Re: [dmarc-ietf] draft-kucherawy-dmarc-base feedback

2014-11-07 Thread Murray S. Kucherawy
On Fri, Nov 7, 2014 at 8:57 PM, wrote: > Trent Adams writes: > > > - > > It is important to note that identifier alignment cannot occur, and > > DMARC determination applied, with a message that is not valid per RFC > > 5322 [MAIL]. This is particularly true when a message has a malformed > >

Re: [dmarc-ietf] draft-kucherawy-dmarc-base feedback

2014-11-07 Thread turnbull
Trent Adams writes: > - > It is important to note that identifier alignment cannot occur, and > DMARC determination applied, with a message that is not valid per RFC > 5322 [MAIL]. This is particularly true when a message has a malformed > or absent RFC5322.From field. > - I occasionally

Re: [dmarc-ietf] draft-kucherawy-dmarc-base feedback

2014-11-07 Thread J. Trent Adams
On 11/6/14 12:06 PM, ned+dm...@mrochek.com wrote: > > > I have a few comments on the base specification. > > In section 3.1.4, the paragraph > >It is important to note that identifier alignment cannot occur with a >message that is not valid per [MAIL], particularly one with a >malf

Re: [dmarc-ietf] draft-kucherawy-dmarc-base feedback

2014-11-07 Thread John R Levine
That's fine if any of the domains have an associated DMARC record - of any sort. My concern is the case where none of them do, or when there are no domains present. In that case I agree with you, it's none of DMARC's business what happens. For From: headers with address-free groups, recall tha

Re: [dmarc-ietf] draft-kucherawy-dmarc-base feedback

2014-11-07 Thread Douglas Otis
On Nov 7, 2014, at 10:32 AM, Murray S. Kucherawy wrote: > On Fri, Nov 7, 2014 at 10:06 AM, John Levine wrote: > >1) Evaluate all the domains you find, and if any of them have published > >DMARC policies, apply the strictest one ... > > Given the anti-phishing goals of DMARC, I don't see how an

Re: [dmarc-ietf] draft-kucherawy-dmarc-base feedback

2014-11-07 Thread Murray S. Kucherawy
On Fri, Nov 7, 2014 at 10:06 AM, John Levine wrote: > >1) Evaluate all the domains you find, and if any of them have published > >DMARC policies, apply the strictest one ... > > Given the anti-phishing goals of DMARC, I don't see how anything else > makes any sense. Or you could skip a step, say

Re: [dmarc-ietf] draft-kucherawy-dmarc-base feedback

2014-11-07 Thread John Levine
>What sort of remedy would you suggest here? Off the top of my head, here >are some suggestions: > >1) Evaluate all the domains you find, and if any of them have published >DMARC policies, apply the strictest one ... Given the anti-phishing goals of DMARC, I don't see how anything else makes any