From nobody Thu Mar 7 17:27:05 2019 Return-Path: X-Original-To: dmarc@ietf.org Delivered-To: dmarc@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 2AAF31310FD; Thu, 7 Mar 2019 17:26:57 -0800 (PST) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: internet-drafts@ietf.org To: Cc: dmarc@ietf.org X-Test-IDTracker: no X-IETF-IDTracker: 6.93.0 Auto-Submitted: auto-generated Precedence: bulk Reply-To: dmarc@ietf.org Message-ID: <155200841713.5502.15213455580946719456@ietfa.amsl.com> Date: Thu, 07 Mar 2019 17:26:57 -0800 Archived-At: Subject: [dmarc-ietf] I-D Action: draft-ietf-dmarc-arc-multi-03.txt X-BeenThere: dmarc@ietf.org X-Mailman-Version: 2.1.29 List-Id: "Domain-based Message Authentication, Reporting, and Compliance \(DMARC\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 08 Mar 2019 01:26:57 -0000 A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the Domain-based Message Authentication, Reporting & Conformance WG of the IETF. Title : Using Multiple Signing Algorithms with the ARC (Authenticated Received Chain) Protocol Authors : Kurt Andersen Seth Blank John Levine Filename : draft-ietf-dmarc-arc-multi-03.txt Pages : 6 Date : 2019-03-07 Abstract: The Authenticated Received Chain (ARC) protocol creates a mechanism whereby a series of handlers of an email message can conduct authentication of the email message as it passes among them on the way to its destination. Initial development of ARC has been done with a single allowed signing algorithm, but parallel work in the DCRUP working group (https://datatracker.ietf.org/wg/dcrup/about/) is expanding the supported algorithms. This specification defines how to extend ARC for multiple signing algorithms. The IETF datatracker status page for this draft is: https://datatracker.ietf.org/doc/draft-ietf-dmarc-arc-multi/ There are also htmlized versions available at: https://tools.ietf.org/html/draft-ietf-dmarc-arc-multi-03 https://datatracker.ietf.org/doc/html/draft-ietf-dmarc-arc-multi-03 A diff from the previous version is available at: https://www.ietf.org/rfcdiff?url2=draft-ietf-dmarc-arc-multi-03 Please note that it may take a couple of minutes from the time of submission until the htmlized version and diff are available at tools.ietf.org. Internet-Drafts are also available by anonymous FTP at: ftp://ftp.ietf.org/internet-drafts/ From nobody Thu Mar 7 17:35:36 2019 Return-Path: X-Original-To: dmarc@ietfa.amsl.com Delivered-To: dmarc@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6A05C13113E for ; Thu, 7 Mar 2019 17:35:34 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2 X-Spam-Level: X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=drkurt.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 3uXblM8CUzab for ; Thu, 7 Mar 2019 17:35:32 -0800 (PST) Received: from mail-io1-xd2f.google.com (mail-io1-xd2f.google.com [IPv6:2607:f8b0:4864:20::d2f]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id AFBE713110A for ; Thu, 7 Mar 2019 17:35:32 -0800 (PST) Received: by mail-io1-xd2f.google.com with SMTP id p196so15403530iod.9 for ; Thu, 07 Mar 2019 17:35:32 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=drkurt.com; s=20130612; h=mime-version:from:date:message-id:subject:to; bh=/DW4se6hUk7lv28r37UuEA9E4HB+Lf0FfKOP1OubACg=; b=dNq8c6DpRE9y4hyD8r0CQOJaWJHxruPc1Ve3y98desJL9Vi93Bsoa4CBgA/gXoa0u7 p5FvDC9BfDkAYLoagkFsfvrahxWjgwnvNnYbOEN8nPoCD4u5A+qbZg1Avbjow4tSLl02 YoQLk1DhXfLSO1KVw2blLtQJUZ+ED4rQ2BB5U= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:from:date:message-id:subject:to; bh=/DW4se6hUk7lv28r37UuEA9E4HB+Lf0FfKOP1OubACg=; b=dMcMP6reuKkS1PYlvAQ0ycnjTZZNs5VZZDUO/odiyo/ij7EypVAq0mqGqRDmw6mPod FeJy4FN7wRWu+CaP4ER9yGofUnvmSONvuETPblE8jCNdMSVXlNXHElH4uEdkd6r1ldsn LiV1+Q/WIgjyNJhfKytGKSDE0sRLBwEmHfiGoDOaklWhhpiRKcq4gdIU/W1q2a8RPL9A zAEu+fq3Rr54EP5cQiBJ1BC4kGY7SSUQCCsw+6rApxE2EaaeWrwUdTO5F3Arr40IwNu2 lC+divojZ+CLS7PygPMEGxqr7TsEMAJ52zp1Z+uFgPZYHbggEVAFxcxSaP8AzBCLDLBq 2LXw== X-Gm-Message-State: APjAAAV9vPbpSdyeqz49lkhl3cMXbiJ18pu7ruNMpQ2tWCzhnqW/2nH2 59Hwn1r7VrlAmbSG1tz5BiyjtshCPakDlNKEr9eH3oSe X-Google-Smtp-Source: APXvYqzjKg8+T2T/M7gtqCtHzCQgz2xR2wI1vHeVLztlEIs48xA4Sn38+nXjhMsBvjcPaw5q/ZHbk4gdlvVSHyRkP4A= X-Received: by 2002:a5d:8190:: with SMTP id u16mr8825789ion.238.1552008931457; Thu, 07 Mar 2019 17:35:31 -0800 (PST) MIME-Version: 1.0 From: "Kurt Andersen (b)" Date: Thu, 7 Mar 2019 17:34:59 -0800 Message-ID: To: "dmarc@ietf.org" Content-Type: multipart/alternative; boundary="0000000000000c641605838b3d2a" Archived-At: Subject: [dmarc-ietf] Refresh of ARC-Multi spec X-BeenThere: dmarc@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Domain-based Message Authentication, Reporting, and Compliance \(DMARC\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 08 Mar 2019 01:35:34 -0000 --0000000000000c641605838b3d2a Content-Type: text/plain; charset="UTF-8" You can ignore the refresh of the "multi" spec - I just updated the referenced version of the ARC spec in order to extend the life of the I-D. No substantive changes. --Kurt --0000000000000c641605838b3d2a Content-Type: text/html; charset="UTF-8"
You can ignore the refresh of the "multi" spec - I just updated the referenced version of the ARC spec in order to extend the life of the I-D. No substantive changes.

--Kurt
--0000000000000c641605838b3d2a-- From nobody Fri Mar 8 16:37:14 2019 Return-Path: X-Original-To: dmarc@ietfa.amsl.com Delivered-To: dmarc@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 515AF128CE4 for ; Fri, 8 Mar 2019 16:37:08 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -17.5 X-Spam-Level: X-Spam-Status: No, score=-17.5 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_MED=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, ENV_AND_HDR_SPF_MATCH=-0.5, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001, USER_IN_DEF_DKIM_WL=-7.5, USER_IN_DEF_SPF_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=google.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Cz9N6qx4cUtU for ; Fri, 8 Mar 2019 16:37:04 -0800 (PST) Received: from mail-vk1-xa35.google.com (mail-vk1-xa35.google.com [IPv6:2607:f8b0:4864:20::a35]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 73B4412867B for ; Fri, 8 Mar 2019 16:37:04 -0800 (PST) Received: by mail-vk1-xa35.google.com with SMTP id i68so5002159vke.6 for ; Fri, 08 Mar 2019 16:37:04 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=gDBZUQsGuLcXRlFManK0ZV4FBVuB2uLbr8vY75gahYI=; b=h2Z+XEAQ4QcsL+1wyTN4aX2818VY6yysYZ0cavLIoGoz53HKJDjxhzCfsvXULXSHi9 VJNDNqwDGsWvcfyfGuPS2454VaIkHjA5lpX5PviDY1f1bppi0xfBii9BSPEVJ7Zcz60f gCGChZvyWGGpqxE/1mpApFmW9NsgtxR79NN205huRLIYZiXYFurYI03qqNBfbJeaxud1 OGx3ArDriGSxY7A5bYhBFZxjg7plufn5Ny+Ti4EGzfSLmKbXCyU1PpHS87Sp1w//hs2A OPI/BDxWDJiy2Mq98uI00XSfNeFRvoSVCm7K7kca47inaZoDwjDbElKKWoCbY6z0+h75 39cg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=gDBZUQsGuLcXRlFManK0ZV4FBVuB2uLbr8vY75gahYI=; b=bUg4C8aeHio/2Ti5ThT99s/CXA0HMR/OdPhTWNDa7eMUfhPnn10ZHneZ9RJwMcyYm/ HMnzmi4QbZqSEnO1Q67Qhj0J1eElR+jHnqGa7HJetJtAG504EAV+tLomYOjcoXMZtFiZ gc5eiav+SkgTf3K6UH1gKWsBR9gBXEpswclwJzij3oqAwwUcGq0NFaPxIioKtxlvFxIP 0x6Tfsmo3S73EkhJY66w9ZlKlRLLXE1WmdgnjiH7PZU9qZMDDF+LD5wIOtLLG+uY3gnC 0BHay8Id45pB2xgaA8BPmj83m6iyRPqoeL9r1XyPnhqVvjHkDXEbMy8W7tFHZgtq94Cg K2Qw== X-Gm-Message-State: APjAAAUuKGhjE2CruDtc9rliFei7w4cI9FHJ1hVlKSNkQMfqDXjg32NG PXu35g/1qopm6F/QZbP8jysqC8CwY7Y0KGCDMH9j X-Google-Smtp-Source: APXvYqwqLoh04D9YJ/LcYbzAx9KZe3Vd/rFH0b11m5iNAGawFUGTe2qc8xU5IVvHPuqyNckYjMYPp7YNlQgAk9LJB78= X-Received: by 2002:a1f:b754:: with SMTP id h81mr10716866vkf.64.1552091822917; Fri, 08 Mar 2019 16:37:02 -0800 (PST) MIME-Version: 1.0 References: In-Reply-To: From: Brandon Long Date: Fri, 8 Mar 2019 16:36:49 -0800 Message-ID: To: Vladimir Dubrovin Cc: "Kurt Andersen (b)" , "dmarc@ietf.org" , spfbis@ietf.org Content-Type: multipart/alternative; boundary="000000000000c3f6df05839e89ae" Archived-At: Subject: Re: [dmarc-ietf] [spfbis] Should we encourage the use of SPF "soft include" for common platforms? X-BeenThere: dmarc@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Domain-based Message Authentication, Reporting, and Compliance \(DMARC\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 09 Mar 2019 00:37:12 -0000 --000000000000c3f6df05839e89ae Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable On Sat, Feb 23, 2019 at 11:35 AM Vladimir Dubrovin wrote: > > It's bad idea, because "?" does not grant SPF authentication. SPF is > important even if message is DKIM signed and regardless of DMARC, because > it authenticates envelope address. As an example, NDR/MDN may not be > generated to envelope address which is not SPF authenticated, we actually > use this rule in practice to eliminate secondary spam. > > GSuite, O365 and large ESPs should not allow to use unvalidated/spoofed > e-mail address. If somebody allows to spoof sender, there is also a good > chance it DKIM signs spoofed message, because DKIM signature is applied b= y > the same party. > Although we go through great pains not to allow you to generate new messages with spoofed addresses, and we also are very particular about what we will DKIM sign... we haven't been as particular with SPF. I kept meaning to create a new smtp-out IP pool that wasn't in our SPF record, but given our SPF record was "all our IPs", that was never an easy task. We then could have used that pool for any message where we don't want to potentially validate with SPF. As to why we have any messages like that, its because of forwarding and relaying. And the cases where you should use your non-SPF IPs include "same domain", ie if you get a spoofed message to a mailing list on the domain, it shouldn't acquire SPF auth by virtue of going through the list. The solution we've used for that now is ARC, we'll "remove" the spf auth of a message if it has an spf=3Dfail for the same domain in the ARC chain. Brandon > > 23.02.2019 21:07, Kurt Andersen (b) =D0=BF=D0=B8=D1=88=D0=B5=D1=82: > > With the growth of huge platforms that emit mail from the same common set > of IPs (such as GSuite, O365, or large ESPs), regular SPF "include" ends = up > granting a DMARC pass to a lot more potential authors than most > organizations would necessarily choose to grant. > > Instead of using the standard "(+)include:" approach, if domain owners > used "?include:" as their mechanism, then that would prevent the SPF resu= lt > from granting a DMARC PASS result when traffic is coming from one of thes= e > massively included platforms. It would essentially force the DMARC result > to be driven only by the DKIM evaluation. > > Thoughts? > > --Kurt Andersen > > (I'm copying the spfbis list too because there may be folks lurking there > who are not on the DMARC list) > > _______________________________________________ > dmarc mailing listdmarc@ietf.orghttps://www.ietf.org/mailman/listinfo/dma= rc > > > -- > Vladimir Dubrovin > @Mail.Ru > > _______________________________________________ > spfbis mailing list > spfbis@ietf.org > https://www.ietf.org/mailman/listinfo/spfbis > --000000000000c3f6df05839e89ae Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


=
On Sat, Feb 23, 2019 at 11:35 AM Vlad= imir Dubrovin <dubrovin=3D40corp.mail.ru@dmarc.ietf.org> wrote:
=20 =20 =20

It's b= ad idea, because "?" does not grant SPF authentication. SPF is important even if message is DKIM signed and regardless of DMARC, because it authenticates envelope address. As an example, NDR/MDN=C2=A0 may not be generated to envelope address which is not SPF authenticated, we actually use this rule in practice to eliminate secondary spam.

GSuite, O3= 65 and large ESPs should not allow to use unvalidated/spoofed e-mail address. If somebody allows to spoof sender, there is also a good chance it DKIM signs spoofed message, because DKIM signature is applied by the same party.

A= lthough we go through great pains not to allow you to generate new messages= with spoofed addresses, and we also are very particular about what we will= DKIM sign... we haven't been as particular with SPF.=C2=A0 I kept mean= ing to create a new smtp-out IP pool that wasn't in our SPF record, but= given our SPF record was "all our IPs", that was never an easy t= ask.=C2=A0 We then could have used that pool for any message where we don&#= 39;t want to potentially validate with SPF.

As to = why we have any messages like that, its because of forwarding and relaying.= =C2=A0 And the cases where you should use your non-SPF IPs include "sa= me domain", ie if you get a spoofed message to a mailing list on the d= omain, it shouldn't acquire SPF auth by virtue of going through the lis= t.

The solution we've used for that now is ARC, we'll "= remove" the spf auth of a message if it has an spf=3Dfail for the same= domain in the ARC chain.

Brandon
=C2=A0=

23.02.2019 2= 1:07, Kurt Andersen (b) =D0=BF=D0=B8=D1=88=D0=B5=D1=82:
=20
With the growth of huge platforms that emit mail from the same common set of IPs (such as GSuite, O365, or large ESPs), regular SPF "include" ends up granting a DMARC pas= s to a lot more potential authors than most organizations would necessarily choose to grant.=C2=A0

Instead of using the standard "(+)include:" approach= , if domain owners used "?include:" as their mechanism, then= that would prevent the SPF result from granting a DMARC PASS result when traffic is coming from one of these massively included platforms. It would essentially force the DMARC result to be driven only by the DKIM evaluation.

Thoughts?

--Kurt Andersen

(I'm copying the spfbis list too because there may be folk= s lurking there who are not on the DMARC list)

= 
____________=
___________________________________
dmarc mailing list
dmarc@ietf.org
https://www.ietf=
.org/mailman/listinfo/dmarc



--=
=20
Vladimir Dubrovin
@Mail.Ru
_______________________________________________
spfbis mailing list
spfbis@ietf.org https://www.ietf.org/mailman/listinfo/spfbis
--000000000000c3f6df05839e89ae-- From nobody Mon Mar 11 15:54:58 2019 Return-Path: X-Original-To: dmarc@ietf.org Delivered-To: dmarc@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 037491311D6; Mon, 11 Mar 2019 15:54:40 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: Tim Evens via Datatracker To: Cc: dmarc@ietf.org, draft-ietf-dmarc-eaiauth.all@ietf.org, ietf@ietf.org X-Test-IDTracker: no X-IETF-IDTracker: 6.93.0 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <155234487991.23094.14124317288389045798@ietfa.amsl.com> Date: Mon, 11 Mar 2019 15:54:40 -0700 Archived-At: Subject: [dmarc-ietf] Genart last call review of draft-ietf-dmarc-eaiauth-03 X-BeenThere: dmarc@ietf.org X-Mailman-Version: 2.1.29 List-Id: "Domain-based Message Authentication, Reporting, and Compliance \(DMARC\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 11 Mar 2019 22:54:44 -0000 Reviewer: Tim Evens Review result: Ready with Nits I am the assigned Gen-ART reviewer for this draft. The General Area Review Team (Gen-ART) reviews all IETF documents being processed by the IESG for the IETF Chair. Please treat these comments just like any other last call comments. For more information, please see the FAQ at . Document: draft-ietf-dmarc-eaiauth-?? Reviewer: Tim Evens Review Date: 2019-03-11 IETF LC End Date: 2019-03-14 IESG Telechat date: Not scheduled for a telechat Summary: Ready with nits. Major issues: None Minor issues: None Nits/editorial comments: Throughout the draft, section references (html rendering) does not correctly HREF the RFC and section. For example, page-5 Section 6 has a reference to section 6.6.1 of RFC7489, but the HTML rendering HREF links to this draft instead of correctly linking to RFC7489 Section 6.6.1. Ideally the references should link correctly, for example on page-3 Section 4 with "Section 3 of [RFC7208]." From nobody Mon Mar 11 16:02:04 2019 Return-Path: X-Original-To: dmarc@ietfa.amsl.com Delivered-To: dmarc@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 19648127964; Mon, 11 Mar 2019 16:02:03 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.648 X-Spam-Level: X-Spam-Status: No, score=-1.648 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, FREEMAIL_FORGED_FROMDOMAIN=0.249, FREEMAIL_FROM=0.001, HEADER_FROM_DIFFERENT_DOMAINS=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=no autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id oULKmSLr6UfE; Mon, 11 Mar 2019 16:02:01 -0700 (PDT) Received: from mail-it1-f182.google.com (mail-it1-f182.google.com [209.85.166.182]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 5AE31131234; Mon, 11 Mar 2019 16:01:30 -0700 (PDT) Received: by mail-it1-f182.google.com with SMTP id z131so1355719itf.5; Mon, 11 Mar 2019 16:01:30 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=bzBd4Y9kHXORdQfP7UETCLcDaeMnsczQHiJ2P3gLbBY=; b=fqVQW5mN0oqw4wODFWyTjGPFXRjF7J+C78OG0xYfttE0FDUceKFZYti2R7q6NomiIP 7yxRfuVsxt5vWOjXcsKGMKUM86Lfcfo7FhgSCAJ82O1z3cG1COdraTMX35mJLpKRaqPO UpzI9dC7co28Tf5V1sFYJ/PqScmFLWEKecdnSvmoWjmiZ5X5KngEz+EF5nxUxTh9g2RT /vjANAAOjiSUbN6E23ruINUrzhD0aXBZkAkZ8gkWmSRFZ/Tod1Fj8B+sOU4Lz3b4g0xO Jwhnr8m89wjOJRNB2gPYm6pGOrLDX9+EhSSkCIcENSP6GhIqU/R8vmmA06hBkTntCnYF qOxA== X-Gm-Message-State: APjAAAWCL0u04B7Oa9PSIR3GDcEi/TBRzxj4FJMkehMgfayqiDztaG8F xXxZl+8jSR8LPSrBl1PpQDZO1MlIzgszS/pMbb9Uk8p2 X-Google-Smtp-Source: APXvYqz3ZllBIshuSuOdyrAMxPH1C94h3a6wPFRFlN1B/TKSXv84T9TUm6V++EKLyfxQbJXEiMLPsl4guJEykZHXXkg= X-Received: by 2002:a24:c6:: with SMTP id 189mr398483ita.84.1552345289284; Mon, 11 Mar 2019 16:01:29 -0700 (PDT) MIME-Version: 1.0 References: <155234487991.23094.14124317288389045798@ietfa.amsl.com> In-Reply-To: <155234487991.23094.14124317288389045798@ietfa.amsl.com> From: Barry Leiba Date: Tue, 12 Mar 2019 08:01:17 +0900 Message-ID: To: Tim Evens via Datatracker Cc: dmarc@ietf.org, draft-ietf-dmarc-eaiauth.all@ietf.org, gen-art@ietf.org, ietf@ietf.org Content-Type: multipart/alternative; boundary="0000000000008962a30583d98d3b" Archived-At: Subject: Re: [dmarc-ietf] Genart last call review of draft-ietf-dmarc-eaiauth-03 X-BeenThere: dmarc@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Domain-based Message Authentication, Reporting, and Compliance \(DMARC\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 11 Mar 2019 23:02:03 -0000 --0000000000008962a30583d98d3b Content-Type: text/plain; charset="UTF-8" Thanks for the review, Tim. The html rendering issues are for the RFC editor to deal with, and not in the scope of the draft editors. Barry On Tue, Mar 12, 2019 at 7:54 AM Tim Evens via Datatracker wrote: > Reviewer: Tim Evens > Review result: Ready with Nits > > I am the assigned Gen-ART reviewer for this draft. The General Area > Review Team (Gen-ART) reviews all IETF documents being processed > by the IESG for the IETF Chair. Please treat these comments just > like any other last call comments. > > For more information, please see the FAQ at > > . > > Document: draft-ietf-dmarc-eaiauth-?? > Reviewer: Tim Evens > Review Date: 2019-03-11 > IETF LC End Date: 2019-03-14 > IESG Telechat date: Not scheduled for a telechat > > Summary: > Ready with nits. > > Major issues: None > > Minor issues: None > > Nits/editorial comments: > > Throughout the draft, section references (html rendering) does not > correctly > HREF the RFC and section. For example, page-5 Section 6 has a reference to > section 6.6.1 of RFC7489, but the HTML rendering HREF links to this draft > instead of correctly linking to RFC7489 Section 6.6.1. Ideally the > references > should link correctly, for example on page-3 Section 4 with "Section 3 of > [RFC7208]." > > > --0000000000008962a30583d98d3b Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Thanks for the review, Tim.

The html rendering issues are for the RFC = editor to deal with, and not in the scope of the draft editors.

Barry

On Tue, Mar 12, 2019 at 7= :54 AM Tim Evens via Datatracker <no= reply@ietf.org> wrote:
Revie= wer: Tim Evens
Review result: Ready with Nits

I am the assigned Gen-ART reviewer for this draft. The General Area
Review Team (Gen-ART) reviews all IETF documents being processed
by the IESG for the IETF Chair.=C2=A0 Please treat these comments just
like any other last call comments.

For more information, please see the FAQ at

<https://trac.ietf.org/trac/gen/wiki/GenArtfaq&g= t;.

Document: draft-ietf-dmarc-eaiauth-??
Reviewer: Tim Evens
Review Date: 2019-03-11
IETF LC End Date: 2019-03-14
IESG Telechat date: Not scheduled for a telechat

Summary:
Ready with nits.

Major issues: None

Minor issues: None

Nits/editorial comments:

Throughout the draft, section references (html rendering) does not correctl= y
HREF the RFC and section.=C2=A0 For example, page-5 Section 6 has a referen= ce to
section 6.6.1 of RFC7489, but the HTML rendering HREF links to this draft instead of correctly linking to RFC7489 Section 6.6.1. Ideally the referenc= es
should link correctly, for example on page-3 Section 4 with "Section 3= of
[RFC7208]."


