Re: DMARC

On Tue 19/Mar/2013 19:20:46 +0100 Dotzero wrote:
> On Tue, Mar 19, 2013 at 1:30 PM, Alessandro Vesely <[email protected]> wrote:
>> On Tue 19/Mar/2013 01:24:44 +0100 Dotzero wrote:
>>> 2) DMARC provides a domain owner or agent the opportunity to express
>>> (negative) policy regarding mail that fails to validate for either
>>> aligned SPF or DKIM. This ability to express policy indicating a
>>> receiver should either quarantine or reject (depending on the policy
>>> published) provides protection against direct domain abuse.
>>
>> That's a confusing repetition of already available policies, dkim=all
>> and -all.  Rejecting is never mandatory, thus the ability to whitelist
>> failed authentications with one another has always been granted.  For
>> a simpler-is-better approach, message disposition specifications could
>> have limited to bolstering and clarifying existing policies.
> 
> It is not simply a confusing repetition of available policies
> Alessandro. There are several key differences. that are important. 1)
> DMARC introduces the concept of alignment for SPF and DKIM 2) DMARC
> policy only comes into effect when a message fails both (aligned) SPF
> and DKIM. This provides additional robustness that is not available
> when looking at ONLY SPF or DKIM.

It seemed to me that the alignment concept could go in the category of
bolstering and clarifying (otherwise it would be insane to whitelist
an spf=pass smtp.mailfrom=phisher.example; dkim-adsp=discard
header.from=bank.example).  The confusing part comes when the extra
policy is not consistent, for example:

  spf=softfail smtp.mailfrom=user.example;
  dkim-adsp=unknown header.from=user.example

but the DMARC policy is reject  --or the other way around, fail,
discard, and none, respectively.  Mandate consistency and redundancy
becomes explicit.