has also not been explained is: why it is an uncoscienable burden for MLMs to use rfc5322.From addresses of the form user=domain@MLM? Any such attempt is weakened by your assertions that From matters to no one.Any MLM can create their own rules by operating in a dedicated domain which issues domain accounts to its subscribers. But as long as it chooses to operate in a shared realm, it must accommodate the needs of others within the shared realm.DF<div> </div><div> </div><!-- originalMessage --><div>-------- Original message --------</div><div>From: Dave Crocker <dcroc...@gmail.com> </div><div>Date: 7/18/20 9:32 PM (GMT-05:00) </div><div>To: "Murray S. Kucherawy" <superu...@gmail.com> </div><div>Cc: IETF DMARC WG <dmarc@ietf.org> </div><div>Subject: Re: [dmarc-ietf] Response to a claim in draft-crocker-dmarc-author-00 security considerations </div><div> </div>On 7/18/2020 5:16 PM, Murray S. Kucherawy wrote: > At some point in the past, Gmail decided to show the email address > only unless that address was in the recipient's contact list, or if > the recipient had replied to that address previously, or something > like that. In those cases, the RFC5322.From address was trusted, and > so the display name was shown. Is there logic like that still in place?
If end users do not reliably make trust decisions based on /any/ of the information in the rfc5322.From field, then how is this question important. It seems to be seeking precise data about something that isn't even secondary. The persistence of thinking that end users are influenced by trust indicators is pernicious. d/ -- Dave Crocker Brandenburg InternetWorking bbiw.net _______________________________________________ dmarc mailing list dmarc@ietf.org https://www.ietf.org/mailman/listinfo/dmarc
_______________________________________________ dmarc mailing list dmarc@ietf.org https://www.ietf.org/mailman/listinfo/dmarc
