Re: [dmarc-ietf] Solution for DMARC disruption of normal email use while still offering its normal protection

2014-06-02 Thread Douglas Otis
Dear Brandon; See comments inline: On Jun 2, 2014, at 2:22 PM, Brandon Long wrote: > On Sun, Jun 1, 2014 at 7:56 PM, Douglas Otis wrote: > It seems wrong to describe a mailing-list adding Subject Tags, List Footers, > while retaining the From header field so people have an easer task of knowi

Re: [dmarc-ietf] Solution for DMARC disruption of normal email use while still offering its normal protection

2014-06-01 Thread Douglas Otis
Dear Hector, See comments inline: On May 30, 2014, at 4:44 PM, Hector Santos wrote: > On 5/30/2014 5:49 PM, J. Gomez wrote: > >>> Ah, but "just like" is a complete misstatement of the situation. >>> There's a big difference. Users on a mailing list think of the >>> poster, not the mailing list

Re: [dmarc-ietf] Solution for DMARC disruption of normal email use while still offering its normal protection

2014-05-31 Thread Stephen J. Turnbull
J. Gomez writes: > Users won't care about the politics of the email system, but about > relevant and wanted email landing on their inbox -- hopefully in an > easily readable manner. If you have users like that, configure your lists accordingly. The options are available (in GNU Mailman, at le

Re: [dmarc-ietf] Solution for DMARC disruption of normal email use while still offering its normal protection

2014-05-31 Thread J. Gomez
On Saturday, May 31, 2014 2:18 PM [GMT+1=CET], Stephen J. Turnbull wrote: > J. Gomez writes: > > > Furthermore, what is more important - to deserve or not to deserve > > the prize of being sanctioned as kosher, or keeping a world-wide > > system interoperable? > > In the face of bullying by larg

Re: [dmarc-ietf] Solution for DMARC disruption of normal email use while still offering its normal protection

2014-05-31 Thread Stephen J. Turnbull
J. Gomez writes: > Furthermore, what is more important - to deserve or not to deserve > the prize of being sanctioned as kosher, or keeping a world-wide > system interoperable? In the face of bullying by large operators counting on the fact that ostracizing them would seriously annoy millions

Re: [dmarc-ietf] Solution for DMARC disruption of normal email use while still offering its normal protection

2014-05-31 Thread J. Gomez
On Saturday, May 31, 2014 1:44 AM [GMT+1=CET], Hector Santos wrote: > On 5/30/2014 5:49 PM, J. Gomez wrote: > > > > Ah, but "just like" is a complete misstatement of the situation. > > > There's a big difference. Users on a mailing list think of the > > > poster, not the mailing list, as respons

Re: [dmarc-ietf] Solution for DMARC disruption of normal email use while still offering its normal protection

2014-05-30 Thread Hector Santos
On 5/30/2014 5:49 PM, J. Gomez wrote: Ah, but "just like" is a complete misstatement of the situation. There's a big difference. Users on a mailing list think of the poster, not the mailing list, as responsible for the content. So according to RFC 5322, the poster's mailbox belongs in From:. R

Re: [dmarc-ietf] Solution for DMARC disruption of normal email use while still offering its normal protection

2014-05-30 Thread J. Gomez
On Friday, May 30, 2014 12:09 PM [GMT+1=CET], Stephen J. Turnbull wrote: > J. Gomez writes: > > > Missuse of DMARC's p=reject by Senders is here to stay. It won't go > > away. It will only grow.[*] > > I'm not so sure. Anyway, that doesn't mean we need to sanction it. To maneuver towards being

Re: [dmarc-ietf] Solution for DMARC disruption of normal email use while still offering its normal protection

2014-05-30 Thread Tim Draegen
Stephen! Welcome! No one said making sausage was pretty. :-( On May 29, 2014, at 6:21 AM, Stephen J. Turnbull wrote: > Tim Draegen writes: > >> John, you are very difficult to communicate with, maybe because >> you're easily insulted, even when there is no insult. I too have >> been in corre

Re: [dmarc-ietf] Solution for DMARC disruption of normal email use while still offering its normal protection

2014-05-30 Thread Stephen J. Turnbull
J. Gomez writes: > Missuse of DMARC's p=reject by Senders is here to stay. It won't go > away. It will only grow.[*] I'm not so sure. Anyway, that doesn't mean we need to sanction it. > In my opinion, the least disruptive adaptation which mailing list > software can do is to take ownership

