On Thu, Nov 24, 2022 at 2:22 PM Neil Anuskiewicz <n...@marmot-tech.com> wrote:
> > > On Nov 24, 2022, at 7:10 AM, Dotzero <dotz...@gmail.com> wrote: > > > > > On Tue, Nov 15, 2022 at 12:29 PM Douglas Foster < > dougfoster.emailstanda...@gmail.com> wrote: > >> Your solution is straightforward, but I am not sold. >> >> DMARC PASS means that the message is free of author impersonation. This >> can only be true if all authors are verifiable and verified. >> > > This is absolutely not true. An attacker can use homoglyphs, cousin > domains and other means of impersonating a sender. An attacker can > impersonate a sender within the same domain and DMARC will happily give a > pass because the right hand side of the from address matches. Author != > sending domain. DMARC only addresses direct domain impersonation. > > > Can we assume that in the context of DMARC, passing means passing with > alignment when it stops exact domain impersonation. I think we can assume > that nobody on this list thinks me using my own passing spf and dkim with > sketchythreatactor.com and spoofing your header from isn’t what anyone > means by pass in this context. If the effect can stop impersonation it’s > ipso facto in alignment. > In the context of a standards working group, no, we cannot assume anything. There have been plenty of misstatements and factually incorrect statements in this group. This includes "DMARC PASS means that the message is free of author impersonation". DMARC pass means it passed DMARC validation. If a homoglyph From email address passes DMARC validation, there has indeed been impersonation of the purported From address. And for purposes of DMARC, Author is not necessarily the same as From. We've had that discussion multiple times before. Michael Hammer
_______________________________________________ dmarc mailing list dmarc@ietf.org https://www.ietf.org/mailman/listinfo/dmarc