--0000000000008962a30583d98d3b-- From nobody Mon Mar 11 16:43:51 2019 Return-Path: X-Original-To: dmarc@ietfa.amsl.com Delivered-To: dmarc@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 340D012D7F8; Mon, 11 Mar 2019 16:43:37 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -14.501 X-Spam-Level: X-Spam-Status: No, score=-14.501 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIMWL_WL_MED=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-5, SPF_PASS=-0.001, URIBL_BLOCKED=0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cisco.com header.b=X4sLVIQJ; dkim=pass (1024-bit key) header.d=cisco.onmicrosoft.com header.b=OK2AuHiw Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ui589XlLCXaW; Mon, 11 Mar 2019 16:43:34 -0700 (PDT) Received: from rcdn-iport-3.cisco.com (rcdn-iport-3.cisco.com [173.37.86.74]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 16385129A87; Mon, 11 Mar 2019 16:43:34 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=17173; q=dns/txt; s=iport; t=1552347814; x=1553557414; h=from:to:cc:subject:date:message-id:references: in-reply-to:mime-version; bh=lWDdGjssj7uBGmhyNvDjWjxTL4cgHSA7x4Wy8UdNAh8=; b=X4sLVIQJlK8+K9Tf8vOGUP2OPxSlkjslf76IOC94AuzmYhysXY3bHkNE 8jg+/LZ0tcAcoyeSegyXk6p+lz1hQ2iD3tyeeWJu41of9JtziDmEXi1DQ x5vq+X4BXx0bKFUkJTG2cKyAsU8AGC72IIeRNeWCBoegD+8xfZvLMP2rn E=; IronPort-PHdr: =?us-ascii?q?9a23=3Ar720CRzIe8VlObjXCy+N+z0EezQntrPoPwUc9p?= =?us-ascii?q?sgjfdUf7+++4j5YhSN/u1j2VnOW4iTq+lJjebbqejBYSQB+t7A1RJKa5lQT1?= =?us-ascii?q?kAgMQSkRYnBZuZCEDlIfjxRyc7B89FElRi+iLzPA=3D=3D?= X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: =?us-ascii?q?A0ADAAAW8oZc/5hdJa1kGQEBAQEBAQE?= =?us-ascii?q?BAQEBAQcBAQEBAQGBUQQBAQEBAQsBgQ0vUANodAQLJwqEAINHA4RQimuCV5I?= =?us-ascii?q?zhXOBJANUCwEBIwmEQAIXhCMiNAkNAQEDAQEJAQMCbRwMhUsGIx0BATcBDwI?= =?us-ascii?q?BCBQrAwICAjAUEQIEAQ0FgyIBgRFMAxUBDqVTAooUcYEvgngBAQWFFxiCDAM?= =?us-ascii?q?FgS8BiywXgUA/gREnH4IeLoMeAoFBAQE+DYJdMYImihovggSECIcqi0hdCQK?= =?us-ascii?q?HT4gBgzoZgXmFZotainiFZYxiAgQCBAUCDgEBBYFHOIFWcBVlAYJBggqDboU?= =?us-ascii?q?UhT9ygSiMWoEfAYEeAQE?= X-IronPort-AV: E=Sophos;i="5.58,468,1544486400"; d="scan'208,217";a="523666636" Received: from rcdn-core-1.cisco.com ([173.37.93.152]) by rcdn-iport-3.cisco.com with ESMTP/TLS/DHE-RSA-SEED-SHA; 11 Mar 2019 23:43:33 +0000 Received: from XCH-ALN-005.cisco.com (xch-aln-005.cisco.com [173.36.7.15]) by rcdn-core-1.cisco.com (8.15.2/8.15.2) with ESMTPS id x2BNhWpU028011 (version=TLSv1.2 cipher=AES256-SHA bits=256 verify=FAIL); Mon, 11 Mar 2019 23:43:32 GMT Received: from xhs-aln-002.cisco.com (173.37.135.119) by XCH-ALN-005.cisco.com (173.36.7.15) with Microsoft SMTP Server (TLS) id 15.0.1473.3; Mon, 11 Mar 2019 18:43:32 -0500 Received: from xhs-aln-002.cisco.com (173.37.135.119) by xhs-aln-002.cisco.com (173.37.135.119) with Microsoft SMTP Server (TLS) id 15.0.1473.3; Mon, 11 Mar 2019 18:43:31 -0500 Received: from NAM04-BN3-obe.outbound.protection.outlook.com (173.37.151.57) by xhs-aln-002.cisco.com (173.37.135.119) with Microsoft SMTP Server (TLS) id 15.0.1473.3 via Frontend Transport; Mon, 11 Mar 2019 18:43:31 -0500 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.onmicrosoft.com; s=selector1-cisco-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=lWDdGjssj7uBGmhyNvDjWjxTL4cgHSA7x4Wy8UdNAh8=; b=OK2AuHiwR1cL784rsy2M+lvvbIiP8L+qJQSxpM0AEvfUxP9tZYmoJTuseduXPh3m91F1xwjoasYup48UPWyjO8Eb4zA51RAgoQmTai8xmyHMdXeO5lWtz14D/w6ESGZokP8AWwpzMLbcwcUnfLJiD4euc/gV+ibRmZQc8PCVmTg= Received: from MWHPR1101MB2319.namprd11.prod.outlook.com (10.174.97.146) by MWHPR1101MB2255.namprd11.prod.outlook.com (10.174.97.19) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.1686.18; Mon, 11 Mar 2019 23:43:30 +0000 Received: from MWHPR1101MB2319.namprd11.prod.outlook.com ([fe80::6155:95f2:aec2:9890]) by MWHPR1101MB2319.namprd11.prod.outlook.com ([fe80::6155:95f2:aec2:9890%8]) with mapi id 15.20.1686.021; Mon, 11 Mar 2019 23:43:30 +0000 From: "Tim Evens (tievens)" To: Barry Leiba , Tim Evens via Datatracker CC: "gen-art@ietf.org" , "dmarc@ietf.org" , "draft-ietf-dmarc-eaiauth.all@ietf.org" , "ietf@ietf.org" Thread-Topic: [Gen-art] Genart last call review of draft-ietf-dmarc-eaiauth-03 Thread-Index: AQHU2F2DVIfpJpgdtkC3WA3tmjrxhaYHC++A//+WcoA= Date: Mon, 11 Mar 2019 23:43:30 +0000 Message-ID: <53F5AD4A-BCE9-4E00-A982-4365BBD9ACA8@cisco.com> References: <155234487991.23094.14124317288389045798@ietfa.amsl.com> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=tievens@cisco.com; x-originating-ip: [128.107.241.164] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: 67f79790-07ce-444d-35dc-08d6a67b5de1 x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(8989299)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(5600127)(711020)(4605104)(2017052603328)(7153060)(7193020); SRVR:MWHPR1101MB2255; x-ms-traffictypediagnostic: MWHPR1101MB2255: x-ms-exchange-purlcount: 1 x-microsoft-exchange-diagnostics: =?utf-8?B?MTtNV0hQUjExMDFNQjIyNTU7MjM6dGNXcG5IMUhHellzY3FscmxYZlE1Znlx?= =?utf-8?B?dG5HMWI2aE41UnhGUzNraEYvM1lQOFUxeGtlakp3M1RGczR1RUE5Q3NxVTFj?= =?utf-8?B?UDdTQkRHTVlXK0FuSmY4b1AxL0syVDcxSDhVSHFwUE84OFJrTEtXTnNIVmln?= =?utf-8?B?RzFwcUpPYVJkRng4WEZnRExXcVVleFNqZXlvdC9ySVlFbjY3MFMwSzJxMStO?= =?utf-8?B?WWFheldpMW5qdzZoVkNvUFhMdmN1Z1k3MlhsUitubE5uZGRaYy8xTldYdTVR?= =?utf-8?B?bUMyV2syS2JFdTRNNTFxNGM3UWFRRHd4ZU4xdUVQaW9LVVNxZ0gxcjYzWTNI?= =?utf-8?B?UEFleFVBc3JHc1ZjbzZROVpvWEJkVEVZeVZyMXhwK1Fpa05Mc2N6OGgweGdh?= =?utf-8?B?RjlxOTBQbnNFMnNsM0RueGN5SkppVEhmdmQ4aEt5OUNMbEFWeFZ4cSs0dWJk?= =?utf-8?B?WEM1M21Oc0x5UE1STWNqVUF3aFZhT3lGSktweEZwNUtjMldMaTdOYS9lVVZI?= =?utf-8?B?Q3FLOTkwQnJDcmJabElNUnkzZGdhU2dTRHJBRGxDYUFCWDZncGZiZ0hURVJW?= =?utf-8?B?bnk5OW8zM0s4Ujd0Qmx0R2tNYmRXWTdVdmxHaVRhZ0NtVVpHTDdKay9wTU1C?= =?utf-8?B?VVZ0Z2I2bXFLaVFNL3ROTlVZdTcvaS9QVnJ5L2twalN1WWwvZ01zb2I3dnZM?= =?utf-8?B?TUtLRklsWmdtZnNiV1ZVTE5KZlBHNlpXQnpzVXdWcXZMNTBya1o1WTRBYnU4?= =?utf-8?B?eExSekV5ZE9nR0xRMUtHbTdrOGxYVHY2LzcrSWJDVmcyQVdwNVFnWFhuMzkw?= =?utf-8?B?SCszN093SVN6ZEVMQ2xkbDlPNldOLzk4ZmFBSWd3UXk2dXNQQ2lDY2pnamUy?= =?utf-8?B?c08rOEgydDk5T2Y0YVJMclQ4RUNqcEdtWGxNRjYyWnpOelpqRWJPQ3ZxcGRm?= =?utf-8?B?akk1NnFjTGcxV3UwV1B2STZFRGhlMVFMRU1XTlZpM2YrYjVrTzJrb1lDM3A0?= =?utf-8?B?S0krRHUvcmE3RU55b1FPTVlBWjk5aW9KSG1aQysxaFhVTEs2Qk1HRTFSU2FR?= =?utf-8?B?R1hLWXFwdTJmQlJiTjkxK2RReFhCZkxNSkwzemdQaDFYVXJVTVNkbnhQNHR3?= =?utf-8?B?VllpeDYrTjhGMWkwbkZnZlVCajkyQ2VlMEpzL2xyS1ovc2IrVDBUbkQyejJ5?= =?utf-8?B?YkUzOHFBQzUyajRhQVNVLzFKZ3d0bnJQOTBFcUN4V3hFZjlCeWkrMVQ5U3B6?= =?utf-8?B?WkNYb2RENThSUmx6NGVEZ0NrdHdDQnVOTTBBRXJ5UUNrL016QUc1bnordjlV?= =?utf-8?B?YjNaeEkwWnZta0w3ZDZyR1BwcWQ4T1g2UTk2KzU4emFldnEwcHNQcE1VQ1h3?= =?utf-8?B?NzVsVjllbTdFaXEzRFhhdWU0VmdxYm1UZkRTTEFKV0xBMDFYRzlFdFJ0ZVAr?= =?utf-8?B?engxcTJ5ODBpcGxEck9WaDJDSXJsZ1ZxdlJsa2ZYU1IzWE80Zm5VdEpsNGhF?= =?utf-8?B?OHNOS0tYZmZ4aVpObTR1MDZHZm14UHRLQUtMNUc4YWhXTXhjRXFBVktkL3Iw?= =?utf-8?B?ak9zRjU3ZTJSR1hycGR1YnM0WXdNNXpxeVZ5TzNEMDRZUGdLaGdkN1NJVzFV?= =?utf-8?B?N0xEcFU5TGk0V3c1QkZNK3FGODd5M2prZklUeWRuMlFyalp2UktNc0NCWlhx?= =?utf-8?B?UXB1M3VkUWZNYUgzQi9ud1hORlJIbzY3RHJpc1EzU25zWFNNYWxqRmY1cGRD?= =?utf-8?B?dkN4Ti9PS0xSSDVOZTFUZmF4MmFLaDZlaUprNS9aeWtBNlFqTUJST1dhdkpH?= =?utf-8?Q?46gxhHyvERCjEyC?= x-microsoft-antispam-prvs: x-forefront-prvs: 09730BD177 x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(39860400002)(346002)(376002)(136003)(366004)(396003)(199004)(51914003)(189003)(2906002)(8936002)(68736007)(229853002)(76176011)(105586002)(53936002)(106356001)(256004)(6116002)(3846002)(478600001)(71190400001)(236005)(71200400001)(14454004)(6306002)(486006)(54896002)(6512007)(82746002)(316002)(36756003)(66066001)(7736002)(6506007)(6246003)(53546011)(6436002)(606006)(2616005)(102836004)(446003)(6486002)(110136005)(54906003)(33656002)(11346002)(83716004)(476003)(99286004)(86362001)(81166006)(4326008)(186003)(5660300002)(97736004)(8676002)(26005)(81156014)(25786009); DIR:OUT; SFP:1101; SCL:1; SRVR:MWHPR1101MB2255; H:MWHPR1101MB2319.namprd11.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; A:1; MX:1; received-spf: None (protection.outlook.com: cisco.com does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: FM2WakDupOl+bORC0dEpkGPqLEIGZdiIsCEmCr3mjYeAkw7cfGsEFmY0iU/+BDVV/31buf5XrR/G+gaWd+0Qe4HcaTcLfWCKfs4bm8Ke2oSCfq3Yj+xdDNW4RGAUB57HMl+nZki+8eBT7rMw3dlC7Kb0zayepd8pHGD2R/M6CpseLUDAianIPBGp29uzjWGsF/InRohWq8p3V4R53rkCCdqBV0VjCz0/COmJtsO+lyGXU4Kob6MoHvLZHyaGIWZxMHoSWlQ/T4Q+z+ExRU6GhHLaRZ4+XMgFtanDT2OMPJM1xiKknv+7iMnfeV2X1BgbzwmiVIDp4JoRehMLPfNC5yVtmlj4UB6XQjfcxStvm4zARfLoFog3KzaMhnfLZFkURgQJyIzNSDj5IIQ6ZsyusDVvxzPaA8Rq00Zap1pNcmQ= Content-Type: multipart/alternative; boundary="_000_53F5AD4ABCE94E00A9824365BBD9ACA8ciscocom_" MIME-Version: 1.0 X-MS-Exchange-CrossTenant-Network-Message-Id: 67f79790-07ce-444d-35dc-08d6a67b5de1 X-MS-Exchange-CrossTenant-originalarrivaltime: 11 Mar 2019 23:43:30.3530 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 5ae1af62-9505-4097-a69a-c1553ef7840e X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-Transport-CrossTenantHeadersStamped: MWHPR1101MB2255 X-OriginatorOrg: cisco.com X-Outbound-SMTP-Client: 173.36.7.15, xch-aln-005.cisco.com X-Outbound-Node: rcdn-core-1.cisco.com Archived-At: Subject: Re: [dmarc-ietf] [Gen-art] Genart last call review of draft-ietf-dmarc-eaiauth-03 X-BeenThere: dmarc@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Domain-based Message Authentication, Reporting, and Compliance \(DMARC\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 11 Mar 2019 23:43:37 -0000 --_000_53F5AD4ABCE94E00A9824365BBD9ACA8ciscocom_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 SSBzaG91bGQgaGF2ZSBiZWVuIG1vcmUgY2xlYXIuICBUaGlzIGlzIE5PVCBzcGVjaWZpYyB0byBI VE1ML0hSRUYgcmVuZGVyaW5nLiAgIFNlY3Rpb24gcmVmZXJlbmNlcyB0byBhbiBSRkMgd2l0aG91 dCB0aGUgUkZDIG1lbnRpb25lZCBpcyBtaXNsZWFkaW5nLiAgIEZvciBleGFtcGxlOg0KDQoNCiIg RE1BUkMgW1JGQzc0ODldIGRlZmluZXMgYSBwb2xpY3kgbGFuZ3VhZ2UgdGhhdCBkb21haW4gb3du ZXJzIGNhbg0KDQogc3BlY2lmeSBmb3IgdGhlIGRvbWFpbiBvZiB0aGUgYWRkcmVzcyBpbiBhIFJG QzUzMjIuRnJvbSBoZWFkZXIuDQoNCg0KDQogU2VjdGlvbiA2LjYuMSBzcGVjaWZpZXMsIHNvbWV3 aGF0IGltcHJlY2lzZWx5LCBob3cgSUROcyBpbiB0aGUNCg0KIFJGQzUzMjIuRnJvbSBhZGRyZXNz IGRvbWFpbiBhcmUgdG8gYmUgaGFuZGxlZC4gIFRoYXQgc2VjdGlvbiBpcw0KDQogdXBkYXRlZCB0 byBzYXkgdGhhdCBhbGwgVS1sYWJlbHMgaW4gdGhlIGRvbWFpbiBhcmUgY29udmVydGVkIHRvDQoN CiBBLWxhYmVscyBiZWZvcmUgZnVydGhlciBwcm9jZXNzaW5nLiAgU2VjdGlvbnMgNi43IGFuZCA3 LjEgYXJlDQoNCiBzaW1pbGFybHkgdXBkYXRlZCB0byBzYXkgdGhhdCBhbGwgVS1sYWJlbHMgaW4g ZG9tYWlucyBiZWluZyBoYW5kbGVkDQoNCiBhcmUgY29udmVydGVkIHRvIEEtbGFiZWxzIGJlZm9y ZSBmdXJ0aGVyIHByb2Nlc3NpbmcuIg0KDQpUaGUgYWJvdmUgcmVmZXJlbmNlcyBTZWN0aW9uIDYu Ni4xIChhbmQgU2VjdGlvbnMgNi43IGFuZCA3LjEpLCBidXQgZnJvbSB3aGljaCBSRkMocyk/IEFy ZSB0aGVzZSBmcm9tIFJGQzUzMjIsIFJGQzc0ODksIHRoaXMgZHJhZnQ/ICAgVGhpcyB3b3VsZCBi ZSBzb21ld2hhdCBtb3JlIGNsZWFyIGlmIHRoaXMgaGFkIG1lbnRpb25lZCB0aGUgaW50ZW5kZWQg cmVmZXJlbmNlZCBSRkMgKDc0ODkpIGluIHRoZSBzYW1lIHBhcmFncmFwaCB0aGF0IHRoZSByZWZl cmVuY2UgaXMgbWFkZS4gIEZvciBleGFtcGxlLCBJbiBSRkM3ODQ5LCBTZWN0aW9u4oCmDQoNCk5h dHVyYWwgbGFuZ3VhZ2UgaW50ZXJwb2xhdGlvbiBpcyBjaGFsbGVuZ2luZy4gIEkgYWdyZWUgdGhh dCB0aGVyZSBhcmUgZGlmZmVyZW50IHdheXMgdG8gcmVmZXJlbmNlIHNvbWV0aGluZyB0aGF0IG1h eSBvciBtYXkgbm90IHdvcmsgd2l0aCB0aGUgY3VycmVudCByZW5kZXJpbmdzLiBGb3IgZXhhbXBs ZToNCg0KIkluIFJGQzc0ODksIFNlY3Rpb24gNi42LjEg4oCmICAiICBpcyBlcXVpdmFsZW50IHRv ICJTZWN0aW9uIDYuNi4xIFtSRkM3NDg5XS4iICBJTU8sIGF1dGhvcnMgKGluIGdlbmVyYWwpIHNo b3VsZCBwdXQgZWZmb3J0IGludG8gY2hlY2tpbmcgdGhhdCB0aGUgdmFyaW91cyByZW5kZXJpbmdz IG1lZXQgZXhwZWN0YXRpb25zLiAgSWYgdGhlcmUgYXJlIGluY29ycmVjdCBoeXBlcmxpbmtzLCBm aXggdGhlbSBvciByZW1vdmUgdGhlbS4gIFRoZSByZW5kZXJpbmcgaXNzdWUgaXMgbm90IGp1c3Qg SFRNTCwgaXQgYWxzbyBlZmZlY3RzIHRoZSBQREYgcmVuZGVyaW5nLg0KDQpJIGJlbGlldmUgdGhl IGF1dGhvciBpcyBwdXR0aW5nIGluIGVmZm9ydCB0byBjb3JyZWN0bHkgcmVmZXJlbmNlIHRoZSBz ZWN0aW9ucywgYnV0IGl0J3Mgbm90IGNvbnNpc3RlbnQuICBUaGUgZHJhZnQgZG9lcyBoYXZlIG1h bnkgcmVmZXJlbmNlcyB0byBzZWN0aW9ucyB0aGF0IGNvcnJlY3RseSBsaW5rLg0KDQpUYWtlIGZv ciBleGFtcGxlOg0KDQoNCiJTZWN0aW9uIDQuMyBvZiBbUkZDNzIwOF0gc3RhdGVzDQogICB0aGF0 IGFsbCBJRE5zIGluIGFuIFNQRiBETlMgcmVjb3JkIE1VU1QgYmUgQS1sYWJlbHM7IHRoaXMgcnVs ZSBpcw0KICAgdW5jaGFuZ2VkIHNpbmNlIGFueSBTUEYgcmVjb3JkIGNhbiBiZSB1c2VkIHRvIGF1 dGhvcml6ZSBlaXRoZXIgRUFJIG9yDQogICBjb252ZW50aW9uYWwgbWFpbC4NCiINCg0KVGhhbmtz LA0KVGltDQoNCg0KDQoNCg0KDQpPbiAzLzExLzE5LCA0OjAyIFBNLCAiR2VuLWFydCBvbiBiZWhh bGYgb2YgQmFycnkgTGVpYmEiIDxnZW4tYXJ0LWJvdW5jZXNAaWV0Zi5vcmc8bWFpbHRvOmdlbi1h cnQtYm91bmNlc0BpZXRmLm9yZz4gb24gYmVoYWxmIG9mIGJhcnJ5bGVpYmFAY29tcHV0ZXIub3Jn PG1haWx0bzpiYXJyeWxlaWJhQGNvbXB1dGVyLm9yZz4+IHdyb3RlOg0KDQpUaGFua3MgZm9yIHRo ZSByZXZpZXcsIFRpbS4NCg0KVGhlIGh0bWwgcmVuZGVyaW5nIGlzc3VlcyBhcmUgZm9yIHRoZSBS RkMgZWRpdG9yIHRvIGRlYWwgd2l0aCwgYW5kIG5vdCBpbiB0aGUgc2NvcGUgb2YgdGhlIGRyYWZ0 IGVkaXRvcnMuDQoNCkJhcnJ5DQoNCk9uIFR1ZSwgTWFyIDEyLCAyMDE5IGF0IDc6NTQgQU0gVGlt IEV2ZW5zIHZpYSBEYXRhdHJhY2tlciA8bm9yZXBseUBpZXRmLm9yZzxtYWlsdG86bm9yZXBseUBp ZXRmLm9yZz4+IHdyb3RlOg0KUmV2aWV3ZXI6IFRpbSBFdmVucw0KUmV2aWV3IHJlc3VsdDogUmVh ZHkgd2l0aCBOaXRzDQoNCkkgYW0gdGhlIGFzc2lnbmVkIEdlbi1BUlQgcmV2aWV3ZXIgZm9yIHRo aXMgZHJhZnQuIFRoZSBHZW5lcmFsIEFyZWENClJldmlldyBUZWFtIChHZW4tQVJUKSByZXZpZXdz IGFsbCBJRVRGIGRvY3VtZW50cyBiZWluZyBwcm9jZXNzZWQNCmJ5IHRoZSBJRVNHIGZvciB0aGUg SUVURiBDaGFpci4gIFBsZWFzZSB0cmVhdCB0aGVzZSBjb21tZW50cyBqdXN0DQpsaWtlIGFueSBv dGhlciBsYXN0IGNhbGwgY29tbWVudHMuDQoNCkZvciBtb3JlIGluZm9ybWF0aW9uLCBwbGVhc2Ug c2VlIHRoZSBGQVEgYXQNCg0KPGh0dHBzOi8vdHJhYy5pZXRmLm9yZy90cmFjL2dlbi93aWtpL0dl bkFydGZhcT4uDQoNCkRvY3VtZW50OiBkcmFmdC1pZXRmLWRtYXJjLWVhaWF1dGgtPz8NClJldmll d2VyOiBUaW0gRXZlbnMNClJldmlldyBEYXRlOiAyMDE5LTAzLTExDQpJRVRGIExDIEVuZCBEYXRl OiAyMDE5LTAzLTE0DQpJRVNHIFRlbGVjaGF0IGRhdGU6IE5vdCBzY2hlZHVsZWQgZm9yIGEgdGVs ZWNoYXQNCg0KU3VtbWFyeToNClJlYWR5IHdpdGggbml0cy4NCg0KTWFqb3IgaXNzdWVzOiBOb25l DQoNCk1pbm9yIGlzc3VlczogTm9uZQ0KDQpOaXRzL2VkaXRvcmlhbCBjb21tZW50czoNCg0KVGhy b3VnaG91dCB0aGUgZHJhZnQsIHNlY3Rpb24gcmVmZXJlbmNlcyAoaHRtbCByZW5kZXJpbmcpIGRv ZXMgbm90IGNvcnJlY3RseQ0KSFJFRiB0aGUgUkZDIGFuZCBzZWN0aW9uLiAgRm9yIGV4YW1wbGUs IHBhZ2UtNSBTZWN0aW9uIDYgaGFzIGEgcmVmZXJlbmNlIHRvDQpzZWN0aW9uIDYuNi4xIG9mIFJG Qzc0ODksIGJ1dCB0aGUgSFRNTCByZW5kZXJpbmcgSFJFRiBsaW5rcyB0byB0aGlzIGRyYWZ0DQpp bnN0ZWFkIG9mIGNvcnJlY3RseSBsaW5raW5nIHRvIFJGQzc0ODkgU2VjdGlvbiA2LjYuMS4gSWRl YWxseSB0aGUgcmVmZXJlbmNlcw0Kc2hvdWxkIGxpbmsgY29ycmVjdGx5LCBmb3IgZXhhbXBsZSBv biBwYWdlLTMgU2VjdGlvbiA0IHdpdGggIlNlY3Rpb24gMyBvZg0KW1JGQzcyMDhdLiINCg0K --_000_53F5AD4ABCE94E00A9824365BBD9ACA8ciscocom_ Content-Type: text/html; charset="utf-8" Content-ID: <05543FA63EE0B5488166E739D52ACE32@namprd11.prod.outlook.com> Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6bz0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6b2ZmaWNlIiB4 bWxuczp3PSJ1cm46c2NoZW1hcy1taWNyb3NvZnQtY29tOm9mZmljZTp3b3JkIiB4bWxuczptPSJo dHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL29mZmljZS8yMDA0LzEyL29tbWwiIHhtbG5zPSJo dHRwOi8vd3d3LnczLm9yZy9UUi9SRUMtaHRtbDQwIj4NCjxoZWFkPg0KPG1ldGEgaHR0cC1lcXVp dj0iQ29udGVudC1UeXBlIiBjb250ZW50PSJ0ZXh0L2h0bWw7IGNoYXJzZXQ9dXRmLTgiPg0KPG1l dGEgbmFtZT0iR2VuZXJhdG9yIiBjb250ZW50PSJNaWNyb3NvZnQgV29yZCAxNSAoZmlsdGVyZWQg bWVkaXVtKSI+DQo8c3R5bGU+PCEtLQ0KLyogRm9udCBEZWZpbml0aW9ucyAqLw0KQGZvbnQtZmFj ZQ0KCXtmb250LWZhbWlseToiQ2FtYnJpYSBNYXRoIjsNCglwYW5vc2UtMToyIDQgNSAzIDUgNCA2 IDMgMiA0O30NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6Q2FsaWJyaTsNCglwYW5vc2UtMToy IDE1IDUgMiAyIDIgNCAzIDIgNDt9DQovKiBTdHlsZSBEZWZpbml0aW9ucyAqLw0KcC5Nc29Ob3Jt YWwsIGxpLk1zb05vcm1hbCwgZGl2Lk1zb05vcm1hbA0KCXttYXJnaW46MGluOw0KCW1hcmdpbi1i b3R0b206LjAwMDFwdDsNCglmb250LXNpemU6MTEuMHB0Ow0KCWZvbnQtZmFtaWx5OiJDYWxpYnJp IixzYW5zLXNlcmlmO30NCmE6bGluaywgc3Bhbi5Nc29IeXBlcmxpbmsNCgl7bXNvLXN0eWxlLXBy aW9yaXR5Ojk5Ow0KCWNvbG9yOmJsdWU7DQoJdGV4dC1kZWNvcmF0aW9uOnVuZGVybGluZTt9DQph OnZpc2l0ZWQsIHNwYW4uTXNvSHlwZXJsaW5rRm9sbG93ZWQNCgl7bXNvLXN0eWxlLXByaW9yaXR5 Ojk5Ow0KCWNvbG9yOnB1cnBsZTsNCgl0ZXh0LWRlY29yYXRpb246dW5kZXJsaW5lO30NCnByZQ0K CXttc28tc3R5bGUtcHJpb3JpdHk6OTk7DQoJbXNvLXN0eWxlLWxpbms6IkhUTUwgUHJlZm9ybWF0 dGVkIENoYXIiOw0KCW1hcmdpbjowaW47DQoJbWFyZ2luLWJvdHRvbTouMDAwMXB0Ow0KCWZvbnQt c2l6ZToxMC4wcHQ7DQoJZm9udC1mYW1pbHk6IkNvdXJpZXIgTmV3Ijt9DQpwLm1zb25vcm1hbDAs IGxpLm1zb25vcm1hbDAsIGRpdi5tc29ub3JtYWwwDQoJe21zby1zdHlsZS1uYW1lOm1zb25vcm1h bDsNCgltc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzsNCgltYXJnaW4tcmlnaHQ6MGluOw0KCW1zby1t YXJnaW4tYm90dG9tLWFsdDphdXRvOw0KCW1hcmdpbi1sZWZ0OjBpbjsNCglmb250LXNpemU6MTEu MHB0Ow0KCWZvbnQtZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNlcmlmO30NCnNwYW4uRW1haWxTdHls ZTE4DQoJe21zby1zdHlsZS10eXBlOnBlcnNvbmFsLXJlcGx5Ow0KCWZvbnQtZmFtaWx5OiJDYWxp YnJpIixzYW5zLXNlcmlmOw0KCWNvbG9yOndpbmRvd3RleHQ7fQ0Kc3Bhbi5IVE1MUHJlZm9ybWF0 dGVkQ2hhcg0KCXttc28tc3R5bGUtbmFtZToiSFRNTCBQcmVmb3JtYXR0ZWQgQ2hhciI7DQoJbXNv LXN0eWxlLXByaW9yaXR5Ojk5Ow0KCW1zby1zdHlsZS1saW5rOiJIVE1MIFByZWZvcm1hdHRlZCI7 DQoJZm9udC1mYW1pbHk6IkNvdXJpZXIgTmV3Ijt9DQouTXNvQ2hwRGVmYXVsdA0KCXttc28tc3R5 bGUtdHlwZTpleHBvcnQtb25seTsNCglmb250LXNpemU6MTAuMHB0O30NCkBwYWdlIFdvcmRTZWN0 aW9uMQ0KCXtzaXplOjguNWluIDExLjBpbjsNCgltYXJnaW46MS4waW4gMS4waW4gMS4waW4gMS4w aW47fQ0KZGl2LldvcmRTZWN0aW9uMQ0KCXtwYWdlOldvcmRTZWN0aW9uMTt9DQotLT48L3N0eWxl Pg0KPC9oZWFkPg0KPGJvZHkgbGFuZz0iRU4tVVMiIGxpbms9ImJsdWUiIHZsaW5rPSJwdXJwbGUi Pg0KPGRpdiBjbGFzcz0iV29yZFNlY3Rpb24xIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPkkgc2hv dWxkIGhhdmUgYmVlbiBtb3JlIGNsZWFyLiAmbmJzcDtUaGlzIGlzIE5PVCBzcGVjaWZpYyB0byBI VE1ML0hSRUYgcmVuZGVyaW5nLiZuYnNwOyZuYnNwOyBTZWN0aW9uIHJlZmVyZW5jZXMgdG8gYW4g UkZDIHdpdGhvdXQgdGhlIFJGQyBtZW50aW9uZWQgaXMgbWlzbGVhZGluZy4mbmJzcDsmbmJzcDsg Rm9yIGV4YW1wbGU6PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZu YnNwOzwvbzpwPjwvcD4NCjxwcmU+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiZxdW90O0NhbGli cmkmcXVvdDssc2Fucy1zZXJpZiI+JnF1b3Q7IDwvc3Bhbj48c3BhbiBzdHlsZT0iY29sb3I6Ymxh Y2siPkRNQVJDIFtSRkM3NDg5XSBkZWZpbmVzIGEgcG9saWN5IGxhbmd1YWdlIHRoYXQgZG9tYWlu IG93bmVycyBjYW48bzpwPjwvbzpwPjwvc3Bhbj48L3ByZT4NCjxwcmU+PHNwYW4gc3R5bGU9ImNv bG9yOmJsYWNrIj4gc3BlY2lmeSBmb3IgdGhlIGRvbWFpbiBvZiB0aGUgYWRkcmVzcyBpbiBhIFJG QzUzMjIuRnJvbSBoZWFkZXIuPG86cD48L286cD48L3NwYW4+PC9wcmU+DQo8cHJlPjxzcGFuIHN0 eWxlPSJjb2xvcjpibGFjayI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wcmU+DQo8cHJlPjxz cGFuIHN0eWxlPSJjb2xvcjpibGFjayI+IFNlY3Rpb24gNi42LjEgc3BlY2lmaWVzLCBzb21ld2hh dCBpbXByZWNpc2VseSwgaG93IElETnMgaW4gdGhlPG86cD48L286cD48L3NwYW4+PC9wcmU+DQo8 cHJlPjxzcGFuIHN0eWxlPSJjb2xvcjpibGFjayI+IFJGQzUzMjIuRnJvbSBhZGRyZXNzIGRvbWFp biBhcmUgdG8gYmUgaGFuZGxlZC4mbmJzcDsgVGhhdCBzZWN0aW9uIGlzPG86cD48L286cD48L3Nw YW4+PC9wcmU+DQo8cHJlPjxzcGFuIHN0eWxlPSJjb2xvcjpibGFjayI+IHVwZGF0ZWQgdG8gc2F5 IHRoYXQgYWxsIFUtbGFiZWxzIGluIHRoZSBkb21haW4gYXJlIGNvbnZlcnRlZCB0bzxvOnA+PC9v OnA+PC9zcGFuPjwvcHJlPg0KPHByZT48c3BhbiBzdHlsZT0iY29sb3I6YmxhY2siPiBBLWxhYmVs cyBiZWZvcmUgZnVydGhlciBwcm9jZXNzaW5nLiZuYnNwOyBTZWN0aW9ucyA2LjcgYW5kIDcuMSBh cmU8bzpwPjwvbzpwPjwvc3Bhbj48L3ByZT4NCjxwcmU+PHNwYW4gc3R5bGU9ImNvbG9yOmJsYWNr Ij4gc2ltaWxhcmx5IHVwZGF0ZWQgdG8gc2F5IHRoYXQgYWxsIFUtbGFiZWxzIGluIGRvbWFpbnMg YmVpbmcgaGFuZGxlZDxvOnA+PC9vOnA+PC9zcGFuPjwvcHJlPg0KPHByZT48c3BhbiBzdHlsZT0i Y29sb3I6YmxhY2siPiBhcmUgY29udmVydGVkIHRvIEEtbGFiZWxzIGJlZm9yZSBmdXJ0aGVyIHBy b2Nlc3NpbmcuJnF1b3Q7PG86cD48L286cD48L3NwYW4+PC9wcmU+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPlRoZSBhYm92 ZSByZWZlcmVuY2VzIFNlY3Rpb24gNi42LjEgKGFuZCBTZWN0aW9ucyA2LjcgYW5kIDcuMSksIGJ1 dCBmcm9tIHdoaWNoIFJGQyhzKT8gQXJlIHRoZXNlIGZyb20gUkZDNTMyMiwgUkZDNzQ4OSwgdGhp cyBkcmFmdD8mbmJzcDsmbmJzcDsgVGhpcyB3b3VsZCBiZSBzb21ld2hhdCBtb3JlIGNsZWFyIGlm IHRoaXMgaGFkIG1lbnRpb25lZCB0aGUgaW50ZW5kZWQgcmVmZXJlbmNlZCBSRkMgKDc0ODkpIGlu IHRoZSBzYW1lDQogcGFyYWdyYXBoIHRoYXQgdGhlIHJlZmVyZW5jZSBpcyBtYWRlLiZuYnNwOyBG b3IgZXhhbXBsZSwgSW4gUkZDNzg0OSwgU2VjdGlvbuKApiAmbmJzcDs8bzpwPjwvbzpwPjwvcD4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+TmF0dXJhbCBsYW5ndWFnZSBpbnRlcnBvbGF0aW9uIGlzIGNoYWxsZW5naW5nLiZu YnNwOyBJIGFncmVlIHRoYXQgdGhlcmUgYXJlIGRpZmZlcmVudCB3YXlzIHRvIHJlZmVyZW5jZSBz b21ldGhpbmcgdGhhdCBtYXkgb3IgbWF5IG5vdCB3b3JrIHdpdGggdGhlIGN1cnJlbnQgcmVuZGVy aW5ncy4gRm9yIGV4YW1wbGU6PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48 bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPiZxdW90O0luIFJGQzc0 ODksIFNlY3Rpb24gNi42LjEg4oCmJm5ic3A7ICZxdW90OyZuYnNwOyBpcyBlcXVpdmFsZW50IHRv ICZxdW90O1NlY3Rpb24gNi42LjEgW1JGQzc0ODldLiZxdW90OyAmbmJzcDtJTU8sIGF1dGhvcnMg KGluIGdlbmVyYWwpIHNob3VsZCBwdXQgZWZmb3J0IGludG8gY2hlY2tpbmcgdGhhdCB0aGUgdmFy aW91cyByZW5kZXJpbmdzIG1lZXQgZXhwZWN0YXRpb25zLiAmbmJzcDtJZiB0aGVyZSBhcmUgaW5j b3JyZWN0IGh5cGVybGlua3MsIGZpeCB0aGVtIG9yIHJlbW92ZQ0KIHRoZW0uJm5ic3A7IFRoZSBy ZW5kZXJpbmcgaXNzdWUgaXMgbm90IGp1c3QgSFRNTCwgaXQgYWxzbyBlZmZlY3RzIHRoZSBQREYg cmVuZGVyaW5nLiA8bzpwPg0KPC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4m bmJzcDs8L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5JIGJlbGlldmUgdGhlIGF1dGhv