Re: [dmarc-ietf] Solution for DMARC disruption of normal email use while still offering its normal protection

2014-05-30 Thread Stephen J. Turnbull
Kurt Andersen writes: > I have to confess that I have not (yet) waded through the details > of TPA or ASL or ATPS, but from a corporate perspective, it would > be extremely unworkable for any but the smallest company to manage > DNS records to whitelist every list server on the internet that m

Re: [dmarc-ietf] Solution for DMARC disruption of normal email use while still offering its normal protection

2014-05-30 Thread Tim Draegen
On May 28, 2014, at 8:48 PM, Douglas Otis wrote: > Dear Tim, > > All that is needed is a few bandaids? Hi Doug, I don't see the problem space as allowing bandaid approaches. The widespread ability to build controls on top of stable domain level identifiers is relatively new. In my view, peop

Re: [dmarc-ietf] Solution for DMARC disruption of normal email use while still offering its normal protection

2014-05-29 Thread Douglas Otis
On May 29, 2014, at 5:05 PM, Kurt Andersen wrote: > On 2014-05-29, 16:26 , "Hector Santos" wrote: > >> . . .the idea is to lookup a 3rd party domain for >> authorization to sign or resign originating author domain mail. >> >> . . .The problem . . . is that . . . [i]t would not >> scale for th

Re: [dmarc-ietf] Solution for DMARC disruption of normal email use while still offering its normal protection

2014-05-29 Thread Scott Kitterman
On May 29, 2014 3:09:44 AM EDT, "Murray S. Kucherawy" wrote: >On Thu, May 29, 2014 at 12:06 AM, John R Levine >wrote: > >> By the way, to return to the original point, it still seems >vanishingly >> unlikely to me that if we invented per-sender whitelists that the two >mail >> providers would im

Re: [dmarc-ietf] Solution for DMARC disruption of normal email use while still offering its normal protection

2014-05-29 Thread Hector Santos
On 5/29/2014 4:28 PM, J. Gomez wrote: On Wednesday, May 28, 2014 10:13 PM [GMT+1=CET], Tim Draegen wrote: I don't believe TPA-Label hits the mark between "solving a big hurt" and "simple". IOW, it's too complicated for the amount of pain it would resolve. Just my opinion, take care, I'm of

Re: [dmarc-ietf] Solution for DMARC disruption of normal email use while still offering its normal protection

2014-05-29 Thread Dave Crocker
On 5/29/2014 4:19 AM, Stephen J. Turnbull wrote: >Franck Martin writes: >> Time to stop these non-technical threads > > These threads are input to the BCP process, at the very least. +1 d/ -- Dave Crocker Brandenburg InternetWorking bbiw.net ___ d

Re: [dmarc-ietf] Solution for DMARC disruption of normal email use while still offering its normal protection

2014-05-29 Thread J. Gomez
On Thursday, May 29, 2014 1:19 PM [GMT+1=CET], Stephen J. Turnbull wrote: > And we remain unhappy, not least because list operators are unhappy. > The configurations are somewhat tricky and not understood at all by > most list operators -- they follow recipes that are appropriate for > common case

Re: [dmarc-ietf] Solution for DMARC disruption of normal email use while still offering its normal protection

2014-05-29 Thread Popowycz, Alex
To: J. Gomez Cc: dmarc@ietf.org Subject: Re: [dmarc-ietf] Solution for DMARC disruption of normal email use while still offering its normal protection On Thu, May 29, 2014 at 1:28 PM, J. Gomez mailto:jgo...@seryrich.com>> wrote: > I don't believe TPA-Label hits the mark between "

Re: [dmarc-ietf] Solution for DMARC disruption of normal email use while still offering its normal protection

2014-05-29 Thread Murray S. Kucherawy
On Thu, May 29, 2014 at 1:28 PM, J. Gomez wrote: > > I don't believe TPA-Label hits the mark between "solving a big hurt" > > and "simple". IOW, it's too complicated for the amount of pain it > > would resolve. Just my opinion, take care, > > I'm of the same opinion as above. > > In my own word

Re: [dmarc-ietf] Solution for DMARC disruption of normal email use while still offering its normal protection

