Re: DMARC?

On Tue, 7 Aug 2012, Don Lee wrote:
> Anyone know about this:
> 
> http://www.dmarc.org/

I recently perused it.  I'd have to do a more careful read of the draft
before I do anything to my DNS in response, but from what I can tell there
seems no point.  DMARC moves in precisely the wrong direction.

SPF's problem is that it false positives on all traditionally forwarded
mails.  Hence SPF can only actually halt the delivery of forgeries when
both the recipient and the putative sender are unafraid of blocked
forwards.

DKIM/ADSP's problem is that it false positives on all mailing list
traffic.  Thus it becomes crazy to publish anything other than
"dkim=unknown" when you post to mailing lists, but that means no actual
forgeries will be blocked either.

A protocol that avoids either problems could easily be developed -- it
would just have to use DKIM signatures like ADSP, but bind those
signatures to the MAIL FROM: (not header From:) like SPF.

DMARC does the opposite.  Its "SPF alignment" feature demands that MAIL
FROM: be more similar to the Header From: than a mailing list can manage.
It's the drawback of SPF and the drawback of ADSP in one package.

It would appear that since I do post to mailing lists, there is no point
in publishing DMARC (or ADSP), even though I already publish SPF and
DKIM-sign outgoing mail.

I can see the rationale for ADSP and DMARC's insanity though.  Under both
vanilla SPF and my hypothetical fused system, a phisher can freely lie in
*the address shown to an unsuspicious end user* so long as he doesn't lie
in his bounce address.  But preventing that without breaking mailing lists
is really hard; it would require either that the recipient maintain a
whitelist of mailing lists he subscribes to, or that the putative-sender
publishes a whitelist of mailing lists he posts to.

In the meantime, just stopping forgery of the bounce address is still a
great improvement.  Naive end users may never see it, but if bad mail
arrives SPF-pass, you at least have a solid identity you can punish for
it.

---- Michael Deutschmann <[email protected]>