ciBpcyBwdXR0aW5nIGluIGVmZm9ydCB0byBjb3JyZWN0bHkgcmVmZXJlbmNlIHRoZSBzZWN0aW9u cywgYnV0IGl0J3Mgbm90IGNvbnNpc3RlbnQuJm5ic3A7IFRoZSBkcmFmdCBkb2VzIGhhdmUgbWFu eSByZWZlcmVuY2VzIHRvIHNlY3Rpb25zIHRoYXQgY29ycmVjdGx5IGxpbmsuDQo8bzpwPjwvbzpw PjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPHAgY2xh c3M9Ik1zb05vcm1hbCI+VGFrZSBmb3IgZXhhbXBsZTo8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPHByZT48c3BhbiBzdHlsZT0iZm9u dC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj4mcXVvdDs8L3NwYW4+PHNw YW4gc3R5bGU9ImNvbG9yOmJsYWNrIj5TZWN0aW9uIDQuMyBvZiBbUkZDNzIwOF0gc3RhdGVzPG86 cD48L286cD48L3NwYW4+PC9wcmU+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0i Zm9udC1zaXplOjEwLjBwdDtmb250LWZhbWlseTomcXVvdDtDb3VyaWVyIE5ldyZxdW90Oztjb2xv cjpibGFjayI+Jm5ic3A7Jm5ic3A7IHRoYXQgYWxsIElETnMgaW4gYW4gU1BGIEROUyByZWNvcmQg TVVTVCBiZSBBLWxhYmVsczsgdGhpcyBydWxlIGlzPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMC4wcHQ7Zm9udC1mYW1p bHk6JnF1b3Q7Q291cmllciBOZXcmcXVvdDs7Y29sb3I6YmxhY2siPiZuYnNwOyZuYnNwOyB1bmNo YW5nZWQgc2luY2UgYW55IFNQRiByZWNvcmQgY2FuIGJlIHVzZWQgdG8gYXV0aG9yaXplIGVpdGhl ciBFQUkgb3I8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3Bh biBzdHlsZT0iZm9udC1zaXplOjEwLjBwdDtmb250LWZhbWlseTomcXVvdDtDb3VyaWVyIE5ldyZx dW90Oztjb2xvcjpibGFjayI+Jm5ic3A7Jm5ic3A7IGNvbnZlbnRpb25hbCBtYWlsLjxvOnA+PC9v OnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPiZxdW90OzxvOnA+PC9vOnA+PC9w Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj5UaGFua3MsPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5U aW08bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+ PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi PjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8 L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxk aXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4i Pk9uIDMvMTEvMTksIDQ6MDIgUE0sICZxdW90O0dlbi1hcnQgb24gYmVoYWxmIG9mIEJhcnJ5IExl aWJhJnF1b3Q7ICZsdDs8YSBocmVmPSJtYWlsdG86Z2VuLWFydC1ib3VuY2VzQGlldGYub3JnIj5n ZW4tYXJ0LWJvdW5jZXNAaWV0Zi5vcmc8L2E+IG9uIGJlaGFsZiBvZg0KPGEgaHJlZj0ibWFpbHRv OmJhcnJ5bGVpYmFAY29tcHV0ZXIub3JnIj5iYXJyeWxlaWJhQGNvbXB1dGVyLm9yZzwvYT4mZ3Q7 IHdyb3RlOjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+PG86cD4mbmJzcDs8L286cD48L3A+ DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdp bi1sZWZ0Oi41aW4iPlRoYW5rcyBmb3IgdGhlIHJldmlldywgVGltLjxvOnA+PC9vOnA+PC9wPg0K PC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2lu LWxlZnQ6LjVpbiI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+VGhlIGh0bWwgcmVuZGVyaW5n IGlzc3VlcyBhcmUgZm9yIHRoZSBSRkMgZWRpdG9yIHRvIGRlYWwgd2l0aCwgYW5kIG5vdCBpbiB0 aGUgc2NvcGUgb2YgdGhlIGRyYWZ0IGVkaXRvcnMuPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxk aXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+PG86cD4m bmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHls ZT0ibWFyZ2luLWxlZnQ6LjVpbiI+QmFycnk8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj48bzpwPiZuYnNw OzwvbzpwPjwvcD4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1h cmdpbi1sZWZ0Oi41aW4iPk9uIFR1ZSwgTWFyIDEyLCAyMDE5IGF0IDc6NTQgQU0gVGltIEV2ZW5z IHZpYSBEYXRhdHJhY2tlciAmbHQ7PGEgaHJlZj0ibWFpbHRvOm5vcmVwbHlAaWV0Zi5vcmciPm5v cmVwbHlAaWV0Zi5vcmc8L2E+Jmd0OyB3cm90ZTo8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGJs b2NrcXVvdGUgc3R5bGU9ImJvcmRlcjpub25lO2JvcmRlci1sZWZ0OnNvbGlkICNDQ0NDQ0MgMS4w cHQ7cGFkZGluZzowaW4gMGluIDBpbiA2LjBwdDttYXJnaW4tbGVmdDo0LjhwdDttYXJnaW4tcmln aHQ6MGluIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6 MGluO21hcmdpbi1yaWdodDowaW47bWFyZ2luLWJvdHRvbToxMi4wcHQ7bWFyZ2luLWxlZnQ6LjVp biI+DQpSZXZpZXdlcjogVGltIEV2ZW5zPGJyPg0KUmV2aWV3IHJlc3VsdDogUmVhZHkgd2l0aCBO aXRzPGJyPg0KPGJyPg0KSSBhbSB0aGUgYXNzaWduZWQgR2VuLUFSVCByZXZpZXdlciBmb3IgdGhp cyBkcmFmdC4gVGhlIEdlbmVyYWwgQXJlYTxicj4NClJldmlldyBUZWFtIChHZW4tQVJUKSByZXZp ZXdzIGFsbCBJRVRGIGRvY3VtZW50cyBiZWluZyBwcm9jZXNzZWQ8YnI+DQpieSB0aGUgSUVTRyBm b3IgdGhlIElFVEYgQ2hhaXIuJm5ic3A7IFBsZWFzZSB0cmVhdCB0aGVzZSBjb21tZW50cyBqdXN0 PGJyPg0KbGlrZSBhbnkgb3RoZXIgbGFzdCBjYWxsIGNvbW1lbnRzLjxicj4NCjxicj4NCkZvciBt b3JlIGluZm9ybWF0aW9uLCBwbGVhc2Ugc2VlIHRoZSBGQVEgYXQ8YnI+DQo8YnI+DQombHQ7PGEg aHJlZj0iaHR0cHM6Ly90cmFjLmlldGYub3JnL3RyYWMvZ2VuL3dpa2kvR2VuQXJ0ZmFxIiB0YXJn ZXQ9Il9ibGFuayI+aHR0cHM6Ly90cmFjLmlldGYub3JnL3RyYWMvZ2VuL3dpa2kvR2VuQXJ0ZmFx PC9hPiZndDsuPGJyPg0KPGJyPg0KRG9jdW1lbnQ6IGRyYWZ0LWlldGYtZG1hcmMtZWFpYXV0aC0/ Pzxicj4NClJldmlld2VyOiBUaW0gRXZlbnM8YnI+DQpSZXZpZXcgRGF0ZTogMjAxOS0wMy0xMTxi cj4NCklFVEYgTEMgRW5kIERhdGU6IDIwMTktMDMtMTQ8YnI+DQpJRVNHIFRlbGVjaGF0IGRhdGU6 IE5vdCBzY2hlZHVsZWQgZm9yIGEgdGVsZWNoYXQ8YnI+DQo8YnI+DQpTdW1tYXJ5Ojxicj4NClJl YWR5IHdpdGggbml0cy48YnI+DQo8YnI+DQpNYWpvciBpc3N1ZXM6IE5vbmU8YnI+DQo8YnI+DQpN aW5vciBpc3N1ZXM6IE5vbmU8YnI+DQo8YnI+DQpOaXRzL2VkaXRvcmlhbCBjb21tZW50czo8YnI+ DQo8YnI+DQpUaHJvdWdob3V0IHRoZSBkcmFmdCwgc2VjdGlvbiByZWZlcmVuY2VzIChodG1sIHJl bmRlcmluZykgZG9lcyBub3QgY29ycmVjdGx5PGJyPg0KSFJFRiB0aGUgUkZDIGFuZCBzZWN0aW9u LiZuYnNwOyBGb3IgZXhhbXBsZSwgcGFnZS01IFNlY3Rpb24gNiBoYXMgYSByZWZlcmVuY2UgdG88 YnI+DQpzZWN0aW9uIDYuNi4xIG9mIFJGQzc0ODksIGJ1dCB0aGUgSFRNTCByZW5kZXJpbmcgSFJF RiBsaW5rcyB0byB0aGlzIGRyYWZ0PGJyPg0KaW5zdGVhZCBvZiBjb3JyZWN0bHkgbGlua2luZyB0 byBSRkM3NDg5IFNlY3Rpb24gNi42LjEuIElkZWFsbHkgdGhlIHJlZmVyZW5jZXM8YnI+DQpzaG91 bGQgbGluayBjb3JyZWN0bHksIGZvciBleGFtcGxlIG9uIHBhZ2UtMyBTZWN0aW9uIDQgd2l0aCAm cXVvdDtTZWN0aW9uIDMgb2Y8YnI+DQpbUkZDNzIwOF0uJnF1b3Q7PGJyPg0KPGJyPg0KPG86cD48 L286cD48L3A+DQo8L2Jsb2NrcXVvdGU+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2JvZHk+ DQo8L2h0bWw+DQo= --_000_53F5AD4ABCE94E00A9824365BBD9ACA8ciscocom_-- From nobody Mon Mar 11 17:51:05 2019 Return-Path: X-Original-To: dmarc@ietfa.amsl.com Delivered-To: dmarc@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0FFCA12797A for ; Mon, 11 Mar 2019 17:37:57 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.001 X-Spam-Level: X-Spam-Status: No, score=-2.001 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_PASS=-0.001] autolearn=unavailable autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1536-bit key) header.d=iecc.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Tj7anUNJ-Ydt for ; Mon, 11 Mar 2019 17:37:55 -0700 (PDT) Received: from gal.iecc.com (gal.iecc.com [IPv6:2001:470:1f07:1126:0:43:6f73:7461]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A264A1311B9 for ; Mon, 11 Mar 2019 17:37:55 -0700 (PDT) Received: (qmail 40256 invoked from network); 12 Mar 2019 00:31:13 -0000 DKIM-Signature: v=1; a=rsa-sha256; c=simple; d=iecc.com; h=date:message-id:from:to:cc:subject:in-reply-to:references:mime-version:content-type:user-agent; s=9d3e.5c86fdd1.k1903; bh=752cNkSTadU+uXet3sQTx+ZJ1WeNj5W55JysCf+DryY=; b=LKctgIqwzQxnasZh1/pXsOZqrSrXPqXWxcmNONU9jnUkbEPfEKBPx5/XcsoeeZ7PkKr9s3F3KeT90rdRfNdULPizAovPS3qcezcfWJoHpldFxSsX7ZRZ18pj8GBnl572P1gDvicOTRlvdEuHLnnaVrlIijRihn/+dglZq0L3PrfIk542bb/y/V3VuOKf7CiefxfkzdBiC7Mgzp9xOt4e8YqSthopMuQIVaw+D8al6hxOegkFLf2hQs+X1SwFara6 Received: from localhost ([IPv6:2001:470:1f07:1126::78:696d:6170]) by imap.iecc.com ([IPv6:2001:470:1f07:1126::78:696d:6170]) with ESMTP via TCP6; 12 Mar 2019 00:31:12 -0000 Date: 12 Mar 2019 09:31:38 +0900 Message-ID: From: "John R. Levine" To: "Tim Evens (tievens)" Cc: "Barry Leiba" , "Tim Evens via Datatracker" , "gen-art@ietf.org" , "dmarc@ietf.org" , "ietf@ietf.org" , "Tim Wicinski" , "Murray Kucherawy" , alexey.melnikov@isode.com, ben@nostrum.com, adam@nostrum.com, "Alexey Melnikov" , "Kurt Andersen" In-Reply-To: <53F5AD4A-BCE9-4E00-A982-4365BBD9ACA8@cisco.com> References: <155234487991.23094.14124317288389045798@ietfa.amsl.com> <53F5AD4A-BCE9-4E00-A982-4365BBD9ACA8@cisco.com> User-Agent: Alpine 2.21 (OSX 202 2017-01-01) MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="0-2007234127-1552350703=:49371" Archived-At: X-Mailman-Approved-At: Mon, 11 Mar 2019 17:51:03 -0700 Subject: Re: [dmarc-ietf] [taugh.com-standards] Re: [Gen-art] Genart last call review of draft-ietf-dmarc-eaiauth-03 X-BeenThere: dmarc@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Domain-based Message Authentication, Reporting, and Compliance \(DMARC\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 12 Mar 2019 00:37:57 -0000 This message is in MIME format. The first part should be readable text, while the remaining parts are likely unreadable without MIME-aware tools. --0-2007234127-1552350703=:49371 Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 8BIT On Mon, 11 Mar 2019, Tim Evens (tievens) wrote: > I should have been more clear. This is NOT specific to HTML/HREF rendering. Section references to an RFC without the RFC mentioned is misleading. For example: > " DMARC [RFC7489] defines a policy language that domain owners can > specify for the domain of the address in a RFC5322.From header. > > Section 6.6.1 specifies, somewhat imprecisely, how IDNs in the > RFC5322.From address domain are to be handled. That section is > updated to say that all U-labels in the domain are converted to > A-labels before further processing. Sections 6.7 and 7.1 are > similarly updated to say that all U-labels in domains being handled > are converted to A-labels before further processing." > The above references Section 6.6.1 (and Sections 6.7 and 7.1), but from which RFC(s)? Are these from RFC5322, RFC7489, this draft? This would be somewhat more clear if this had mentioned the intended referenced RFC (7489) in the same paragraph that the reference is made. For example, In RFC7849, Section… All of sectioh 6 is about DMARC and the only RFC mentioned in section 6 is 7489 so I assumed it was clear enough that's what the references are for. I suppose I could add "of RFC 7489" after each section reference but it seems awfully pedantic. > "In RFC7489, Section 6.6.1 … " is equivalent to "Section 6.6.1 > [RFC7489]." IMO, authors (in general) should put effort into checking > that the various renderings meet expectations. If there are incorrect > hyperlinks, fix them or remove them. The rendering issue is not just > HTML, it also effects the PDF rendering. That really seems like something for the tools team or the RFC editor. The xref links in the XML are all there, and the stuff you're worried about is all mechanically created by xml2rfc. R's, John --0-2007234127-1552350703=:49371-- From nobody Thu Mar 14 02:55:32 2019 Return-Path: X-Original-To: dmarc@ietf.org Delivered-To: dmarc@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id AE497129441; Thu, 14 Mar 2019 02:55:21 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 8bit From: =?utf-8?q?Martin_D=C3=BCrst_via_Datatracker?= To: Cc: dmarc@ietf.org, draft-ietf-dmarc-eaiauth.all@ietf.org, ietf@ietf.org X-Test-IDTracker: no X-IETF-IDTracker: 6.94.0 Auto-Submitted: auto-generated Precedence: bulk Reply-To: =?utf-8?q?Martin_D=C3=BCrst?= Message-ID: <155255732161.2699.16055637076396529424@ietfa.amsl.com> Date: Thu, 14 Mar 2019 02:55:21 -0700 Archived-At: Subject: [dmarc-ietf] I18ndir last call review of draft-ietf-dmarc-eaiauth-03 X-BeenThere: dmarc@ietf.org X-Mailman-Version: 2.1.29 List-Id: "Domain-based Message Authentication, Reporting, and Compliance \(DMARC\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 14 Mar 2019 09:55:22 -0000 Reviewer: Martin Dürst Review result: Ready with Issues I am the assigned Internationalization Directorate (i18ndir) reviewer for this draft. Harald Alvestrand and Pete Resnik contributed to this review. The Internationalization Directorate has been formed only recently, and has not yet established a review template or an FAQ. The review is intended to concentrate on internationalization issues, but is not limited to such issues. Please treat these comments just like any other last call comments. General: ======= It's good that this document is being done, EAI can only work better if it's clear where in the infrastructure U-labels are to be used, and where A-labels, and what happens with non-ASCII LHS. It's a pity that there are not more places where U-labels are used, but that may be difficult to change. Major/intermediate issues: ========================= The Abstract mentions the Authentication-Results header field, but the text doesn't. Section 4, %{s} and %{l} macros in SPF: The draft says that these cannot be used for local parts that contain non-ASCII characters. This may be enough for this draft, but is this a problem that should be fixed in the longer term? How widely are %{s} and %{l} macros used currently? Section 5, grammar of dkim-safe-char: This adds all of Unicode (therewith not including overlong encodings or surrogates), which is probably the best thing that can be done in the grammar; any try to eliminate e.g. non-characters, characters with control functions, invisible characters, unassigned code points, private-use code points, and the like would be very difficult. But there should be a warning about this in the security section. It may be appropriate to give a warning to implementers that they have to make sure that for internationalized messages, the DKIM signatures are calculated on UTF-8 strings. My assumption is that this should just work with the usual signature algorithms and the usual APIs, but some implementations may use special checks or so that would cause problems. Minor issues: ============ In Abstract, fix "Authentication-Results header" -> "Authentication-Results header field" 1. Introduction: This should start with a short section listing the documents/definitions that the reader is supposed to be familiar with. "unencoded message bodies": Does this mean message bodies in ASCII only? I'm not sure this needs special mention; A-labels would also be needed e.g. for Korean domains in a message body encoded as Shift_JIS. "Internationalized mail also allows UTF-8 characters": There are no UTF-8 characters. There are ((non-ASCII) Unicode) characters encoded as/in UTF-8. Please fix. (several places) 2. Definitions: The term IDN, for Internationalized Domain Name, refers to a domain name containing either U-labels or A-labels. What about domain names with mixed U-labels and A-labels? The draft says: Since DMARC is not currently a standards track protocol, this specification offers advice rather than requirements for DMARC. but then the abstract says This specification updates the SPF, DKIM, and DMARC specifications and the DMARC section (section 6) looks as if it's just as normative as the others. Either way may be fine (allowing informationals to be updated is not a bad idea), but it should be self-consistent. Section 5 repeatedly uses the term "internationalized messages", but it doesn't seem to be defined. The intent seems to be to refer to messages with RFC 6532 headers (which are called "internationalized email headers" in RFC 6532; it uses the term "internationalized messages" only in the context of message/global). In section 5, please consider referencing RFC 5982. 6. DMARC ... This would be easier to read, in particular for outsiders, if special terms such as "RFC5322.From", "rua", and "ruf" were quoted. Nits: ==== Please fix capitalization of headers (e.g. General principles -> General Principles). "This rule is relaxed only for headers in internationalized messages [RFC6532] so IDNs SHOULD be represented as U-labels but MAY be A-labels." is a bit difficult to read. I'd propose a rewrite along the following lines: "This rule is relaxed only for headers in internationalized messages [RFC6532]. In such headers, IDNs SHOULD be represented as U-labels but MAY be represented as A-labels." "Field names are restricted to printable ASCII (see [RFC5322] section 3.6.8) so this case conversion remains the usual ASCII conversion." -> "Field names are restricted to printable ASCII (see [RFC5322] section 3.6.8) so this case conversion remains limited to ASCII characters." (We don't want to give the impression that non-ASCII characters are unusual; they are not.) "Since a policy record can be used for both internationalized and conventional mail, those addresses still have to be conventional addresses, not internationalized addresses." -> "Since a policy record can be used for both internationalized and conventional mail, those addresses still have to be ASCII-only addresses, not internationalized addresses." (We don't want to give the impression that addresses with non-ASCII characters are non-conventional.) From nobody Thu Mar 14 13:38:56 2019 Return-Path: X-Original-To: dmarc@ietfa.amsl.com Delivered-To: dmarc@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6CEAD131058 for ; Thu, 14 Mar 2019 13:38:44 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.999 X-Spam-Level: X-Spam-Status: No, score=-1.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=unavailable autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=drkurt.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 4luvolnK8ZM9 for ; Thu, 14 Mar 2019 13:38:43 -0700 (PDT) Received: from mail-it1-x130.google.com (mail-it1-x130.google.com [IPv6:2607:f8b0:4864:20::130]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 114F0130DC2 for ; Thu, 14 Mar 2019 13:38:38 -0700 (PDT) Received: by mail-it1-x130.google.com with SMTP id e24so6914047itl.1 for ; Thu, 14 Mar 2019 13:38:38 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=drkurt.com; s=20130612; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=JkWUY/LgtDC6g2jFlAeoOQBWFXXJPV5GJaLlCvmSRc0=; b=YenNb6Am3apuqbeKMCgOKHfifwVzRZKOWWkATKbDjE8r2tNSGvkzMBv9WYhXDVI0fJ YREt2wPOJNNl+UVSmTyXHdtzlHwC8AmsEh4bWkIMREg/+aWj7RXYZRc8f2uogRr2wPzo KkwjJdKVAbyXTuyOSsoJGmrEbD+KxGx7q3BbI= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=JkWUY/LgtDC6g2jFlAeoOQBWFXXJPV5GJaLlCvmSRc0=; b=nn5r8X5H1AxF1rZB1AP5upuACjdGEzKPTYsTYUEY76GtInY3ByuOq2ZnFNBtVjyyHl HXJphbAK4OLq8z06KxPeSAXFJwE5Y0QCMEddhia8plzdjK9f8/dYBpY7MSr1o4j5gh+x KW5YoEj7zz1CeTKpH3wlRLmjSTwb5FAzUhLGzYjHyMbZmGwW6FGX83taV/0dmFWnxTKc FyXED4hQGYKLcsuCMiNxe0EvZdtdA2ncmbeuZRsJou7Ckn6/Rpo8FYhM9WFzLIGtSVKb aLyBRmPZaV/3IfeTw5XwSnyA7bWsLMsoIkEujGh5jfYL7jyauHYckLJUGh0BSEC9NsxC sRvg== X-Gm-Message-State: APjAAAWhL7+fOy2sflF22xH+DKaovJRJd8eWJ0iXVfAVli3Lq8iWGBIx NhrHvFXUHfFsd6G+tTxzEm+Hq6eLjhXUBRqSU/wmhqTo X-Google-Smtp-Source: APXvYqwfi4DvB+YQ5g5k2zyR47stVcQTFeOH1tIlHyZHWOfZ6pFr/X26PysrBDhI6Eik8GuxgCKmucFhMlsy8SVISOE= X-Received: by 2002:a24:2812:: with SMTP id h18mr264102ith.173.1552595918071; Thu, 14 Mar 2019 13:38:38 -0700 (PDT) MIME-Version: 1.0 References: <155255732161.2699.16055637076396529424@ietfa.amsl.com> In-Reply-To: <155255732161.2699.16055637076396529424@ietfa.amsl.com> From: Kurt Andersen Date: Thu, 14 Mar 2019 13:38:02 -0700 Message-ID: To: =?UTF-8?Q?Martin_D=C3=BCrst?= Cc: i18ndir@ietf.org, "dmarc@ietf.org" , draft-ietf-dmarc-eaiauth.all@ietf.org, IETF discussion list Content-Type: multipart/alternative; boundary="0000000000002d69ac058413e8c4" Archived-At: Subject: Re: [dmarc-ietf] I18ndir last call review of draft-ietf-dmarc-eaiauth-03 X-BeenThere: dmarc@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Domain-based Message Authentication, Reporting, and Compliance \(DMARC\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 14 Mar 2019 20:38:53 -0000 --0000000000002d69ac058413e8c4 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Replying to one question posed below. Eliding the other content... On Thu, Mar 14, 2019 at 2:55 AM Martin D=C3=BCrst via Datatracker < noreply@ietf.org> wrote: > Reviewer: Martin D=C3=BCrst > Review result: Ready with Issues > > I am the assigned Internationalization Directorate (i18ndir) reviewer for > this > draft. Harald Alvestrand and Pete Resnik contributed to this review. > > > > Major/intermediate issues: > =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D > > The Abstract mentions the Authentication-Results header field, but the > text doesn't. > > Section 4, %{s} and %{l} macros in SPF: The draft says that these cannot > be used for local parts that contain non-ASCII characters. This may be > enough for this draft, but is this a problem that should be fixed in the > longer term? How widely are %{s} and %{l} macros used currently? > Based on a dataset that is currently a couple of years old, surveying about 12M domains that were in current use at that time, there were 75 using the %{s} macro and 139 using %{l}. So I think it's a safe generalization to say that they are not widely used. From a cursory inspection, it appears that the general use case is for logging anomalies through query records employing the "exists" SPF mechanism. --Kurt Andersen --0000000000002d69ac058413e8c4 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Replying to one question posed below. Eliding the oth= er content...