2014-05-29 Thread J. Gomez
On Wednesday, May 28, 2014 10:13 PM [GMT+1=CET], Tim Draegen wrote: > I don't believe TPA-Label hits the mark between "solving a big hurt" > and "simple". IOW, it's too complicated for the amount of pain it > would resolve. Just my opinion, take care, I'm of the same opinion as above. In my

Re: [dmarc-ietf] Solution for DMARC disruption of normal email use while still offering its normal protection

2014-05-29 Thread Dave Crocker
On 5/29/2014 12:09 AM, Murray S. Kucherawy wrote: > Has anyone tried asking them? I'll suggest that it's premature to do such asking, just as it is premature to say that they are uninterested or would reject the idea. Absent a very concrete proposal -- along the lines of a specification -- the re

Re: [dmarc-ietf] Solution for DMARC disruption of normal email use while still offering its normal protection

2014-05-29 Thread Hector Santos
On 5/29/2014 3:09 AM, Murray S. Kucherawy wrote: On Thu, May 29, 2014 at 12:06 AM, John R Levine mailto:jo...@taugh.com>> wrote: By the way, to return to the original point, it still seems vanishingly unlikely to me that if we invented per-sender whitelists that the two mail provi

Re: [dmarc-ietf] Solution for DMARC disruption of normal email use while still offering its normal protection

2014-05-29 Thread Stephen J. Turnbull
Franck Martin writes: > The changes in mailman to handle DMARC came from people involved > with DMARC.org. Not all of them. The "message-wrapping" suggestion was mine (at least I invented it independently and was an early public proponent), and it was implemented by Mark Sapiro AFAIK. A From-

Re: [dmarc-ietf] Solution for DMARC disruption of normal email use while still offering its normal protection

2014-05-29 Thread Stephen J. Turnbull
Hi, I've been invited by Murray Kucherawy and Franck Martin to participate in these discussions, so let me introduce my affiliation briefly. I've been operating GNU Mailman lists since 1999, an occasional contributor for about 10 years, and a GSoC Mentor for Mailman since 2012. I have somewhat am

Re: [dmarc-ietf] Solution for DMARC disruption of normal email use while still offering its normal protection

2014-05-29 Thread Murray S. Kucherawy
On Thu, May 29, 2014 at 12:06 AM, John R Levine wrote: > By the way, to return to the original point, it still seems vanishingly > unlikely to me that if we invented per-sender whitelists that the two mail > providers would implement them. > Has anyone tried asking them? I'm not sure what value

Re: [dmarc-ietf] Solution for DMARC disruption of normal email use while still offering its normal protection

2014-05-29 Thread John R Levine
By the way, to return to the original point, it still seems vanishingly unlikely to me that if we invented per-sender whitelists that the two mail providers would implement them. Regards, John Levine, jo...@taugh.com, Taughannock Networks, Trumansburg NY Please consider the environment before r

Re: [dmarc-ietf] Solution for DMARC disruption of normal email use while still offering its normal protection

2014-05-28 Thread Douglas Otis
On May 28, 2014, at 1:13 PM, Tim Draegen wrote: > On May 28, 2014, at 12:37 PM, John Levine wrote: >>> Its not clear to me that gmail.com needs to tell another service to trust >>> the OAR from a given third party, the choice to trust that service could >>> easily be up to the receiving service

Re: [dmarc-ietf] Solution for DMARC disruption of normal email use while still offering its normal protection

2014-05-28 Thread Franck Martin
- Original Message - > From: "Dave Crocker" > To: "Franck Martin" > Cc: dmarc@ietf.org > Sent: Wednesday, May 28, 2014 3:48:39 PM > Subject: Re: [dmarc-ietf] Solution for DMARC disruption of normal email use > while still offering its normal

Re: [dmarc-ietf] Solution for DMARC disruption of normal email use while still offering its normal protection

2014-05-28 Thread Dave Crocker
On 5/28/2014 3:45 PM, Franck Martin wrote: > Before one can move to p=reject, it needs to take control of all the email > streams. OK. Thanks for the clarification. The examples you provide are for third parties that have a business relationship with the domain owner. The interesting challeng

Re: [dmarc-ietf] Solution for DMARC disruption of normal email use while still offering its normal protection

