Re: DMARC

On Tue, Mar 19, 2013 at 1:30 PM, Alessandro Vesely <[email protected]> wrote:
> On Tue 19/Mar/2013 01:24:44 +0100 Dotzero wrote:
>> On Mon, Mar 18, 2013 at 6:53 PM, Neil Schwartzman <[email protected]> wrote:
>>> Some people think DMARC will save email (from what?) others think
>>> it breaks email because of mailing lists such as this one (which
>>> are a rare anachronism say some).
>>>
>>> Discuss.
>>>
>>> {waves at new sub Murray}
>>
>> DMARC is a tool that allows domain owners or agents to do a couple of
>> things - if you want saving, seek religious counsel.
>>
>> 1) DMARC enables authentication failure reporting from mailbox
>> providers that choose to participate. This provides insight into mail
>> claiming to be from them for senders that never had this sort of
>> visibility before.
>
> That is its astounding, revolutionary feature, IMHO.  With that
> feedback, even faint hearts can specify strong policies.
>
>> 2) DMARC provides a domain owner or agent the opportunity to express
>> (negative) policy regarding mail that fails to validate for either
>> aligned SPF or DKIM. This ability to express policy indicating a
>> receiver should either quarantine or reject (depending on the policy
>> published) provides protection against direct domain abuse.
>
> That's a confusing repetition of already available policies, dkim=all
> and -all.  Rejecting is never mandatory, thus the ability to whitelist
> failed authentications with one another has always been granted.  For
> a simpler-is-better approach, message disposition specifications could
> have limited to bolstering and clarifying existing policies.

It is not simply a confusing repitition of available policies
Alessandro. There are several key differences. that are important. 1)
DMARC introduces the concept of alignment for SPF and DKIM 2) DMARC
policy only comes into effect when a message fails both (aligned) SPF
and DKIM. This provides additional robustness that is not available
when looking at ONLY SPF or DKIM.