Re: [dmarc-ietf] ARC interop and abuse concerns

2023-03-20 Thread Douglas Foster
Let's recap what we know about the ARC experiment: We have two major players who have tried the ARC. For Outlook.com, Microsoft is using ARC to document their role as originator or outbound gateway.ARC does not provide the appropriate authentication mechanisms for this, so Microsoft makes up

Re: [dmarc-ietf] ARC interop and abuse concerns

2023-03-19 Thread Dotzero
Let's not conflate "spaminess" with authentication (specifically DMARC and ARC) and forwarding. DMARC deals with direct domain abuse. ARC is an attempt to show an authenticated chain of handling outside of DMARC when DKIM and/or SPF is broken through forwarding. Consideration of "spaminess" is

Re: [dmarc-ietf] ARC interop and abuse concerns

2023-03-19 Thread Scott Kitterman
On March 19, 2023 7:30:55 AM UTC, Wei Chuang wrote: >On Wed, Mar 15, 2023 at 5:05 AM Scott Kitterman >wrote: > >> >> >> On March 15, 2023 6:55:15 AM UTC, Wei Chuang > 40google@dmarc.ietf.org> wrote: >> >On Tue, Mar 14, 2023 at 9:11 AM Scott Kitterman >> >wrote: >> > >> >> For the replay

Re: [dmarc-ietf] ARC interop and abuse concerns

2023-03-19 Thread Douglas Foster
Let's not gloss over the interaction between spaminess, forwarding, and authentication. A forwarded mail stream will almost always be viewed as spammy, if any spam exists in the source mail stream. This is because: - The downstream evaluator will give the forwarder no credit for spam

Re: [dmarc-ietf] ARC interop and abuse concerns

2023-03-19 Thread Wei Chuang
On Wed, Mar 15, 2023 at 5:05 AM Scott Kitterman wrote: > > > On March 15, 2023 6:55:15 AM UTC, Wei Chuang 40google@dmarc.ietf.org> wrote: > >On Tue, Mar 14, 2023 at 9:11 AM Scott Kitterman > >wrote: > > > >> For the replay resistance part of the question, I think it would make > >> sense

Re: [dmarc-ietf] ARC interop and abuse concerns

2023-03-19 Thread Wei Chuang
On Wed, Mar 15, 2023 at 4:02 AM Alessandro Vesely wrote: > On Wed 15/Mar/2023 07:55:15 +0100 Wei Chuang wrote: > > On Tue, Mar 14, 2023 at 9:11 AM Scott Kitterman > wrote: > > > >> For the replay resistance part of the question, I think it would make > >> sense to wait and see how the DKIM

Re: [dmarc-ietf] ARC interop and abuse concerns

2023-03-19 Thread Wei Chuang
Apologies for repeating myself here and creating noise. I'm just re-walking through the thread, trying to get to Scott's subsequent response, which I wanted to get to. -Wei On Sun, Mar 19, 2023 at 12:19 AM Wei Chuang wrote: > > > On Tue, Mar 14, 2023 at 9:11 AM Scott Kitterman > wrote: > >>

Re: [dmarc-ietf] ARC interop and abuse concerns

2023-03-19 Thread Wei Chuang
On Tue, Mar 14, 2023 at 9:11 AM Scott Kitterman wrote: > For the replay resistance part of the question, I think it would make > sense to wait and see how the DKIM working group addresses the problem for > DKIM generally and then assess how their solution impacts ARC and how it > addresses the

Re: [dmarc-ietf] ARC interop and abuse concerns

2023-03-15 Thread Scott Kitterman
On March 15, 2023 6:55:15 AM UTC, Wei Chuang wrote: >On Tue, Mar 14, 2023 at 9:11 AM Scott Kitterman >wrote: > >> For the replay resistance part of the question, I think it would make >> sense to wait and see how the DKIM working group addresses the problem for >> DKIM generally and then

Re: [dmarc-ietf] ARC interop and abuse concerns

2023-03-15 Thread Alessandro Vesely
On Wed 15/Mar/2023 07:55:15 +0100 Wei Chuang wrote: On Tue, Mar 14, 2023 at 9:11 AM Scott Kitterman wrote: For the replay resistance part of the question, I think it would make sense to wait and see how the DKIM working group addresses the problem for DKIM generally and then assess how their

Re: [dmarc-ietf] ARC interop and abuse concerns

2023-03-15 Thread Wei Chuang
On Tue, Mar 14, 2023 at 9:11 AM Scott Kitterman wrote: > For the replay resistance part of the question, I think it would make > sense to wait and see how the DKIM working group addresses the problem for > DKIM generally and then assess how their solution impacts ARC and how it > addresses the

Re: [dmarc-ietf] ARC interop and abuse concerns

2023-03-14 Thread Scott Kitterman
For the replay resistance part of the question, I think it would make sense to wait and see how the DKIM working group addresses the problem for DKIM generally and then assess how their solution impacts ARC and how it addresses the issue for ARC. I think the question of spamminess is

[dmarc-ietf] ARC interop and abuse concerns

2023-03-14 Thread Wei Chuang
Hi all, We've been making use of ARC to help with forwarded mail. One thing we've noticed is differences for when some forwarders generate the ARC headers. Another concern is that we've seen spammers attempt to manipulate ARC headers. 1) ARC could benefit from more refinement of interop such as