On Thu, Mar 14, 2019 at 2:55 AM Martin D=C3=BCrst via Datatrac= ker <noreply@ietf.org> wrote:=
Reviewer: Marti= n D=C3=BCrst
Review result: Ready with Issues

I am the assigned Internationalization Directorate (i18ndir) reviewer for t= his
draft. Harald Alvestrand and Pete Resnik contributed to this review.
<elided>=C2=A0

Major/intermediate issues:
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=

The Abstract mentions the Authentication-Results header field, but the
text doesn't.

Section 4, %{s} and %{l} macros in SPF: The draft says that these cannot be used for local parts that contain non-ASCII characters. This may be
enough for this draft, but is this a problem that should be fixed in the longer term? How widely are %{s} and %{l} macros used currently?

Based on a dataset that is currently a couple of = years old, surveying about 12M domains that were in current use at that tim= e, there were 75 using the %{s} macro and 139 using %{l}. So I think it'= ;s a safe generalization to say that they are not widely used. From a curso= ry inspection, it appears that the general use case is for logging anomalie= s through query records employing the "exists" SPF mechanism.

--Kurt Andersen
--0000000000002d69ac058413e8c4-- From btv1==978177adc24==fosterd@bayviewphysicians.com Sat Mar 16 05:56:30 2019 Return-Path: X-Original-To: dmarc@ietfa.amsl.com Delivered-To: dmarc@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D7F1D1274D0 for ; Sat, 16 Mar 2019 05:56:30 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2 X-Spam-Level: X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=bayviewphysicians.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id EUCMp0Eno7cP for ; Sat, 16 Mar 2019 05:56:28 -0700 (PDT) Received: from mail.bayviewphysicians.com (mail.bayviewphysicians.com [216.54.111.133]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 789E01200B3 for ; Sat, 16 Mar 2019 05:56:28 -0700 (PDT) X-ASG-Debug-ID: 1552740986-0990577634cb480001-K2EkT1 Received: from webmail.bayviewphysicians.com (webmail.bayviewphysicians.com [192.168.1.49]) by mail.bayviewphysicians.com with ESMTP id MFCAFUDNH99gbMZg (version=TLSv1.2 cipher=ECDHE-RSA-AES256-SHA384 bits=256 verify=NO) for ; Sat, 16 Mar 2019 08:56:26 -0400 (EDT) X-Barracuda-Envelope-From: fosterd@bayviewphysicians.com X-Barracuda-RBL-Trusted-Forwarder: 192.168.1.49 X-ASG-Whitelist: Client X-SmarterMail-Authenticated-As: fosterd@bayviewphysicians.com DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=bayviewphysicians.com; s=s1025; h= content-type:mime-version:message-id:reply-to:date:subject:to:from; bh=yFePpIuNv21+jPT6YrReIDaw2uzc40B7eTQ6EAoItAU=; b=gU+nrOJAAoIAHmYX4d+knG4vfhHli9OW/IXut4D8Ibe13PlfhsWtOsJQS38qsqxGs uGJhNnlpcsV3ITAtkwAuX5OhaBqCm21cQYl1Hm4YmyzhwPaLCmvq763EqQjeTfDt8 46FguNlGEkLyecXVnzQKtY2o0QihHGGUg735NITac= Received: by webmail.bayviewphysicians.com via HTTP; Sat, 16 Mar 2019 08:56:20 -0400 From: "Douglas E. Foster" To: Date: Sat, 16 Mar 2019 08:56:20 -0400 X-ASG-Orig-Subj: Email security beyond DMARC? Reply-To: fosterd@bayviewphysicians.com Message-ID: <1dc451a973a8443a87d37b6e5c41fe38@bayviewphysicians.com> MIME-Version: 1.0 Content-Type: multipart/alternative; boundary=bb0233355d094548a3edd241372a88d1 X-Originating-IP: [192.168.1.239] X-Exim-Id: 1dc451a973a8443a87d37b6e5c41fe38 X-Barracuda-Connect: webmail.bayviewphysicians.com[192.168.1.49] X-Barracuda-Start-Time: 1552740986 X-Barracuda-Encrypted: ECDHE-RSA-AES256-SHA384 X-Barracuda-URL: https://mail.bayviewphysicians.com:443/cgi-mod/mark.cgi X-Barracuda-BRTS-Status: 1 X-Virus-Scanned: by bsmtpd at bayviewphysicians.com X-Barracuda-Scan-Msg-Size: 2436 Archived-At: Subject: [dmarc-ietf] Email security beyond DMARC? X-BeenThere: dmarc@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Domain-based Message Authentication, Reporting, and Compliance \(DMARC\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 16 Mar 2019 13:18:08 -0000 This is a multipart message in MIME format. --bb0233355d094548a3edd241372a88d1 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit I tried to understand what IETF is doing about email security, and this working group seems to be the only surviving effort. Based on the index, the groups attention is focused on polishing the existing DMARC implementaton rather than plowing new territory. Given the devastating effect of WannaCry and the success of other email-based attacks, I think our work is far from finished. DMARC / DKIM / SPF rely entirely on sender participation. Too few legitimate senders are implementing these measures in the manner that was envisioned, and too few , and too many spam filters fail to use these tools fully. DMARC represents a powerful concept which can be applied by the receiver, with adjustments, in ways that liberates the receiver from dependency on legitimate senders becoming fearless. I can articulate how that could be done, but I do not know how to start that discussion appropriately. Doug Foster --bb0233355d094548a3edd241372a88d1 Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable =
I tried to understand what IETF is doing about email security, and thi= s working group seems to be the only surviving effort.   Bas= ed on the index, the groups attention is focused on polishing the existing = DMARC implementaton rather than plowing new territory.   Given th= e devastating effect of WannaCry and the success of other email-based attac= ks, I think our work is far from finished.   
 
 
DMARC / DKIM / SPF rely entirely on sender participation.   = Too few legitimate senders are implementing these measures in the manner th= at was envisioned, and too few , and too many spam filters fail to use thes= e tools fully.
 
DMARC represents a powerful concept which can be applied by the receiv= er, with adjustments, in ways that liberates the receiver from dependency o= n legitimate senders becoming fearless.   I can articulate h= ow that could be done, but I do not know how to start that discussion appro= priately.
 
