On Sat, Nov 7, 2026 at 8:25 PM Tero Kivinen <[email protected]> wrote:
> It is no longer unauthenticated, but it still might be unauthorized, i.e., > someone might maliciously forward his iki.fi emails to some other user, > and then email would be authenticated by iki.fi ARC, but it would still > be unauthorized by the final recipient. > > Not really going to happen in iki.fi, as we are non-profit > organization, so we do have requirement to know real names of our members, > so if someone would do that, it would be really easy to catch that person. > 100%! In the zero-trust model ARC tells you authentication but still not authorization. That is why I have always been hugely in favor of allowing a user-visible setting which ARC signers you want to authorize. That could then be used to adjust DMARC handling as well. Alas as you noted above I never won that prioritization battle :) I think the similar concept will be needed in the DKIM2 world to indicate which intermediaries are authorized to make changes / null recipes. > > Ah, so that ARC header only affected whether you allowed mail to come > in, but it did not affect the DMARC authentication at all. Exactly. It prevented spurious no-auth-no-entry rejections. It did not affect DMARC handling logic. Best, Emanuel
_______________________________________________ Ietf-dkim mailing list -- [email protected] To unsubscribe send an email to [email protected]