2014-05-28 Thread Franck Martin
- Original Message - > From: "Dave Crocker" > To: "Franck Martin" > Cc: dmarc@ietf.org > Sent: Wednesday, May 28, 2014 3:29:30 PM > Subject: Re: [dmarc-ietf] Solution for DMARC disruption of normal email use > while still offering its normal

Re: [dmarc-ietf] Solution for DMARC disruption of normal email use while still offering its normal protection

2014-05-28 Thread Dave Crocker
On 5/28/2014 3:28 PM, Franck Martin wrote: > how you get third parties sending emails on your behalf to become compliant. Please clarify what that means. d/ -- Dave Crocker Brandenburg InternetWorking bbiw.net ___ dmarc mailing list dmarc@ietf.org h

Re: [dmarc-ietf] Solution for DMARC disruption of normal email use while still offering its normal protection

2014-05-28 Thread Franck Martin
- Original Message - > From: "Jim Fenton" > To: dmarc@ietf.org > Sent: Wednesday, May 28, 2014 3:18:04 PM > Subject: Re: [dmarc-ietf] Solution for DMARC disruption of normal email use > while still offering its normal > protection > > On 5/28/14 2:54 P

Re: [dmarc-ietf] Solution for DMARC disruption of normal email use while still offering its normal protection

2014-05-28 Thread Jim Fenton
On 5/28/14 2:54 PM, Dave Crocker wrote: > On 5/28/2014 2:52 PM, Scott Kitterman wrote: >> How do we define the scope of work for this list? > > Merely as an example, one line of effort could be towards methods of > DKIM signature survival through mailing lists. > > It's not a new topic and it's not

Re: [dmarc-ietf] Solution for DMARC disruption of normal email use while still offering its normal protection

2014-05-28 Thread Dave Crocker
On 5/28/2014 2:52 PM, Scott Kitterman wrote: > How do we define the scope of work for this list? Merely as an example, one line of effort could be towards methods of DKIM signature survival through mailing lists. It's not a new topic and it's not an easy one, and it doesn't even have the string

Re: [dmarc-ietf] Solution for DMARC disruption of normal email use while still offering its normal protection

2014-05-28 Thread Scott Kitterman
On Wednesday, May 28, 2014 14:11:36 Dave Crocker wrote: > On 5/28/2014 2:07 PM, Tim Draegen wrote: > >> > I have been in extensive correspondence with the people who develop and > >> > maintain the Mailman discussion list software, and can only find that > >> > suggestion gratuitously insulting.>

Re: [dmarc-ietf] Solution for DMARC disruption of normal email use while still offering its normal protection

2014-05-28 Thread Dave Crocker
On 5/28/2014 2:07 PM, Tim Draegen wrote: >> > I have been in extensive correspondence with the people who develop and >> > maintain the Mailman discussion list software, and can only find that >> > suggestion gratuitously insulting. > John, you are very difficult to communicate with, maybe becaus

Re: [dmarc-ietf] Solution for DMARC disruption of normal email use while still offering its normal protection

2014-05-28 Thread Tim Draegen
On May 28, 2014, at 12:37 PM, John Levine wrote: >> Its not clear to me that gmail.com needs to tell another service to trust >> the OAR from a given third party, the choice to trust that service could >> easily be up to the receiving service. > > Good point. That's why I keep saying that one or

Re: [dmarc-ietf] Solution for DMARC disruption of normal email use while still offering its normal protection

2014-05-28 Thread Douglas Otis
On May 28, 2014, at 12:07 AM, Brandon Long wrote: > So... > > I think this buries the lede a bit more than the OAR suggestion does. I > could imagine something like this for broadcasting who a service trusts the > OAR header from. > > This basically would require someone like Yahoo/Gmail t

Re: [dmarc-ietf] Solution for DMARC disruption of normal email use while still offering its normal protection

2014-05-28 Thread John Levine
>For a service at this scale, you'd need to only do this for places where >you "trust" their Authentication-Results header. There is a potential >issue of conflicting AR headers, which is one benefit of the OAR. > >Its not clear to me that gmail.com needs to tell another service to trust >the OAR

[dmarc-ietf] Solution for DMARC disruption of normal email use while still offering its normal protection

2014-05-27 Thread Douglas Otis
Dear DMARC WG, A draft has been submitted for review. It covers past failures while also providing a path forward. I have experience with similar systems operating at much higher scale without difficulty or using much in the way of resources. Serving several very large ISPs worth of users ma