Doug Foster
 
 
 --bb0233355d094548a3edd241372a88d1-- From nobody Sat Mar 16 09:59:21 2019 Return-Path: X-Original-To: dmarc@ietfa.amsl.com Delivered-To: dmarc@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E13EE1200D7 for ; Sat, 16 Mar 2019 09:59:19 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.001 X-Spam-Level: X-Spam-Status: No, score=-2.001 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=tnetconsulting.net Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id mQP0u4LqqtoR for ; Sat, 16 Mar 2019 09:59:18 -0700 (PDT) Received: from tncsrv06.tnetconsulting.net (tncsrv06.tnetconsulting.net [IPv6:2600:3c00:e000:1e9::8849]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E8E00126DFA for ; Sat, 16 Mar 2019 09:59:17 -0700 (PDT) Received: from Contact-TNet-Consulting-Abuse-for-assistance by tncsrv06.tnetconsulting.net (8.15.2/8.15.2/Debian-3) with ESMTPSA id x2GGxFYI004194 (version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128 verify=NO) for ; Sat, 16 Mar 2019 11:59:17 -0500 ARC-Filter: OpenARC Filter v0.1.0 tncsrv06.tnetconsulting.net x2GGxFYI004194 Authentication-Results: tncsrv06.tnetconsulting.net; arc=none header.d=tnetconsulting.net ARC-Seal: i=1; a=rsa-sha256; d=tnetconsulting.net; s=2015; t=1552755557; cv=none; b=14M9kw6mxPqcUquIXRdPdn2TWWSk75AxMQYVUAM7gcA2SZOKDcd7hOG5oNQk0lTUQVocRBkcEUHA8cjbna+2duLmYnIvHAv1mzXcbMLsRSX67D4FUoX06im9bzD1gNwLGtbLWFx7rB3iHULBprOz60AqSvTA5iqTYocha2YgdnQ= ARC-Message-Signature: i=1; a=rsa-sha256; d=tnetconsulting.net; s=2015; t=1552755557; c=relaxed/simple; bh=u8OF9cgaxJWFOWCsw3NV61XV6oMwUCyYQT8zxKKqBM4=; h=DKIM-Signature:Subject:To:From:Message-ID:Date:User-Agent: MIME-Version:Content-Type; b=uVD2erzN/1uV8q9ACHYEAV/S7WhqYt2m0DojfkL2VCDsjvHK8IKXKn6Y2KR8ZOmbi2YHy1cJfibtVKv/hhIdZ47quZY8VgotHMQIBXvAk1xUSZgP91LWWAL8rTVE/6U3fK7Cr6T1LOctFIAdfJD5rsXckgE0DFYTP4VNL2C4TWA= ARC-Authentication-Results: i=1; tncsrv06.tnetconsulting.net; none DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=tnetconsulting.net; s=2019; t=1552755557; bh=u8OF9cgaxJWFOWCsw3NV61XV6oMwUCyYQT8zxKKqBM4=; h=Subject:To:References:From:Message-ID:Date:User-Agent: MIME-Version:In-Reply-To:Content-Type:Cc:Content-Disposition: Content-Language:Content-Transfer-Encoding:Content-Type:Date:From: In-Reply-To:Message-ID:MIME-Version:References:Reply-To: Resent-Date:Resent-From:Resent-To:Resent-Cc:Sender:Subject:To: User-Agent; b=WgZd4InxhCKnc3/SEkK36ExtuxPP8muuBf1JP+MlM3lIRNNAw3/VZu7PWbWLKkF96 OryCvUIzwQma4nkwsoiz2IPG8ZlUvpe5ZmOwD1LPiHvH2Xl4iDZIXdpnjTiyoVkEp8 PjCSRpqCdk5MtyQ+avWFqfxYYEK5kHi7E2p1FT7o= To: dmarc@ietf.org References: <1dc451a973a8443a87d37b6e5c41fe38@bayviewphysicians.com> From: Grant Taylor Organization: TNet Consulting Message-ID: Date: Sat, 16 Mar 2019 10:59:26 -0600 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Thunderbird/60.4.0 MIME-Version: 1.0 In-Reply-To: <1dc451a973a8443a87d37b6e5c41fe38@bayviewphysicians.com> Content-Type: multipart/signed; protocol="application/pkcs7-signature"; micalg=sha-256; boundary="------------ms050703040800090306070805" Archived-At: Subject: Re: [dmarc-ietf] Email security beyond DMARC? X-BeenThere: dmarc@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Domain-based Message Authentication, Reporting, and Compliance \(DMARC\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 16 Mar 2019 16:59:20 -0000 This is a cryptographically signed message in MIME format. --------------ms050703040800090306070805 Content-Type: text/plain; charset=windows-1252; format=flowed Content-Language: en-US Content-Transfer-Encoding: quoted-printable On 3/16/19 6:56 AM, Douglas E. Foster wrote: > I tried to understand what IETF is doing about email security, and this= =20 > working group seems to be the only=A0surviving effort.=A0 =A0Based on t= he=20 > index, the groups attention is focused on polishing the existing DMARC = > implementaton rather than plowing new territory.=A0 =A0Given the devast= ating=20 > effect of WannaCry and the success of other email-based attacks, I thin= k=20 > our work is far from finished. I can understand why you think there is more work to be done about email = security. However I don't know that this, DMARC, group is the best=20 location to push for it. I don't know what is left to do with DMARC, other than refining=97or=20 polishing as you said=97needs to be done. I'm not saying that there isn'= t=20 anything left to do, just that I'm ignorant of what that might be.=20 Please share suggestions if you have any. I also think it's somewhat unfair to imply that DMARC, and other email=20 protection technologies, don't protect email to the desired level,=20 *especially* when people don't /properly/ utilize said technology. I am = willing to accept that said technologies may be too difficult for mass=20 adoption. I do believe that SPF, DKIM, and DMARC are capable of protecting email=20 when they are used /properly/. There a numerous other technologies that have been developed in the last = 100 years that help protect against one form of problem or another. Yet = these technologies, some simple to use, don't get utilized like they=20 should. Some examples that come to mind are the seat belt in cars,=20 HTTPS encryption on web servers, IPsec, even S/MIME encryption for email = comes to mind. Sure, some of these technologies need some help=20 initially configuring. But almost all of them are simple to use /after/ = they have been configured. Yet, all of them are under utilized. I think that this pattern says something about humans choosing to not=20 use technology, even when a viable solution for the problem at hand exist= s. > DMARC / DKIM / SPF rely entirely on sender participation.=A0 =A0Too few= =20 > legitimate senders are implementing these measures in the manner that=20 > was envisioned, and too few , and too many spam filters fail to use=20 > these tools fully. IMHO, the execution of a technology is independent of the viability of=20 said technology. Unless it is an indication of a symptomatic problem=20 with said technology. > DMARC represents a powerful concept which can be applied by the=20 > receiver, with adjustments, in ways that liberates the receiver from=20 > dependency on legitimate=A0senders becoming fearless. I am curious to learn what you are talking about. > I can articulate how that could be done, but I do not know how to start= =20 > that discussion appropriately. I don't know what the proper process is. But given how you are=20 referencing DMARC, I'm guessing that you're not completely out of the=20 ball park by bringing it up on this mailing list. --=20 Grant. . . . unix || die --------------ms050703040800090306070805 Content-Type: application/pkcs7-signature; name="smime.p7s" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="smime.p7s" Content-Description: S/MIME Cryptographic Signature MIAGCSqGSIb3DQEHAqCAMIACAQExDzANBglghkgBZQMEAgEFADCABgkqhkiG9w0BBwEAAKCC Cy4wggVAMIIEKKADAgECAhEA01fiRe1k2R6LEQCcImIMYTANBgkqhkiG9w0BAQsFADCBlzEL MAkGA1UEBhMCR0IxGzAZBgNVBAgTEkdyZWF0ZXIgTWFuY2hlc3RlcjEQMA4GA1UEBxMHU2Fs Zm9yZDEaMBgGA1UEChMRQ09NT0RPIENBIExpbWl0ZWQxPTA7BgNVBAMTNENPTU9ETyBSU0Eg Q2xpZW50IEF1dGhlbnRpY2F0aW9uIGFuZCBTZWN1cmUgRW1haWwgQ0EwHhcNMTgxMTE4MDAw MDAwWhcNMTkxMTE4MjM1OTU5WjArMSkwJwYJKoZIhvcNAQkBFhpndGF5bG9yQHRuZXRjb25z dWx0aW5nLm5ldDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBANgOhvncDgc4KAlD +pyhFpw6wCfeERlSOAXowjdTjlOR2zcIgzL0TM9A+hkSv2wsVh6fn6VvHGxKrLemReiGd7fQ 15Y9J/pxKOmShkw9DDtFsa18ozydp95X2IuzY8Z2JukxouqrfpSH4fOrrHLkOgvlFG4xaQHW 0KB8xUP5DFWyyZM5QCdq278GSJ5pUd+B6qmzwHESNF6syyvgLppXkFatLTz8pWf6eEngDA0Y 3fQ3Q2gnbgpryRhVQMa1GjQJ7LDroUGQhX2zBWePW+sShiTwo8jADYKsbgSGtvZ/42A8zxyg s9YZMHQoCeeuLNuX/MBp9rCTl5nlzP3jGWQTC5ECAwEAAaOCAfAwggHsMB8GA1UdIwQYMBaA FIKvbIz4xf6WYXzoHz0rcUhexIvAMB0GA1UdDgQWBBQg2PeEKxHWd4FaHe0T+gqAOWkC1jAO BgNVHQ8BAf8EBAMCBaAwDAYDVR0TAQH/BAIwADAgBgNVHSUEGTAXBggrBgEFBQcDBAYLKwYB BAGyMQEDBQIwEQYJYIZIAYb4QgEBBAQDAgUgMEYGA1UdIAQ/MD0wOwYMKwYBBAGyMQECAQEB MCswKQYIKwYBBQUHAgEWHWh0dHBzOi8vc2VjdXJlLmNvbW9kby5uZXQvQ1BTMFoGA1UdHwRT MFEwT6BNoEuGSWh0dHA6Ly9jcmwuY29tb2RvY2EuY29tL0NPTU9ET1JTQUNsaWVudEF1dGhl bnRpY2F0aW9uYW5kU2VjdXJlRW1haWxDQS5jcmwwgYsGCCsGAQUFBwEBBH8wfTBVBggrBgEF BQcwAoZJaHR0cDovL2NydC5jb21vZG9jYS5jb20vQ09NT0RPUlNBQ2xpZW50QXV0aGVudGlj YXRpb25hbmRTZWN1cmVFbWFpbENBLmNydDAkBggrBgEFBQcwAYYYaHR0cDovL29jc3AuY29t b2RvY2EuY29tMCUGA1UdEQQeMByBGmd0YXlsb3JAdG5ldGNvbnN1bHRpbmcubmV0MA0GCSqG SIb3DQEBCwUAA4IBAQCPxlHHG57PA5GUYlQuC8VHB7TcMQeEJKnB/S+bamyrck4vpIEaF9rG EM+OnAQsJzSkSVHD2707jxh1ng0jrsH2+F9qNGTpCksXo0fMqm4tf28Ag092+CZ5sfdjVZ4E ELG4xNhFZF9/aFaAY7RIeJ89Vvn6s6BnKsaAPjVB/sO+5gIm0BIeoVauq71ue6jS7o2Jn94o BuAhjuh34gk/Wxzcku96MLmEwCY63GWWKVRYbqrDhqROmnQPdyrDYrU8uD0vb4SAdpSKfRqO DrerlQgX3euyYqcnVJSA8Ec+NdiJrGKXW76C7DrTi7IxDgjIHL+DPyFgtj+p6wYOEkYJwKtp MIIF5jCCA86gAwIBAgIQapvhODv/K2ufAdXZuKdSVjANBgkqhkiG9w0BAQwFADCBhTELMAkG A1UEBhMCR0IxGzAZBgNVBAgTEkdyZWF0ZXIgTWFuY2hlc3RlcjEQMA4GA1UEBxMHU2FsZm9y ZDEaMBgGA1UEChMRQ09NT0RPIENBIExpbWl0ZWQxKzApBgNVBAMTIkNPTU9ETyBSU0EgQ2Vy dGlmaWNhdGlvbiBBdXRob3JpdHkwHhcNMTMwMTEwMDAwMDAwWhcNMjgwMTA5MjM1OTU5WjCB lzELMAkGA1UEBhMCR0IxGzAZBgNVBAgTEkdyZWF0ZXIgTWFuY2hlc3RlcjEQMA4GA1UEBxMH U2FsZm9yZDEaMBgGA1UEChMRQ09NT0RPIENBIExpbWl0ZWQxPTA7BgNVBAMTNENPTU9ETyBS U0EgQ2xpZW50IEF1dGhlbnRpY2F0aW9uIGFuZCBTZWN1cmUgRW1haWwgQ0EwggEiMA0GCSqG SIb3DQEBAQUAA4IBDwAwggEKAoIBAQC+s55XrCh2dUAWxzgDmNPGGHYhUPMleQtMtaDRfTpY PpynMS6n9jR22YRq2tA9NEjk6vW7rN/5sYFLIP1of3l0NKZ6fLWfF2VgJ5cijKYy/qlAckY1 wgOkUMgzKlWlVJGyK+UlNEQ1/5ErCsHq9x9aU/x1KwTdF/LCrT03Rl/FwFrf1XTCwa2QZYL5 5AqLPikFlgqOtzk06kb2qvGlnHJvijjI03BOrNpo+kZGpcHsgyO1/u1OZTaOo8wvEU17VVeP 1cHWse9tGKTDyUGg2hJZjrqck39UIm/nKbpDSZ0JsMoIw/JtOOg0JC56VzQgBo7ictReTQE5 LFLG3yQK+xS1AgMBAAGjggE8MIIBODAfBgNVHSMEGDAWgBS7r34CPfqm8TyEjq3uOJjs2TIy 1DAdBgNVHQ4EFgQUgq9sjPjF/pZhfOgfPStxSF7Ei8AwDgYDVR0PAQH/BAQDAgGGMBIGA1Ud EwEB/wQIMAYBAf8CAQAwEQYDVR0gBAowCDAGBgRVHSAAMEwGA1UdHwRFMEMwQaA/oD2GO2h0 dHA6Ly9jcmwuY29tb2RvY2EuY29tL0NPTU9ET1JTQUNlcnRpZmljYXRpb25BdXRob3JpdHku Y3JsMHEGCCsGAQUFBwEBBGUwYzA7BggrBgEFBQcwAoYvaHR0cDovL2NydC5jb21vZG9jYS5j b20vQ09NT0RPUlNBQWRkVHJ1c3RDQS5jcnQwJAYIKwYBBQUHMAGGGGh0dHA6Ly9vY3NwLmNv bW9kb2NhLmNvbTANBgkqhkiG9w0BAQwFAAOCAgEAeFyygSg0TzzuX1bOn5dW7I+iaxf28/ZJ CAbU2C81zd9A/tNx4+jsQgwRGiHjZrAYayZrrm78hOx7aEpkfNPQIHGG6Fvq3EzWf/Lvx7/h k6zSPwIal9v5IkDcZoFD7f3iT7PdkHJY9B51csvU50rxpEg1OyOT8fk2zvvPBuM4qQNqbGWl nhMpIMwpWZT89RY0wpJO+2V6eXEGGHsROs3njeP9DqqqAJaBa4wBeKOdGCWn1/Jp2oY6dyNm NppI4ZNMUH4Tam85S1j6E95u4+1Nuru84OrMIzqvISE2HN/56ebTOWlcrurffade2022O/tU U1gb4jfWCcyvB8czm12FgX/y/lRjmDbEA08QJNB2729Y+io1IYO3ztveBdvUCIYZojTq/OCR 6MvnzS6X72HP0PRLRTiOSEmIDsS5N5w/8IW1Hva5hEFy6fDAfd9yI+O+IMMAj1KcL/Zo9jzJ 16HO5m60ttl1Enk8MQkz/W3JlHaeI5iKFn4UJu1/cP2YHXYPiWf2JyBzsLBrGk1II+3yL8ao rYew6CQvdVifC3HtwlSam9V1niiCfOBe2C12TdKGu05LWIA3ZkFcWJGaNXOZ6Ggyh/TqvXG5 v7zmEVDNXFnHn9tFpMpOUvxhcsjycBtH0dZ0WrNw6gH+HF8TIhCnH3+zzWuDN0Rk6h9KVkfK ehIxggQ4MIIENAIBATCBrTCBlzELMAkGA1UEBhMCR0IxGzAZBgNVBAgTEkdyZWF0ZXIgTWFu Y2hlc3RlcjEQMA4GA1UEBxMHU2FsZm9yZDEaMBgGA1UEChMRQ09NT0RPIENBIExpbWl0ZWQx PTA7BgNVBAMTNENPTU9ETyBSU0EgQ2xpZW50IEF1dGhlbnRpY2F0aW9uIGFuZCBTZWN1cmUg RW1haWwgQ0ECEQDTV+JF7WTZHosRAJwiYgxhMA0GCWCGSAFlAwQCAQUAoIICWzAYBgkqhkiG 9w0BCQMxCwYJKoZIhvcNAQcBMBwGCSqGSIb3DQEJBTEPFw0xOTAzMTYxNjU5MjZaMC8GCSqG SIb3DQEJBDEiBCALlJh4JIB+WGarfnHyYOGnyh+S5EMC9XpJ/kbVigMgZzBsBgkqhkiG9w0B CQ8xXzBdMAsGCWCGSAFlAwQBKjALBglghkgBZQMEAQIwCgYIKoZIhvcNAwcwDgYIKoZIhvcN AwICAgCAMA0GCCqGSIb3DQMCAgFAMAcGBSsOAwIHMA0GCCqGSIb3DQMCAgEoMIG+BgkrBgEE AYI3EAQxgbAwga0wgZcxCzAJBgNVBAYTAkdCMRswGQYDVQQIExJHcmVhdGVyIE1hbmNoZXN0 ZXIxEDAOBgNVBAcTB1NhbGZvcmQxGjAYBgNVBAoTEUNPTU9ETyBDQSBMaW1pdGVkMT0wOwYD VQQDEzRDT01PRE8gUlNBIENsaWVudCBBdXRoZW50aWNhdGlvbiBhbmQgU2VjdXJlIEVtYWls IENBAhEA01fiRe1k2R6LEQCcImIMYTCBwAYLKoZIhvcNAQkQAgsxgbCgga0wgZcxCzAJBgNV BAYTAkdCMRswGQYDVQQIExJHcmVhdGVyIE1hbmNoZXN0ZXIxEDAOBgNVBAcTB1NhbGZvcmQx GjAYBgNVBAoTEUNPTU9ETyBDQSBMaW1pdGVkMT0wOwYDVQQDEzRDT01PRE8gUlNBIENsaWVu dCBBdXRoZW50aWNhdGlvbiBhbmQgU2VjdXJlIEVtYWlsIENBAhEA01fiRe1k2R6LEQCcImIM YTANBgkqhkiG9w0BAQEFAASCAQCtN4wlVDL9II5AFTffEhvI4vrKF4vNQZvIKXVwRrDUwOPg SMt8ON6ZsjI78z/PSB4GXLNk8S/5jpcP8+CnGUQ8y/ilg06MFErCfQNOLzh2UT0yKs7Vhq69 8h4fxn1kK2lp2hBfr8NFci0SzjVeyQs7qSiwy1gxyQe0mA0SnYEchyoFwdlPcJDKrJrFLYJ9 ynZobxAA+pn9rjqC4Cs3pI4qPZ2hErk2hkKBHOIxh9xVAaAhja3OAnUXXyfPZs03JCCn27Bv 6xASJP0SgZgICmMrV6tK2fx1eiXy9oLywND/9khw0Y9Z6Az3FkbVZ2LR8YnjN4KYwug+zetN UWR2nUnOAAAAAAAA --------------ms050703040800090306070805-- From nobody Sat Mar 16 16:04:29 2019 Return-Path: X-Original-To: dmarc@ietfa.amsl.com Delivered-To: dmarc@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D96FA130DF6 for ; Sat, 16 Mar 2019 16:04:27 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2 X-Spam-Level: X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id nPiu-DxW5nuX for ; Sat, 16 Mar 2019 16:04:26 -0700 (PDT) Received: from mail-ot1-x332.google.com (mail-ot1-x332.google.com [IPv6:2607:f8b0:4864:20::332]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id ED3CE124B0C for ; Sat, 16 Mar 2019 16:04:25 -0700 (PDT) Received: by mail-ot1-x332.google.com with SMTP id v62so11461877otb.3 for ; Sat, 16 Mar 2019 16:04:25 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=subject:to:references:from:message-id:date:user-agent:mime-version :in-reply-to:content-language:content-transfer-encoding; bh=LdswIZAMDWhkF3sKHIRmGqfLXGbqx4WRyYdlGxrWU2M=; b=IohwmXzIqav0ZVbWsG7anrHAGlZS2+xRxVr9itQY+88B3MCqLNKzeCwppPUvNbur4Z hqTg7kWJCFax4OkWvFc0k0BrpDIj5En6+W62BFlM6DRJ6HDMLP9uJAF9h89CqAj2K0+v Efsct1pjEsQ/Ziy5vWmyOZsRlvXfVxDmJlEFIci86SjMABoCr/CDr3/Hs4qeKGip6euZ CQ/V44C/+6yW6SAFADB1MuKZft9dAqd11Ta2cf+z6N0VpFE920Q4wZyqCkhESrL+GWa1 //b5pOOY702jD54o7q/COdZwEtoO8WxkQy59Obfob+2q8dUS1u3IpwpPphKfi8ADrb0w PgQw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:subject:to:references:from:message-id:date :user-agent:mime-version:in-reply-to:content-language :content-transfer-encoding; bh=LdswIZAMDWhkF3sKHIRmGqfLXGbqx4WRyYdlGxrWU2M=; b=dINv364KJuH7ZjX1+EiDZr1nBfO0SS38toZ9wll+hBqvTGUx9P6saPoRmHLPgdekuy lGlV+3y7tE2vLgGqm0ntXFRrBLeVNBQWhdSI/vlKKYwwrqI8jlyn+JG19zDh3KELo+ri qmZ2czSjQNx8h83MlCQNQ/SDc+A2ZHQI1o8ScS417dTi+5AtCtD9RXH+q/85KmpSOlUX xUVGfCVnxWuEF5MJbwvqrQCi2mA+9uy26Ulc9Kx/sLe/GsTSEEO3ZeKOoGNtPVVo+rd3 tpAvjNxWFI6/qhZBwHrab/taBUfTslEGXqublRtX7JUI4whwEroyvku+j88VIZj55urV VVsg== X-Gm-Message-State: APjAAAXYHALdv9NHRS5Lj2YMb8TV2N4WKYHSuoSHmGbAdtYoP5F47aCH pO0IdRCY2SAx936aphPY3ImntKo0 X-Google-Smtp-Source: APXvYqwJXpaMirybVbMJghQVrj5WK2HP1KnG0uOlcB7QbJCH7l+gPEB9ND51BSoQt7jpENgdFQj22g== X-Received: by 2002:a9d:7404:: with SMTP id n4mr6647311otk.54.1552777464661; Sat, 16 Mar 2019 16:04:24 -0700 (PDT) Received: from ?IPv6:2600:1700:a3a0:4c80:7c1c:e4c:eb22:22e4? ([2600:1700:a3a0:4c80:7c1c:e4c:eb22:22e4]) by smtp.gmail.com with ESMTPSA id o16sm2517880ote.38.2019.03.16.16.04.22 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Sat, 16 Mar 2019 16:04:23 -0700 (PDT) To: fosterd@bayviewphysicians.com, dmarc@ietf.org References: <1dc451a973a8443a87d37b6e5c41fe38@bayviewphysicians.com> From: Dave Crocker Message-ID: <04689446-111e-691f-dd34-0a62353ffb92@gmail.com> Date: Sat, 16 Mar 2019 16:04:17 -0700 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:60.0) Gecko/20100101 Thunderbird/60.5.3 MIME-Version: 1.0 In-Reply-To: <1dc451a973a8443a87d37b6e5c41fe38@bayviewphysicians.com> Content-Type: text/plain; charset=windows-1252; format=flowed Content-Language: en-US Content-Transfer-Encoding: 8bit Archived-At: Subject: Re: [dmarc-ietf] Email security beyond DMARC? X-BeenThere: dmarc@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Domain-based Message Authentication, Reporting, and Compliance \(DMARC\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 16 Mar 2019 23:04:28 -0000 On 3/16/2019 5:56 AM, Douglas E. Foster wrote: > DMARC represents a powerful concept which can be applied by the > receiver, with adjustments, in ways that liberates the receiver from > dependency on legitimatesenders Since use of DMARC begins with a record publish by the author domain owner, I can't imagine how you think DMARC can be used without dependence on legitimate senders. Nor can I guess what protections or scenarios you have in mind. d -- Dave Crocker Brandenburg InternetWorking bbiw.net From nobody Mon Mar 18 05:58:11 2019 Return-Path: X-Original-To: dmarc@ietfa.amsl.com Delivered-To: dmarc@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D5F92131137 for ; Mon, 18 Mar 2019 05:57:58 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_NONE=-0.0001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id DRyXDFlNARNN for ; Mon, 18 Mar 2019 05:57:56 -0700 (PDT) Received: from softronics.hoeneisen.ch (softronics.hoeneisen.ch [62.2.86.178]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 34E9813110F for ; Mon, 18 Mar 2019 05:57:56 -0700 (PDT) Received: from localhost ([127.0.0.1]) by softronics.hoeneisen.ch with esmtp (Exim 4.86_2) (envelope-from ) id 1h5rpy-0001RP-29; Mon, 18 Mar 2019 13:57:54 +0100 Date: Mon, 18 Mar 2019 13:57:54 +0100 (CET) From: Bernie Hoeneisen X-X-Sender: bhoeneis@softronics.hoeneisen.ch To: "Douglas E. Foster" cc: dmarc@ietf.org In-Reply-To: <1dc451a973a8443a87d37b6e5c41fe38@bayviewphysicians.com> Message-ID: References: <1dc451a973a8443a87d37b6e5c41fe38@bayviewphysicians.com> User-Agent: Alpine 2.20 (DEB 67 2015-01-07) MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII; format=flowed X-SA-Exim-Connect-IP: 127.0.0.1 X-SA-Exim-Mail-From: bernie@ietf.hoeneisen.ch X-SA-Exim-Scanned: No (on softronics.hoeneisen.ch); SAEximRunCond expanded to false Archived-At: Subject: Re: [dmarc-ietf] Email security beyond DMARC? X-BeenThere: dmarc@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Domain-based Message Authentication, Reporting, and Compliance \(DMARC\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 18 Mar 2019 12:58:10 -0000 Hi Doug On Sat, 16 Mar 2019, Douglas E. Foster wrote: > I tried to understand what IETF is doing about email security, and this > working group seems to be the only surviving effort. Based on the > index, the groups attention is focused on polishing the existing DMARC > implementaton rather than plowing new territory. Given the devastating > effect of WannaCry and the success of other email-based attacks, I think > our work is far from finished. You may want to have a look on some upcoming work. We just started a new mailing list, which includes the topic of email security: MEDUP -- Missing Elements for Decentralized and Usable Privacy To subscribe: - https://www.ietf.org/mailman/listinfo/medup Please find more information on: - https://mailarchive.ietf.org/arch/msg/medup/mbrbhFekt_srXShzpCa4RiXgPbY - https://mailarchive.ietf.org/arch/msg/pearg/oBjgAwG3_eoR6tpLQGTE_9OggzQ The former also includes a list of Internet-Drafts describing the MEDUP challenges. Please be also informated that the LAMPS WG has requested a new work item on email header protection to be added to its charter. Hope that helps! Best, Bernie -- http://ucom.ch/ Modern Telephony Solutions and Tech Consulting for Internet Technology From mikedup84@gmail.com Mon Mar 18 12:48:59 2019 Return-Path: X-Original-To: dmarc@ietfa.amsl.com Delivered-To: dmarc@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8B4C413121A for ; Mon, 18 Mar 2019 12:48:59 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.749 X-Spam-Level: X-Spam-Status: No, score=-1.749 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_ENVFROM_END_DIGIT=0.25, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id LHoIviumgI4M for ; Mon, 18 Mar 2019 12:48:58 -0700 (PDT) Received: from mail-vs1-xe2d.google.com (mail-vs1-xe2d.google.com [IPv6:2607:f8b0:4864:20::e2d]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 4EEF913119D for ; Mon, 18 Mar 2019 12:48:58 -0700 (PDT) Received: by mail-vs1-xe2d.google.com with SMTP id g127so3185909vsd.6 for ; Mon, 18 Mar 2019 12:48:58 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:from:date:message-id:subject:to; bh=GAg3NFJuiJ7TpAYWGNZEL2iETq/tQI3H9h7mhMUgIpM=; b=T0LwJrqQz3LCDUGR8bSGl7htUqHil4QQWmRTVQlNFag1QSZYWiecG3KpAiaNkxlCIu tmRS2BSNS+QlB9GFoDwN3nWuhU/H8ipFZWxg1hg2bVzo0zZqMaGchSLCvLbBembgzkhP NoxfiqiNWjYd7ziJngxHxQ1v0+4MYPxL17zQ497iuCSodeb/eKojbpflXmLEqZAfNnJy SenSRuU4XqRzW38iyLxqbg6GRT9bN1PFM9zmHnqscR70Q4HUswq/hsWH9/xhyeB8MVya QrOUNxdPc9aAG+M5BkTdHryZTETPduaii0wOCws1DP9Ke80y6+nUkNfVnOGpwv09r4qJ 0frg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:from:date:message-id:subject:to; bh=GAg3NFJuiJ7TpAYWGNZEL2iETq/tQI3H9h7mhMUgIpM=; b=mvVrDyCeGtcLUuGPeXpnH7E52Gtv8/b12UPlVyovYY7r1t3z931aAnReMAMyoZUqae urT2xbYK+jPl6ckn7lte0x03JMUM6t2kmCMujQ9Xibbv36BPLGXV9Wix0ZKJraimX7Co UD1VKs99Zl5iw6dLdd6FKxE3OizdFPmAmdACnu2jwiZO5m1vvY9HeSnlMBYEOy97vdTf b/xHpd/OAmHsQGUIqFGr7t/5ggQJNqRBl3P/Go3X9FTpXBUSXtWox5AS1f6UNebfGwC1 44954ctWQyUETWY6Vw2okaqWHIt4+xiwgI9E/cI+pfJf3Xaotsee6roo3QKhsx4oCWge QttA== X-Gm-Message-State: APjAAAXn/HwAmYN98dhhR6zv4F4DCTfYGXdBOA4Fnff7n3wZQvpf5cM2 TDOGyStMBheRlDCg28KAba9Ku1051Fsy0BLoIAtRznQz X-Google-Smtp-Source: APXvYqydEk4l0nrM9wGVk+x2B+pow7PlGYdDzOXHNihtmh74K1UzDqH9mHPC+xuRG3CZLumjMVAsYEwwekGQECmUiss= X-Received: by 2002:a67:7684:: with SMTP id r126mr9673509vsc.219.1552938537027; Mon, 18 Mar 2019 12:48:57 -0700 (PDT) MIME-Version: 1.0 From: Michael Davis Date: Mon, 18 Mar 2019 14:48:41 -0500 Message-ID: To: dmarc@ietf.org Content-Type: multipart/alternative; boundary="000000000000db96d5058463adbd" Archived-At: Subject: [dmarc-ietf] p=reject X-BeenThere: dmarc@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Domain-based Message Authentication, Reporting, and Compliance \(DMARC\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 18 Mar 2019 19:58:08 -0000 --000000000000db96d5058463adbd Content-Type: text/plain; charset="UTF-8" If a sender's IP is in SPF, so SPF passes; and the applied DKIM signature is successfully decrypted, so DKIM passes; what good is checking alignment and rejecting a message? I have had Adobe and Cloudflare automated system emails rejected based on those senders' DMARC policy, after SPF and DKIM pass. These emails were regarding password resets and come from servers that do not equal the spoofed address domain. It would seem that if the sender is approved according to SPF and verified according to DKIM that alignment being a reason for rejection post authenticas is an exercise of absurdity. Please help me understand otherwise. --000000000000db96d5058463adbd Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
If a=C2=A0sender's IP is in SPF, so S= PF passes; and the applied DKIM signature is successfully=C2=A0decrypted, s= o DKIM passes; what good is checking alignment and rejecting a message? I h= ave had Adobe and Cloudflare automated system emails rejected based on thos= e senders' DMARC policy, after SPF and DKIM pass. These emails were reg= arding password resets and come from servers that do not equal the spoofed = address domain. It would seem that if the sender is approved according to S= PF and verified according to DKIM that alignment being a reason for rejecti= on=C2=A0post authenticas=C2=A0is an exercise of absurdity.=C2=A0

Please help me understand otherwise.=
--000000000000db96d5058463adbd-- From nobody Mon Mar 18 13:03:40 2019 Return-Path: X-Original-To: dmarc@ietfa.amsl.com Delivered-To: dmarc@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D68BC127987 for ; Mon, 18 Mar 2019 13:03:38 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2 X-Spam-Level: X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=agari.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id fC-BNs0KH8TN for ; Mon, 18 Mar 2019 13:03:35 -0700 (PDT) Received: from NAM04-BN3-obe.outbound.protection.outlook.com (mail-bn3nam04on070e.outbound.protection.outlook.com [IPv6:2a01:111:f400:fe4e::70e]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 8DB8D1200D7 for ; Mon, 18 Mar 2019 13:03:35 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=agari.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=r62ES1N0iDMcXfvdop978eamBdcN4vqwzlxuSgHw1vI=; b=F/e4Z2M5aNr76h4SRIN7F0bM5vOyTVYl7sAT6lWHXHV0flmvqAAMacShLTe41NxRGjuiHRAPT9YrZhgFdAQ9q+lvUu33dNALS2I5oblRTjpTAJez1ieOeVcGBguIlbY6iZx8hcP4Ae7UZeIIp4+WOC7E/1uQXZktQsORgGe79Os= Received: from MWHPR13MB0992.namprd13.prod.outlook.com (10.169.207.15) by MWHPR13MB1519.namprd13.prod.outlook.com (10.175.140.20) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.1709.16; Mon, 18 Mar 2019 20:03:32 +0000 Received: from MWHPR13MB0992.namprd13.prod.outlook.com ([fe80::b4e2:fe96:7e6c:9f2c]) by MWHPR13MB0992.namprd13.prod.outlook.com ([fe80::b4e2:fe96:7e6c:9f2c%5]) with mapi id 15.20.1709.015; Mon, 18 Mar 2019 20:03:32 +0000 From: Autumn Tyr-Salvia To: Michael Davis , "dmarc@ietf.org" Thread-Topic: [dmarc-ietf] p=reject Thread-Index: AQHU3cUK8XJViCOEn0aGmAy4ai3bgqYRzxK0 Date: Mon, 18 Mar 2019 20:03:32 +0000 Message-ID: References: In-Reply-To: Accept-Language: en-US Content-Language: en-US X-Mentions: mikedup84@gmail.com X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=atyrsalvia@agari.com; x-originating-ip: [50.227.133.34] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: 3a330a91-d6c2-4220-c59a-08d6abdccc0c x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(8989299)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(5600127)(711020)(4605104)(2017052603328)(7153060)(7193020); SRVR:MWHPR13MB1519; x-ms-traffictypediagnostic: MWHPR13MB1519: x-microsoft-antispam-prvs: x-forefront-prvs: 098076C36C x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(136003)(346002)(376002)(39850400004)(396003)(366004)(189003)(199004)(76176011)(316002)(14444005)(71200400001)(99286004)(186003)(26005)(478600001)(53546011)(102836004)(110136005)(6506007)(7696005)(19627405001)(256004)(105586002)(106356001)(105004)(66066001)(486006)(86362001)(14454004)(476003)(6246003)(71190400001)(25786009)(11346002)(6436002)(446003)(229853002)(8936002)(3846002)(8676002)(74316002)(2906002)(53936002)(33656002)(9686003)(54896002)(81156014)(97736004)(81166006)(68736007)(5660300002)(2501003)(7736002)(6116002)(55016002)(52536014); DIR:OUT; SFP:1102; SCL:1; SRVR:MWHPR13MB1519; H:MWHPR13MB0992.namprd13.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; MX:1; A:1; received-spf: None (protection.outlook.com: agari.com does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: BX1BobT1hlzfySmGhMpSDSZaZV4kEWMq6ouPk60s6z14WEceW40B490eGFnBIKal7uEKdeQKdLtjQWNaelphiGzOm5dljE/D9vUKdQ/bkvJZyxpabItkM9yGCwp7lln3ZgbZMHCICWCQs3P+gt+i7vXinONaRxUX9C8PeHl/31TqgfgnrTCXU3s40k8X/Juxb0xyl/x80BaEm1WGgC6+N4eTWCKbA8xss3DXJ7fgeDZ8O8SM0vljQsodKzMNKzKAaGf9Yi1xAohVFNp7iWh6YI5Ki59wLzSrD3MleizuxZDEDbIXGflHH8KGmIdzUpZvgEd4KGjsRfiuevqMh6dzlRIA8QJDsvuS3+Zrc6AppLQXx2AMGPjOg33UyfNcCBu085fYAU9/OBtDwSnNAvMDiN6Js/52/U/GVVEUMia+c5s= Content-Type: multipart/alternative; boundary="_000_MWHPR13MB09928A1B84F813030AAEBF52D7470MWHPR13MB0992namp_" MIME-Version: 1.0 X-OriginatorOrg: agari.com X-MS-Exchange-CrossTenant-Network-Message-Id: 3a330a91-d6c2-4220-c59a-08d6abdccc0c X-MS-Exchange-CrossTenant-originalarrivaltime: 18 Mar 2019 20:03:32.2606 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 05773123-385e-420d-844e-f01aee5e37ab X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-Transport-CrossTenantHeadersStamped: MWHPR13MB1519 Archived-At: Subject: Re: [dmarc-ietf] p=reject X-BeenThere: dmarc@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Domain-based Message Authentication, Reporting, and Compliance \(DMARC\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 18 Mar 2019 20:03:39 -0000 --_000_MWHPR13MB09928A1B84F813030AAEBF52D7470MWHPR13MB0992namp_ Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Hello Michael, Consider this scenario: Friendly From: @yourbank.com SMTP MAIL FROM: @spammer.ru DKIM d=3Dspammer.ru SPF gets checked at the SMTP MAIL FROM domain, and DKIM gets checked at the= d=3D domain. Either or both of these could pass authentication, but that w= ould not mean the message is legitimately from yourbank.com. DMARC was inte= nded to tie together the backend server information with the friendly From:= address to prevent abusive spoofing like this, which is very common. Thanks, Autumn Tyr-Salvia atyrsalvia@agari.com Agari Principal Customer Success Engineer ________________________________ From: dmarc on behalf of Michael Davis Sent: Monday, March 18, 2019 12:48 PM To: dmarc@ietf.org Subject: [dmarc-ietf] p=3Dreject If a sender's IP is in SPF, so SPF passes; and the applied DKIM signature i= s successfully decrypted, so DKIM passes; what good is checking alignment a= nd rejecting a message? I have had Adobe and Cloudflare automated system em= ails rejected based on those senders' DMARC policy, after SPF and DKIM pass= . These emails were regarding password resets and come from servers that do= not equal the spoofed address domain. It would seem that if the sender is = approved according to SPF and verified according to DKIM that alignment bei= ng a reason for rejection post authenticas is an exercise of absurdity. Please help me understand otherwise. --_000_MWHPR13MB09928A1B84F813030AAEBF52D7470MWHPR13MB0992namp_ Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable
Hello Michael,

Consider this scenario:

Friendly From: @yourbank.com
SMTP MAIL FROM: @spammer.ru
DKIM d=3Dspammer.ru

SPF gets checked at the SMTP MAIL FROM domain, and DKIM gets checked at the= d=3D domain. Either or both of these could pass authentication, but that w= ould not mean the message is legitimately from yourbank.com. DMARC was inte= nded to tie together the backend server information with the friendly From: address to prevent abusive spoofing li= ke this, which is very common.


Thanks,

Autumn Tyr-Salvia
atyrsalvia@agari.com
Agari Principal Customer Success Engineer

From: dmarc <dmarc-bounc= es@ietf.org> on behalf of Michael Davis <mikedup84@gmail.com>
Sent: Monday, March 18, 2019 12:48 PM
To: dmarc@ietf.org
Subject: [dmarc-ietf] p=3Dreject
 
If a sender's IP is in SPF, so SPF passes; and the ap= plied DKIM signature is successfully decrypted, so DKIM passes; what g= ood is checking alignment and rejecting a message? I have had Adobe and Clo= udflare automated system emails rejected based on those senders' DMARC policy, after SPF and DKIM pass. These emails were= regarding password resets and come from servers that do not equal the spoo= fed address domain. It would seem that if the sender is approved according = to SPF and verified according to DKIM that alignment being a reason for rejection post authenticas&nbs= p;is an exercise of absurdity. 

Please help me understand otherwise.
--_000_MWHPR13MB09928A1B84F813030AAEBF52D7470MWHPR13MB0992namp_-- From nobody Mon Mar 18 20:01:35 2019 Return-Path: X-Original-To: dmarc@ietfa.amsl.com Delivered-To: dmarc@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id DA765130F63 for ; Mon, 18 Mar 2019 20:01:32 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2 X-Spam-Level: X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HEADER_FROM_DIFFERENT_DOMAINS=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1536-bit key) header.d=iecc.com header.b=uMxgvK/T; dkim=pass (1536-bit key) header.d=taugh.com header.b=SxoxaX+R Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id o7HIuLkOM8EW for ; Mon, 18 Mar 2019 20:01:31 -0700 (PDT) Received: from gal.iecc.com (gal.iecc.com [IPv6:2001:470:1f07:1126:0:43:6f73:7461]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C64DD130F67 for ; Mon, 18 Mar 2019 20:01:30 -0700 (PDT) Received: (qmail 10000 invoked from network); 19 Mar 2019 03:01:28 -0000 DKIM-Signature: v=1; a=rsa-sha256; c=simple; d=iecc.com; h=date:message-id:from:to:cc:subject:in-reply-to:mime-version:content-type:content-transfer-encoding; s=270e.5c905b88.k1903; bh=RUF6A6w6CvS+MLQWY0gcvAPlUJruTsxJ1hpuY8U0ORQ=; b=uMxgvK/TF7qCjsASGnVOMuf8rkG69T/Unifm2UyiFC1pOiPPPHcmQcATaIpKhC+Fnef0KM1S8o4MPe/27/hRFbbRfw4aHVL1T4ES26yZMc3zuYTfNYPFwrqNwLlphCxPmE3AiUM/qO+fnafPZ0vecyrTlKIIwE6D0ZQ32HlQirJ7NgIRhLGjOLdSzoeqJOu/1dtF2SbcDJkXA2+fLhAoPBF0UYl2xCG2uT/vyBCxhDZMHqeDDMGG2M9eCCPFNIoz DKIM-Signature: v=1; a=rsa-sha256; c=simple; d=taugh.com; h=date:message-id:from:to:cc:subject:in-reply-to:mime-version:content-type:content-transfer-encoding; s=270e.5c905b88.k1903; bh=RUF6A6w6CvS+MLQWY0gcvAPlUJruTsxJ1hpuY8U0ORQ=; b=SxoxaX+R6mynIrUaaW9u3rnDceGAofsHW7OeDqjRYwuwJw8hVfr10YyQisdrKsgvDgPVW43RXIJT/9olbvwYHcEfF3vxxAcf2oaF0s0Ay+P4qeddcaTVwfTJ+E9OBYQrj32Ua9Wixj1t6IMpi+tCmk1nhAi/69KadHHHi9veFJ7oE1kJGNCleB+akF1pCdcKLQ34HJXZbUKoHdcLFKgflVoy2EevlFKv3ZCIIocbkW+ynzmydpp5JCm9neXoYxdp Received: from ary.qy ([IPv6:2001:470:1f07:1126::78:696d:6170]) by imap.iecc.com ([IPv6:2001:470:1f07:1126::78:696d:6170]) with ESMTP via TCP6; 19 Mar 2019 03:01:28 -0000 Received: by ary.qy (Postfix, from userid 501) id 650AB201032169; Mon, 18 Mar 2019 23:01:28 -0400 (EDT) Date: 18 Mar 2019 23:01:28 -0400 Message-Id: <20190319030128.650AB201032169@ary.qy> From: "John Levine" To: dmarc@ietf.org Cc: mikedup84@gmail.com In-Reply-To: Organization: Taughannock Networks X-Headerized: yes Mime-Version: 1.0 Content-type: text/plain; charset=utf-8 Content-transfer-encoding: 8bit Archived-At: Subject: Re: [dmarc-ietf] p=reject X-BeenThere: dmarc@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Domain-based Message Authentication, Reporting, and Compliance \(DMARC\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 19 Mar 2019 03:01:33 -0000 In article you write: >-=-=-=-=-=- > >If a sender's IP is in SPF, so SPF passes; and the applied DKIM signature >is successfully decrypted, so DKIM passes; what good is checking alignment >and rejecting a message? The short answer is that bad guys can publish SPF and DKIM just as well as good guys. Anecdotally, it appears that bad guys are better at it than good guys. The point of DMARC is not just that a message is authenticated, but that it is authenticated by the same domain that's on the From: line, which makes it highly likely that the message is actually from who it appears to be from, rather than from some random crook with an SPF record and a DKIM signer. There are certainly plenty of ways that DMARC can do unfortunate things but in this case it's working as intended. From nobody Tue Mar 19 06:24:19 2019 Return-Path: X-Original-To: dmarc@ietfa.amsl.com Delivered-To: dmarc@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7634B131270 for ; Tue, 19 Mar 2019 06:24:17 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.001 X-Spam-Level: X-Spam-Status: No, score=-2.001 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=isdg.net header.b=Y7P4dOX1; dkim=pass (1024-bit key) header.d=beta.winserver.com header.b=bdzZ26qA Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id lZ-65cmhlCit for ; Tue, 19 Mar 2019 06:24:14 -0700 (PDT) Received: from mail.winserver.com (mail.catinthebox.net [76.245.57.69]) by ietfa.amsl.com (Postfix) with ESMTP id 5277A130F05 for ; Tue, 19 Mar 2019 06:24:14 -0700 (PDT) DKIM-Signature: v=1; d=isdg.net; s=tms1; a=rsa-sha1; c=simple/relaxed; l=3299; t=1553001846; atps=ietf.org; atpsh=sha1; h=Received:Received:Received:Received:Message-ID:Date:From: Organization:To:Subject:List-ID; bh=9vhMgPmPLmGHYcIbmENmAaoau4Y=; b=Y7P4dOX17pvutHHhPsnhl52ieUlF9pU5R74fc8gmRhTBSAe14UKRHemf89Bq5j YFtwPk+XcbM2vVL2WOH1AuSuyyUY+uit8jcCWVFxHOXenm6F4CP2AHcQBTqtJcEE pwUrAYIngx0Hs5MxtiKBhjTrgqtrsErqG3sHnQP4bsMV4= Received: by winserver.com (Wildcat! SMTP Router v7.0.454.6) for dmarc@ietf.org; Tue, 19 Mar 2019 08:24:06 -0500 Authentication-Results: dkim.winserver.com; dkim=pass header.d=beta.winserver.com header.s=tms1 header.i=beta.winserver.com; Received: from beta.winserver.com ([76.245.57.74]) by winserver.com (Wildcat! SMTP v7.0.454.6) with ESMTP id 3408734996.1.1556; Tue, 19 Mar 2019 08:24:06 -0500 DKIM-Signature: v=1; d=beta.winserver.com; s=tms1; a=rsa-sha256; c=simple/relaxed; l=3299; t=1553001818; h=Received:Received: Message-ID:Date:From:Organization:To:Subject:List-ID; bh=08AuAZn tenQ6xyiiuhypdU9ufqPTvhMPcmXb3ZPnPUI=; b=bdzZ26qAxldok3VAtCnKVy6 Tm/hCHTqsZ31C10rlnISqzmc1tKhpAs5uPlhTWvSAELJxNq2GtRsYFwe1VvdzaLi 107ZCTt+A8WXeKnddNPdbwPVD6QWGBDbhKOXneedrcgjpKW50ynldY7KIhlMnLGh UfJ9z22XEb6JsvA73v28= Received: by beta.winserver.com (Wildcat! SMTP Router v7.0.454.6) for dmarc@ietf.org; Tue, 19 Mar 2019 09:23:38 -0400 Received: from [192.168.1.68] ([75.26.216.248]) by beta.winserver.com (Wildcat! SMTP v7.0.454.6) with ESMTP id 3956607846.9.303152; Tue, 19 Mar 2019 09:23:37 -0400 Message-ID: <5C90ED74.6070409@isdg.net> Date: Tue, 19 Mar 2019 09:24:04 -0400 From: Hector Santos Reply-To: hsantos@isdg.net Organization: Santronics Software, Inc. User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:24.0) Gecko/20100101 Thunderbird/24.8.1 MIME-Version: 1.0 To: Michael Davis , dmarc@ietf.org References: In-Reply-To: Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit Archived-At: Subject: Re: [dmarc-ietf] p=reject X-BeenThere: dmarc@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Domain-based Message Authentication, Reporting, and Compliance \(DMARC\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 19 Mar 2019 13:24:18 -0000 On 3/18/2019 3:48 PM, Michael Davis wrote: > If a sender's IP is in SPF, so SPF passes; and the applied DKIM signature > is successfully decrypted, so DKIM passes; what good is checking alignment > and rejecting a message? I have had Adobe and Cloudflare automated system > emails rejected based on those senders' DMARC policy, after SPF and DKIM > pass. These emails were regarding password resets and come from servers > that do not equal the spoofed address domain. It would seem that if the > sender is approved according to SPF and verified according to DKIM that > alignment being a reason for rejection post authenticas is an exercise of > absurdity. > > Please help me understand otherwise. Hi Michel, I'll take a stab at this. My opinion. I do agree with one vital (optimization) idea. If a domain is 100% exclusive and restrictive and the domain's DNS-exposed policies indicate this exclusivity for all parties involved, then, in my opinion, DMARC is redundant. SPF should be good enough as long as all all identities are aligned. That said, there a few points here. First, this is all about having "trust." Second, we don't have a 3rd party authorization/trust system for email, not like we do with HTTPS and the browsers relationship with 3rd party CA vendors. Third, without the first and second thing, it becomes questionable (almost to the level of absurdity) to use 3rd party services for high value transactions where one might suggest a "password reset" would be considered high value. With DKIM, we have a self-signing 1st party signature system and a DKIM Policy framework for a 1st party authorization system. It lacks a 3rd party authorization framework like we have with HTTPS. It is important to keep this in mind because this dearth has been the "thorn on the dkim side" since the early days of DKIM-SSP (Sender Signature Policy) where it did offer policies for the 3rd party. o=! EXCLUSIVE (signature required, no 3rd party) o=- STRONG (signature required, 3rd party allowed) o=~ NEUTRAL (signature optional, 3rd party allowed) o=? WEAK (signature optional, no third party) o=. NEVER (no mail expected) o=^ USER Over the years, because of the complexity and the failure to work out a 3rd party authorization protocol, ADSP and eventually DMARC reduced this to only supporting the more powerful, more narrow, more restrictive exclusive 1st party only signing protection policy. But overall, what they all (SSP, ADSP, DMARC) lacked was a 3rd party signature authorization protocol. Ideas like TPA and ATPS were proposed as DKIM Policy extensions to fill in this big gap but unfortunately, not much traction. Note: By 3rd party, this means the RPID, SDID and AUID domains don't align with ADID where: ADID Author Domain Identity (5322.From.domain) RPID Return Path Identity (5321.MailFrom.domain) SDID Signer Domain Identity (5322.DKIM-Signature s= tag) AUID Agent User Identity (5322.DKIM-Signature i= tag) Honestly, I see your point, but vendors really do need to watch out using a 3rd party sending ADID, RPID, SDID and AUID scenarios for sensitive transactions. We simply do not have an automated 3rd party authorization/trust and assessment system in place. -- HLS From nobody Tue Mar 19 11:03:19 2019 Return-Path: X-Original-To: dmarc@ietfa.amsl.com Delivered-To: dmarc@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8B57F1315B5 for ; Tue, 19 Mar 2019 11:03:15 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2 X-Spam-Level: X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=upu.int Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id SqdDrpAeOB8c for ; Tue, 19 Mar 2019 11:03:12 -0700 (PDT) Received: from mgw1.upu.int (mgw1.upu.int [193.247.49.7]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E6D5D1315D5 for ; Tue, 19 Mar 2019 11:03:11 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=upu.int; i=@upu.int; q=dns/txt; s=default; t=1553018590; x=1584554590; h=from:to:cc:subject:date:message-id:references: in-reply-to:content-transfer-encoding:mime-version; bh=W43eVN1pIH7tuqpQyAG131OI7VRY1GswGUH4dmmAtCE=; b=kEDOpjGqZguaXzXq01pbtyKyzajMbpkegDZqk1qetxpjgKkxEZlBAMu3 IlxrjAc5WNwD0pKlt9If3ivhIURjBBLZMSBAWds5xOHmQ/htkt3GWTUrj 65Ap+9voAyCDJNXk/7C2cmrWr2iX/h2J9Hh1QnBpo/MLxRcMl02MPapTr JlNFgnAT1+hIiO/JR1FeY7B7qp6A737JRVKBxOel//o7Det1Qf3vghvbV 87WSz8J2+9IYZuV6mahDvyQhimrruKYtkTu+vuSdZKBGbdjoqEyj9CxPW 1vIXpp+3A1RUUJ1JhMWCWb1whcWy3YjpiHW0e5+WubAZRj3NAu7odpKRb g==; Authentication-Results: mgw1-out.upu.int; spf=Pass smtp.mailfrom=gustavo.DAMY@upu.int; spf=None smtp.helo=postmaster@PEXC01.upu.ch Received-SPF: Pass (mgw1-out.upu.int: domain of gustavo.DAMY@upu.int designates 193.247.55.160 as permitted sender) identity=mailfrom; client-ip=193.247.55.160; receiver=mgw1-out.upu.int; envelope-from="gustavo.DAMY@upu.int"; x-sender="gustavo.DAMY@upu.int"; x-conformance=spf_only; x-record-type="v=spf1"; x-record-text="v=spf1 ip4:193.247.55.160/32 ip4:193.247.55.161/32 ip4:80.80.227.166/32 ip4:193.247.63.15/32 +a:erecruit.noreply.upu.int +mx -all" Received-SPF: None (mgw1-out.upu.int: no sender authenticity information available from domain of postmaster@PEXC01.upu.ch) identity=helo; client-ip=193.247.55.160; receiver=mgw1-out.upu.int; envelope-from="gustavo.DAMY@upu.int"; x-sender="postmaster@PEXC01.upu.ch"; x-conformance=spf_only IronPort-SDR: XYy2s1P7kRtsFX6A942bD+NmYVALq8yQJdFRk9+L+IjURluD1+9qHzD+h7/oelxaf6aa9ldlGZ IVQCob39SdWd5cLi1Pc9XZIcXB9AV7OPwrB9vrO0SH25JKfBhIYNlnAYf5VQmsDMBzBiyV6k2r gYItE7CHqdJxk+L9tHTqxig07LOg38s22Y6z9fUpypIr3prDv4z6aJCyvqezOjYx7JDgBCaEM1 BKTNzE0BxgI6EFVwP3LmiLYNOlR0pJBpLBep/l/cukzV7+swfmKqaR/wIUzR7Q8ThK6WzIgaCX DB4= X-IronPort-AV: E=Sophos;i="5.60,245,1549926000"; d="scan'208";a="1890599" Received: from PEXC01.upu.ch (2002:c1f7:37a0::c1f7:37a0) by PEXC01.upu.ch (2002:c1f7:37a0::c1f7:37a0) with Microsoft SMTP Server (TLS) id 15.0.1130.7; Tue, 19 Mar 2019 19:03:00 +0100 Received: from PEXC01.upu.ch ([fe80::28c1:e4c1:2f2e:11fc]) by PEXC01.upu.ch ([fe80::28c1:e4c1:2f2e:11fc%13]) with mapi id 15.00.1130.005; Tue, 19 Mar 2019 19:03:00 +0100 From: DAMY gustavo To: "dmarc@ietf.org" CC: Bernie Hoeneisen Thread-Topic: [dmarc-ietf] Email security beyond DMARC? Thread-Index: AQHU3b0Xv/AeslasNkiUwE096qOcBKYTO0Dw Date: Tue, 19 Mar 2019 18:02:59 +0000 Message-ID: <90b936ec488f41108bc4e528eb7933f6@PEXC01.upu.ch> References: <1dc451a973a8443a87d37b6e5c41fe38@bayviewphysicians.com> In-Reply-To: Accept-Language: en-GB, fr-CH, en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [172.22.0.30] Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Archived-At: Subject: Re: [dmarc-ietf] Email security beyond DMARC? X-BeenThere: dmarc@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Domain-based Message Authentication, Reporting, and Compliance \(DMARC\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 19 Mar 2019 18:03:18 -0000 Very useful links Bernie, thanks for the info. I wonder if this working group will eventually will make reference to the = concept of PeP protocol to reinforce the usage of DMARC you are mentionin= g below?=20 Best Regards Gustavo Damy -----Original Message----- From: Bernie Hoeneisen =20 Sent: Monday, March 18, 2019 1:58 PM To: Douglas E. Foster Cc: dmarc@ietf.org Subject: Re: [dmarc-ietf] Email security beyond DMARC? Hi Doug On Sat, 16 Mar 2019, Douglas E. Foster wrote: > I tried to understand what IETF is doing about email security, and=20 > this working group seems to be the only surviving effort. Based on=20 > the index, the groups attention is focused on polishing the existing=20 > DMARC implementaton rather than plowing new territory. Given the=20 > devastating effect of WannaCry and the success of other email-based=20 > attacks, I think our work is far from finished. You may want to have a look on some upcoming work. We just started a new ma= iling list, which includes the topic of email security: MEDUP -- Missing Elements for Decentralized and Usable Privacy To subscribe: - https://www.ietf.org/mailman/listinfo/medup Please find more information on: - https://mailarchive.ietf.org/arch/msg/medup/mbrbhFekt_srXShzpCa4RiXgPbY - https://mailarchive.ietf.org/arch/msg/pearg/oBjgAwG3_eoR6tpLQGTE_9OggzQ The former also includes a list of Internet-Drafts describing the MEDUP cha= llenges. Please be also informated that the LAMPS WG has requested a new work item=20 on email header protection to be added to its charter. Hope that helps! Best, Bernie -- http://ucom.ch/ Modern Telephony Solutions and Tech Consulting for Internet Technology From btv1==981b339ecf5==fosterd@bayviewphysicians.com Tue Mar 19 11:25:23 2019 Return-Path: X-Original-To: dmarc@ietfa.amsl.com Delivered-To: dmarc@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D124F131235 for ; Tue, 19 Mar 2019 11:25:23 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2 X-Spam-Level: X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=bayviewphysicians.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id G9ODpyV7z21S for ; Tue, 19 Mar 2019 11:25:22 -0700 (PDT) Received: from mail.bayviewphysicians.com (mail.bayviewphysicians.com [216.54.111.133]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id F19B8131260 for ; Tue, 19 Mar 2019 11:25:21 -0700 (PDT) X-ASG-Debug-ID: 1553019920-099057763414bd50001-K2EkT1 Received: from webmail.bayviewphysicians.com (smartermail4.bayviewphysicians.com [192.168.1.49]) by mail.bayviewphysicians.com with ESMTP id lr1AyNWUlmSZgK2W (version=TLSv1.2 cipher=ECDHE-RSA-AES256-SHA384 bits=256 verify=NO); Tue, 19 Mar 2019 14:25:20 -0400 (EDT) X-Barracuda-Envelope-From: fosterd@bayviewphysicians.com X-Barracuda-RBL-Trusted-Forwarder: 192.168.1.49 X-ASG-Whitelist: Client X-SmarterMail-Authenticated-As: fosterd@bayviewphysicians.com DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=bayviewphysicians.com; s=s1025; h=content-type:mime-version:message-id:date:subject:to:from; bh=KQO3E/XcAsVyzL7B0J2EG9KJd1rqR8AJwm2HxDFYdhI=; b=L7rCjSwLvf6zIJSOeG0OhJCY0afErYHJuzPcPX5jBbYFAOfP06P+DxsJQH96D7nZP mkHepW888DrYq4hRQpX/uicTVpaTwPVNTacj70tGP9m2OYVyAAg7VL3SxXVHuDqHu bS8OIDIqpZ0UK2gc26ZQLEuLK6bf38J5ql5BA1RlM= Received: from MSA189 (MSA-189.BayviewPhysicians.com [192.168.2.94]) by webmail.bayviewphysicians.com with SMTP (version=TLS\Tls12 cipher=Aes256 bits=256); Tue, 19 Mar 2019 14:25:13 -0400 From: "Doug Foster" X-Barracuda-RBL-IP: 192.168.2.94 To: "'DAMY gustavo'" , Cc: "'Bernie Hoeneisen'" References: <1dc451a973a8443a87d37b6e5c41fe38@bayviewphysicians.com> <90b936ec488f41108bc4e528eb7933f6@PEXC01.upu.ch> In-Reply-To: <90b936ec488f41108bc4e528eb7933f6@PEXC01.upu.ch> Date: Tue, 19 Mar 2019 14:25:14 -0400 X-ASG-Orig-Subj: RE: [dmarc-ietf] Email security beyond DMARC? Message-ID: <002a01d4de81$18ac27b0$4a047710$@bayviewphysicians.com> MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit X-Mailer: Microsoft Outlook 14.0 Thread-Index: AQJmenrxqi/qc1CC2lkp6UWa01arRwL8vst8AWe2KCqkzOiiMA== Content-Language: en-us X-Exim-Id: 002a01d4de81$18ac27b0$4a047710$ X-Barracuda-Connect: smartermail4.bayviewphysicians.com[192.168.1.49] X-Barracuda-Start-Time: 1553019920 X-Barracuda-Encrypted: ECDHE-RSA-AES256-SHA384 X-Barracuda-URL: https://mail.bayviewphysicians.com:443/cgi-mod/mark.cgi X-Virus-Scanned: by bsmtpd at bayviewphysicians.com X-Barracuda-Scan-Msg-Size: 2306 X-Barracuda-BRTS-Status: 1 Archived-At: Subject: Re: [dmarc-ietf] Email security beyond DMARC? X-BeenThere: dmarc@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Domain-based Message Authentication, Reporting, and Compliance \(DMARC\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 19 Mar 2019 18:29:51 -0000 Can one of you elaborate on the potential connection between PeP and DMARC, or more generally, the connection beteen PeP and spam filtering? -----Original Message----- From: dmarc [mailto:dmarc-bounces@ietf.org] On Behalf Of DAMY gustavo Sent: Tuesday, March 19, 2019 2:03 PM To: dmarc@ietf.org Cc: Bernie Hoeneisen Subject: Re: [dmarc-ietf] Email security beyond DMARC? Very useful links Bernie, thanks for the info. I wonder if this working group will eventually will make reference to the concept of PeP protocol to reinforce the usage of DMARC you are mentioning below? Best Regards Gustavo Damy -----Original Message----- From: Bernie Hoeneisen Sent: Monday, March 18, 2019 1:58 PM To: Douglas E. Foster Cc: dmarc@ietf.org Subject: Re: [dmarc-ietf] Email security beyond DMARC? Hi Doug On Sat, 16 Mar 2019, Douglas E. Foster wrote: > I tried to understand what IETF is doing about email security, and > this working group seems to be the only surviving effort. Based on > the index, the groups attention is focused on polishing the existing > DMARC implementaton rather than plowing new territory. Given the > devastating effect of WannaCry and the success of other email-based > attacks, I think our work is far from finished. You may want to have a look on some upcoming work. We just started a new mailing list, which includes the topic of email security: MEDUP -- Missing Elements for Decentralized and Usable Privacy To subscribe: - https://www.ietf.org/mailman/listinfo/medup Please find more information on: - https://mailarchive.ietf.org/arch/msg/medup/mbrbhFekt_srXShzpCa4RiXgPbY - https://mailarchive.ietf.org/arch/msg/pearg/oBjgAwG3_eoR6tpLQGTE_9OggzQ The former also includes a list of Internet-Drafts describing the MEDUP challenges. Please be also informated that the LAMPS WG has requested a new work item on email header protection to be added to its charter. Hope that helps! Best, Bernie -- http://ucom.ch/ Modern Telephony Solutions and Tech Consulting for Internet Technology _______________________________________________ dmarc mailing list dmarc@ietf.org https://www.ietf.org/mailman/listinfo/dmarc From nobody Tue Mar 19 11:42:15 2019 Return-Path: X-Original-To: dmarc@ietfa.amsl.com Delivered-To: dmarc@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7A045131521 for ; Tue, 19 Mar 2019 11:42:13 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.999 X-Spam-Level: X-Spam-Status: No, score=-1.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HEADER_FROM_DIFFERENT_DOMAINS=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1536-bit key) header.d=iecc.com header.b=nrPOam/A; dkim=pass (1536-bit key) header.d=taugh.com header.b=Z6dd3483 Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id MSD3Eg2-t2kz for ; Tue, 19 Mar 2019 11:42:11 -0700 (PDT) Received: from gal.iecc.com (gal.iecc.com [IPv6:2001:470:1f07:1126:0:43:6f73:7461]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 2585D131513 for ; Tue, 19 Mar 2019 11:42:11 -0700 (PDT) Received: (qmail 24106 invoked from network); 19 Mar 2019 18:42:09 -0000 DKIM-Signature: v=1; a=rsa-sha256; c=simple; d=iecc.com; h=date:message-id:from:to:cc:subject:in-reply-to:mime-version:content-type:content-transfer-encoding; s=5e26.5c913801.k1903; bh=JpSKbAXZ8Q1K/s62lGymQxQhf0idbrOoA7PHNx8aVf0=; b=nrPOam/ABBE7VKC2r8p4fQ4sEgjWtLsJvE04HLa1zspgoAIALxe+5FlaOAXuECwlzbHS65Lu68+w+4LmZWhUuOT10b4qzcOV6Sa3nvFEwLgpvg2FBzFz5fqZ4iQeszEnjCroagQ62Vy8e7TLvrqgs5/YVl8JsdK7k4JPI9fpkTBK30sATE7Bfys2Ex3ZVtpRxjYIh1L49HVzCDztdvFA+mHzh4CI/c59J4sRD8X+mtHLb9ajZVoUMRAjHF6MSNeL DKIM-Signature: v=1; a=rsa-sha256; c=simple; d=taugh.com; h=date:message-id:from:to:cc:subject:in-reply-to:mime-version:content-type:content-transfer-encoding; s=5e26.5c913801.k1903; bh=JpSKbAXZ8Q1K/s62lGymQxQhf0idbrOoA7PHNx8aVf0=; b=Z6dd3483BhMp9/lDxId5z23MSiXiIz4sFf/Kq8HmkuP7q/s82fJiiFH8cuucmhcX5yIjIZOqYDXbPotHYQCd/YvocruDMtOIFp9qXmFRrCn7xZ46PlbdwwXuMPr/Abvjvmny52lioO2EN8RZC/og0TK7wfmrLY6xBpz5EU2PQ+hhb8dLt6NXTZHpXjPligDOHW9lEClIgRmppsYmmzo4mCgceLT4Pnz4Sc7vCNjHOuouj8o7HUa9pyRFMoNfnWuI Received: from ary.qy ([IPv6:2001:470:1f07:1126::78:696d:6170]) by imap.iecc.com ([IPv6:2001:470:1f07:1126::78:696d:6170]) with ESMTP via TCP6; 19 Mar 2019 18:42:09 -0000 Received: by ary.qy (Postfix, from userid 501) id 804E42010381DB; Tue, 19 Mar 2019 14:42:09 -0400 (EDT) Date: 19 Mar 2019 14:42:09 -0400 Message-Id: <20190319184209.804E42010381DB@ary.qy> From: "John Levine" To: dmarc@ietf.org In-Reply-To: <002a01d4de81$18ac27b0$4a047710$@bayviewphysicians.com> Organization: Taughannock Networks X-Headerized: yes Mime-Version: 1.0 Content-type: text/plain; charset=utf-8 Content-transfer-encoding: 8bit Archived-At: Subject: Re: [dmarc-ietf] Email security beyond DMARC? X-BeenThere: dmarc@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Domain-based Message Authentication, Reporting, and Compliance \(DMARC\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 19 Mar 2019 18:42:14 -0000 In article <002a01d4de81$18ac27b0$4a047710$@bayviewphysicians.com> you write: >Can one of you elaborate on the potential connection between PeP and DMARC, >or more generally, the connection beteen PeP and spam filtering? I presume that PeP would make spam filtering much harder since the filters can't look inside the messages. Be careful what you wish for, and remember that bad guys can use all our shiny toys, too. R's, John From nobody Tue Mar 19 11:44:14 2019 Return-Path: X-Original-To: dmarc@ietfa.amsl.com Delivered-To: dmarc@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 15E911315A3 for ; Tue, 19 Mar 2019 11:44:05 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_NONE=-0.0001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id BIVJNyaCHY6p for ; Tue, 19 Mar 2019 11:44:01 -0700 (PDT) Received: from softronics.hoeneisen.ch (softronics.hoeneisen.ch [62.2.86.178]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 79BC713151C for ; Tue, 19 Mar 2019 11:44:01 -0700 (PDT) Received: from localhost ([127.0.0.1]) by softronics.hoeneisen.ch with esmtp (Exim 4.86_2) (envelope-from ) id 1h6JiP-0001do-9O; Tue, 19 Mar 2019 19:43:57 +0100 Date: Tue, 19 Mar 2019 19:43:57 +0100 (CET) From: 'Bernie Hoeneisen' X-X-Sender: bhoeneis@softronics.hoeneisen.ch To: Doug Foster cc: 'DAMY gustavo' , dmarc@ietf.org In-Reply-To: <002a01d4de81$18ac27b0$4a047710$@bayviewphysicians.com> Message-ID: References: <1dc451a973a8443a87d37b6e5c41fe38@bayviewphysicians.com> <90b936ec488f41108bc4e528eb7933f6@PEXC01.upu.ch> <002a01d4de81$18ac27b0$4a047710$@bayviewphysicians.com> User-Agent: Alpine 2.20 (DEB 67 2015-01-07) MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII; format=flowed X-SA-Exim-Connect-IP: 127.0.0.1 X-SA-Exim-Mail-From: bernie@ietf.hoeneisen.ch X-SA-Exim-Scanned: No (on softronics.hoeneisen.ch); SAEximRunCond expanded to false Archived-At: Subject: Re: [dmarc-ietf] Email security beyond DMARC? X-BeenThere: dmarc@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Domain-based Message Authentication, Reporting, and Compliance \(DMARC\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 19 Mar 2019 18:44:13 -0000 Dear Doug / Damy There is no direct connection between pEp and DMARC, as pEp is not relying on centralized infrastructure. cheers Bernie On Tue, 19 Mar 2019, Doug Foster wrote: > Can one of you elaborate on the potential connection between PeP and DMARC, > or more generally, the connection beteen PeP and spam filtering? > > -----Original Message----- > From: dmarc [mailto:dmarc-bounces@ietf.org] On Behalf Of DAMY gustavo > Sent: Tuesday, March 19, 2019 2:03 PM > To: dmarc@ietf.org > Cc: Bernie Hoeneisen > Subject: Re: [dmarc-ietf] Email security beyond DMARC? > > Very useful links Bernie, thanks for the info. > I wonder if this working group will eventually will make reference to the > concept of PeP protocol to reinforce the usage of DMARC you are mentioning > below? > > Best Regards > Gustavo Damy > > > -----Original Message----- > From: Bernie Hoeneisen > Sent: Monday, March 18, 2019 1:58 PM > To: Douglas E. Foster > Cc: dmarc@ietf.org > Subject: Re: [dmarc-ietf] Email security beyond DMARC? > > Hi Doug > > On Sat, 16 Mar 2019, Douglas E. Foster wrote: > >> I tried to understand what IETF is doing about email security, and >> this working group seems to be the only surviving effort. Based on >> the index, the groups attention is focused on polishing the existing >> DMARC implementaton rather than plowing new territory. Given the >> devastating effect of WannaCry and the success of other email-based >> attacks, I think our work is far from finished. > > You may want to have a look on some upcoming work. We just started a new > mailing list, which includes the topic of email security: > > MEDUP -- Missing Elements for Decentralized and Usable Privacy > > To subscribe: > > - https://www.ietf.org/mailman/listinfo/medup > > Please find more information on: > > - https://mailarchive.ietf.org/arch/msg/medup/mbrbhFekt_srXShzpCa4RiXgPbY > > - https://mailarchive.ietf.org/arch/msg/pearg/oBjgAwG3_eoR6tpLQGTE_9OggzQ > > The former also includes a list of Internet-Drafts describing the MEDUP > challenges. > > > Please be also informated that the LAMPS WG has requested a new work item on > email header protection to be added to its charter. > > > Hope that helps! > > Best, > Bernie > > -- > > http://ucom.ch/ > Modern Telephony Solutions and Tech Consulting for Internet Technology > > > _______________________________________________ > dmarc mailing list > dmarc@ietf.org > https://www.ietf.org/mailman/listinfo/dmarc > > > _______________________________________________ > dmarc mailing list > dmarc@ietf.org > https://www.ietf.org/mailman/listinfo/dmarc > From nobody Wed Mar 20 02:34:01 2019 Return-Path: X-Original-To: dmarc@ietfa.amsl.com Delivered-To: dmarc@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 12740131095 for ; Wed, 20 Mar 2019 02:34:00 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.001 X-Spam-Level: X-Spam-Status: No, score=-2.001 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=upu.int Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id GwoqaCZCFgSl for ; Wed, 20 Mar 2019 02:33:57 -0700 (PDT) Received: from mgw3.upu.int (mgw3.upu.int [193.247.49.9]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A86FD1274A1 for ; Wed, 20 Mar 2019 02:33:56 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=upu.int; i=@upu.int; q=dns/txt; s=default; t=1553074433; x=1584610433; h=from:to:subject:date:message-id:references:in-reply-to: content-transfer-encoding:mime-version; bh=ldUPEBJ/04FyFhIzw7iNgJzm4baRB/aBy7ih2owQgso=; b=OVAR5fEbsBQ5Iy92pkeva8hfd8tACiBMH5imgs45FsK4Wve4Rn2Sxd1V hWIgCoN3A5HwHip2DmwHGki2Q5D5oE4Kmq+VYLjvza9j6EHWrnSIdh3eU iRWcJ+15Pnkjoxj6sqePuFGBxLaJe+CgrvinaJcRKXhoKGD6JI4BtKibN GWaIGXTFo19ehtJPmJnTP2u5D5HoABlTYSPoaBA3+JC50v1IKKa9B4GId NWtsyl5AyT24Tiwv7ENkZfCB7sWrV9Qenk29xvQ2rN2+Ns84jzqu4p/aC KN17v94KtZ/cyYi4KzMxZQd56GUBgbkP+6CDZwhNjEI16iFfxxX1dWtvh A==; Authentication-Results: mgw3.upu.ch; spf=Pass smtp.mailfrom=gustavo.DAMY@upu.int; spf=None smtp.helo=postmaster@PEXC02.upu.ch Received-SPF: Pass (mgw3.upu.ch: domain of gustavo.DAMY@upu.int designates 193.247.55.161 as permitted sender) identity=mailfrom; client-ip=193.247.55.161; receiver=mgw3.upu.ch; envelope-from="gustavo.DAMY@upu.int"; x-sender="gustavo.DAMY@upu.int"; x-conformance=spf_only; x-record-type="v=spf1"; x-record-text="v=spf1 ip4:193.247.55.160/32 ip4:193.247.55.161/32 ip4:80.80.227.166/32 ip4:193.247.63.15/32 +a:erecruit.noreply.upu.int +mx -all" Received-SPF: None (mgw3.upu.ch: no sender authenticity information available from domain of postmaster@PEXC02.upu.ch) identity=helo; client-ip=193.247.55.161; receiver=mgw3.upu.ch; envelope-from="gustavo.DAMY@upu.int"; x-sender="postmaster@PEXC02.upu.ch"; x-conformance=spf_only IronPort-SDR: kJUv8wLpqWELbts8Cl7q1R7PL8efKlrsNXKaP64Sp/OU7sQjfH7RNkgogphfoSyfoSaa0IaJDC 8EIZAZoLA5AdYHYT0mcpijCIznug1BtBQ1W3NseHLsC5yATaUzseSLciicb0EPq0k52YdOOIkV HfO/S39HefgA9w9ty+5gtA06iRJgYBI54Qau20S2D63+WjjNmdy5vhiup3Ex5kY0z1TYp7j/jg JAH6cSe2QesrGygo3yn1kEJ3JJ8q+1td6j2zUsMgTFCaG7SZTtJwuVN4bMN8vmsIBGqGxejUaP /N0= X-IronPort-AV: E=Sophos;i="5.60,248,1549926000"; d="scan'208";a="1860181" Received: from PEXC01.upu.ch (2002:c1f7:37a0::c1f7:37a0) by PEXC02.upu.ch (2002:c1f7:37a1::c1f7:37a1) with Microsoft SMTP Server (TLS) id 15.0.1130.7; Wed, 20 Mar 2019 10:33:46 +0100 Received: from PEXC01.upu.ch ([fe80::28c1:e4c1:2f2e:11fc]) by PEXC01.upu.ch ([fe80::28c1:e4c1:2f2e:11fc%13]) with mapi id 15.00.1130.005; Wed, 20 Mar 2019 10:33:46 +0100 From: DAMY gustavo To: "dmarc@ietf.org" Thread-Topic: [dmarc-ietf] Email security beyond DMARC? Thread-Index: AQHU3b0Xv/AeslasNkiUwE096qOcBKYTO0Dw///6sgCAAAU7gIAA+KSQ Date: Wed, 20 Mar 2019 09:33:45 +0000 Message-ID: <8e26770d45b14816b3a5b9da33acf83a@PEXC01.upu.ch> References: <1dc451a973a8443a87d37b6e5c41fe38@bayviewphysicians.com> <90b936ec488f41108bc4e528eb7933f6@PEXC01.upu.ch> <002a01d4de81$18ac27b0$4a047710$@bayviewphysicians.com> In-Reply-To: Accept-Language: en-GB, fr-CH, en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [172.22.0.30] Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Archived-At: Subject: Re: [dmarc-ietf] Email security beyond DMARC? X-BeenThere: dmarc@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Domain-based Message Authentication, Reporting, and Compliance \(DMARC\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 20 Mar 2019 09:34:00 -0000 OK thank you Bernie,=20 But pEp is also based on MIME (which requires trust on at least one cent= ralized CA which falls into the centralized infrastructure isn't it ?) And yes I agree bad guys could use this as well (but probably they already = do it anyway) so through pEp + DMARC it wouldn't be even safer to exchange= messages finally an easy way to have End to end encryption using open prot= ocols for webmail (and not just rely on existing APPS/SW) implementations?= =20 At the end you have to trust someone and that could be linked to existing D= MARC DNS records?=20 Regards Gustavo =20 -----Original Message----- From: 'Bernie Hoeneisen' =20 Sent: Tuesday, March 19, 2019 7:44 PM To: Doug Foster Cc: DAMY gustavo ; dmarc@ietf.org Subject: Re: [dmarc-ietf] Email security beyond DMARC? Dear Doug / Damy There is no direct connection between pEp and DMARC, as pEp is not relying = on centralized infrastructure. cheers Bernie On Tue, 19 Mar 2019, Doug Foster wrote: > Can one of you elaborate on the potential connection between PeP and DMAR= C, > or more generally, the connection beteen PeP and spam filtering? > > -----Original Message----- > From: dmarc [mailto:dmarc-bounces@ietf.org] On Behalf Of DAMY gustavo > Sent: Tuesday, March 19, 2019 2:03 PM > To: dmarc@ietf.org > Cc: Bernie Hoeneisen > Subject: Re: [dmarc-ietf] Email security beyond DMARC? > > Very useful links Bernie, thanks for the info. > I wonder if this working group will eventually will make reference to th= e > concept of PeP protocol to reinforce the usage of DMARC you are mention= ing > below? > > Best Regards > Gustavo Damy > > > -----Original Message----- > From: Bernie Hoeneisen > Sent: Monday, March 18, 2019 1:58 PM > To: Douglas E. Foster > Cc: dmarc@ietf.org > Subject: Re: [dmarc-ietf] Email security beyond DMARC? > > Hi Doug > > On Sat, 16 Mar 2019, Douglas E. Foster wrote: > >> I tried to understand what IETF is doing about email security, and >> this working group seems to be the only surviving effort. Based on >> the index, the groups attention is focused on polishing the existing >> DMARC implementaton rather than plowing new territory. Given the >> devastating effect of WannaCry and the success of other email-based >> attacks, I think our work is far from finished. > > You may want to have a look on some upcoming work. We just started a new > mailing list, which includes the topic of email security: > > MEDUP -- Missing Elements for Decentralized and Usable Privacy > > To subscribe: > > - https://www.ietf.org/mailman/listinfo/medup > > Please find more information on: > > - https://mailarchive.ietf.org/arch/msg/medup/mbrbhFekt_srXShzpCa4RiXgPbY > > - https://mailarchive.ietf.org/arch/msg/pearg/oBjgAwG3_eoR6tpLQGTE_9OggzQ > > The former also includes a list of Internet-Drafts describing the MEDUP > challenges. > > > Please be also informated that the LAMPS WG has requested a new work item= on > email header protection to be added to its charter. > > > Hope that helps! > > Best, > Bernie > > -- > > http://ucom.ch/ > Modern Telephony Solutions and Tech Consulting for Internet Technology > > > _______________________________________________ > dmarc mailing list > dmarc@ietf.org > https://www.ietf.org/mailman/listinfo/dmarc > > > _______________________________________________ > dmarc mailing list > dmarc@ietf.org > https://www.ietf.org/mailman/listinfo/dmarc > From nobody Wed Mar 20 07:05:27 2019 Return-Path: X-Original-To: dmarc@ietfa.amsl.com Delivered-To: dmarc@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5FCAC1294B6 for ; Wed, 20 Mar 2019 07:05:25 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_NONE=-0.0001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id TwFe1EcdYhiK for ; Wed, 20 Mar 2019 07:05:23 -0700 (PDT) Received: from softronics.hoeneisen.ch (softronics.hoeneisen.ch [62.2.86.178]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 1990212787F for ; Wed, 20 Mar 2019 07:05:22 -0700 (PDT) Received: from localhost ([127.0.0.1]) by softronics.hoeneisen.ch with esmtp (Exim 4.86_2) (envelope-from ) id 1h6bqJ-0006aI-Np; Wed, 20 Mar 2019 15:05:19 +0100 Date: Wed, 20 Mar 2019 15:05:19 +0100 (CET) From: Bernie Hoeneisen X-X-Sender: bhoeneis@softronics.hoeneisen.ch To: John Levine cc: dmarc@ietf.org In-Reply-To: <20190319184209.804E42010381DB@ary.qy> Message-ID: References: <20190319184209.804E42010381DB@ary.qy> User-Agent: Alpine 2.20 (DEB 67 2015-01-07) MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII; format=flowed X-SA-Exim-Connect-IP: 127.0.0.1 X-SA-Exim-Mail-From: bernie@ietf.hoeneisen.ch X-SA-Exim-Scanned: No (on softronics.hoeneisen.ch); SAEximRunCond expanded to false Archived-At: Subject: Re: [dmarc-ietf] Email security beyond DMARC? X-BeenThere: dmarc@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Domain-based Message Authentication, Reporting, and Compliance \(DMARC\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 20 Mar 2019 14:05:26 -0000 On Tue, 19 Mar 2019, John Levine wrote: > In article <002a01d4de81$18ac27b0$4a047710$@bayviewphysicians.com> you write: >> Can one of you elaborate on the potential connection between PeP and DMARC, >> or more generally, the connection beteen PeP and spam filtering? > > I presume that PeP would make spam filtering much harder since the filters can't > look inside the messages. This is a mutual challenge of email systems that use true end-to-end encryption. While those improve Privacy, spam mitigation means need to be adjusted. On the other hand, pEp (inherently) also provides some additional means for spam mitigation / detection (on the client), e.g. end-to-end authentication of the peer user. If pEp is applied on top of existing email infrastructure (which is likely the case in most scenarios), DMARC can also be used in conjunction with pEp emails. cheers, Bernie From nobody Wed Mar 20 07:22:42 2019 Return-Path: X-Original-To: dmarc@ietfa.amsl.com Delivered-To: dmarc@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 043081275E9 for ; Wed, 20 Mar 2019 07:22:40 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_NONE=-0.0001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id PxB5l4jn53O8 for ; Wed, 20 Mar 2019 07:22:38 -0700 (PDT) Received: from softronics.hoeneisen.ch (softronics.hoeneisen.ch [62.2.86.178]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C9A3B126D00 for ; Wed, 20 Mar 2019 07:22:37 -0700 (PDT) Received: from localhost ([127.0.0.1]) by softronics.hoeneisen.ch with esmtp (Exim 4.86_2) (envelope-from ) id 1h6c71-0006fq-A1; Wed, 20 Mar 2019 15:22:35 +0100 Date: Wed, 20 Mar 2019 15:22:35 +0100 (CET) From: Bernie Hoeneisen X-X-Sender: bhoeneis@softronics.hoeneisen.ch To: DAMY gustavo cc: "dmarc@ietf.org" In-Reply-To: <8e26770d45b14816b3a5b9da33acf83a@PEXC01.upu.ch> Message-ID: References: <1dc451a973a8443a87d37b6e5c41fe38@bayviewphysicians.com> <90b936ec488f41108bc4e528eb7933f6@PEXC01.upu.ch> <002a01d4de81$18ac27b0$4a047710$@bayviewphysicians.com> <8e26770d45b14816b3a5b9da33acf83a@PEXC01.upu.ch> User-Agent: Alpine 2.20 (DEB 67 2015-01-07) MIME-Version: 1.0 Content-Type: text/plain; format=flowed; charset=US-ASCII X-SA-Exim-Connect-IP: 127.0.0.1 X-SA-Exim-Mail-From: bernie@ietf.hoeneisen.ch X-SA-Exim-Scanned: No (on softronics.hoeneisen.ch); SAEximRunCond expanded to false Archived-At: Subject: Re: [dmarc-ietf] Email security beyond DMARC? X-BeenThere: dmarc@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Domain-based Message Authentication, Reporting, and Compliance \(DMARC\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 20 Mar 2019 14:22:40 -0000 On Wed, 20 Mar 2019, DAMY gustavo wrote: > But pEp is also based on MIME (which requires trust on at least one > centralized CA which falls into the centralized infrastructure isn't it > ?) MIME does not require a centralized CA. I presume your mean S/MIME. pEp is not based on S/MIME. However, pEp is working on interoperability with S/MIME. > And yes I agree bad guys could use this as well (but probably they > already do it anyway) so through pEp + DMARC it wouldn't be even safer > to exchange messages finally an easy way to have End to end encryption > using open protocols for webmail (and not just rely on existing APPS/SW) > implementations? This depends on the requirements or threat scenarios a system is based on. If Privacy is top priority, I see no other way than using a true end-to-end system. cheers, Bernie From nobody Wed Mar 20 07:25:32 2019 Return-Path: X-Original-To: dmarc@ietfa.amsl.com Delivered-To: dmarc@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E07A4131165 for ; Wed, 20 Mar 2019 07:25:30 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2 X-Spam-Level: X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id kIxHMQtzh6RN for ; Wed, 20 Mar 2019 07:25:29 -0700 (PDT) Received: from mail-pg1-x533.google.com (mail-pg1-x533.google.com [IPv6:2607:f8b0:4864:20::533]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 33B3E131141 for ; Wed, 20 Mar 2019 07:25:29 -0700 (PDT) Received: by mail-pg1-x533.google.com with SMTP id y3so1908209pgk.12 for ; Wed, 20 Mar 2019 07:25:29 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=subject:to:cc:references:from:message-id:date:user-agent :mime-version:in-reply-to:content-language:content-transfer-encoding; bh=en0NC60k+Q19/sdkBRI3nMOqAErEMkDvuHJti8BujrM=; b=bI9vhiejCKKFcS0wv1wJ0uWQ/umvr4WUsLE75GuHQ9mkuzlShJOxjHUzJCHmfg5bR/ T3Li2/yitJnKjnTaLfuHCkn4hICcH7LTMfgB9QU8eV3zQPwdMF6V/mVN/eewqA8zBW42 w9B1svHaeacLNTC1RNsdbylvyAy4VojcKFsorDy0gUg2Fe2O9JbYIluSqTilw0TMSDtX fejfGuorhvx6SYt7kC6h3jVGF7PPPmd9xf5I7LZF2H4HYRHCnHf3gpsCaWtUIoUsWR2C 8l3Iej98LmHp2n4tG0endHMNMOYc7ZYL/MVAeYq6QSi9oJgvsE2/tEU5uiXKyUv30Yo7 Zgtw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:subject:to:cc:references:from:message-id:date :user-agent:mime-version:in-reply-to:content-language :content-transfer-encoding; bh=en0NC60k+Q19/sdkBRI3nMOqAErEMkDvuHJti8BujrM=; b=mWkJ+FxoU/YSw1+T58063xPUUdbbHdeMbBVupS3pdaE8qi3Rl/c8SbK0NHD6RV1VWT pm33+GH0M2OfSpA5/SwEdPVBgm+y7EAN+6YRv2S+Pl9/+V2FnjvWfCqje2UmiuMcDFCk MNtbUSFMUmvSECw0dcQVJRsB26diBoZH04r2M6fXTS+bCdU2FovIff6jYoz8391/oNaP pwJrLgjMzU89Kzk+Zo0TGawJi4YxQ+NM60FXpdG9Zbk2bzPFiBdgrUVeglVcvcLko+E9 afa5e00lEylykbl2McKpONX1LDhFCwjwfvJ/NGY4nKWmvf7L8W2UKled5hUC/FbHlKiR +O/Q== X-Gm-Message-State: APjAAAWlByc08ayYMO5migdqoFCJeGiMHkZA3NsmvjPdyVwS9xx5mAIu hbEWJr4wKAT/npQCqsabYLwKLijU X-Google-Smtp-Source: APXvYqwWSTUXj+H3448rlR0E+7zeCeBj0ggd4foVwQ7Nfzb412b7WQoW6lYcXieRdHI6fKnJWaR+vQ== X-Received: by 2002:a63:e106:: with SMTP id z6mr28699327pgh.418.1553091927794; Wed, 20 Mar 2019 07:25:27 -0700 (PDT) Received: from ?IPv6:2600:1700:a3a0:4c80:d188:aa4a:7cf9:309a? ([2600:1700:a3a0:4c80:d188:aa4a:7cf9:309a]) by smtp.gmail.com with ESMTPSA id r82sm5084427pfa.161.2019.03.20.07.25.26 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Wed, 20 Mar 2019 07:25:26 -0700 (PDT) To: Bernie Hoeneisen , DAMY gustavo Cc: "dmarc@ietf.org" References: <1dc451a973a8443a87d37b6e5c41fe38@bayviewphysicians.com> <90b936ec488f41108bc4e528eb7933f6@PEXC01.upu.ch> <002a01d4de81$18ac27b0$4a047710$@bayviewphysicians.com> <8e26770d45b14816b3a5b9da33acf83a@PEXC01.upu.ch> From: Dave Crocker Message-ID: <98e1d7e3-625e-ac9c-fd13-f25b5c380e3f@gmail.com> Date: Wed, 20 Mar 2019 07:25:24 -0700 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:60.0) Gecko/20100101 Thunderbird/60.6.0 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=utf-8; format=flowed Content-Language: en-US Content-Transfer-Encoding: 7bit Archived-At: Subject: Re: [dmarc-ietf] Email security beyond DMARC? X-BeenThere: dmarc@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Domain-based Message Authentication, Reporting, and Compliance \(DMARC\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 20 Mar 2019 14:25:32 -0000 On 3/20/2019 7:22 AM, Bernie Hoeneisen wrote: > >> But pEp is also based on MIME (which requires trust on at least one >> centralized CA which falls into the centralized infrastructure isn't >> it ?) > > MIME does not require a centralized CA. I presume your mean S/MIME. pEp > is not based on S/MIME. However, pEp is working on interoperability with > S/MIME. well, mime uses IANA for registering types, and that's certainly a centralized operation... d/ -- Dave Crocker Brandenburg InternetWorking bbiw.net From nobody Wed Mar 20 07:47:31 2019 Return-Path: X-Original-To: dmarc@ietfa.amsl.com Delivered-To: dmarc@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E14011279A8 for ; Wed, 20 Mar 2019 07:47:29 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.001 X-Spam-Level: X-Spam-Status: No, score=-2.001 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=tnetconsulting.net Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id nrnaVv-yqw8P for ; Wed, 20 Mar 2019 07:47:27 -0700 (PDT) Received: from tncsrv06.tnetconsulting.net (tncsrv06.tnetconsulting.net [IPv6:2600:3c00:e000:1e9::8849]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id CB6D0127988 for ; Wed, 20 Mar 2019 07:47:27 -0700 (PDT) Received: from Contact-TNet-Consulting-Abuse-for-assistance by tncsrv06.tnetconsulting.net (8.15.2/8.15.2/Debian-3) with ESMTPSA id x2KElP2c019340 (version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128 verify=NO) for ; Wed, 20 Mar 2019 09:47:27 -0500 ARC-Filter: OpenARC Filter v0.1.0 tncsrv06.tnetconsulting.net x2KElP2c019340 Authentication-Results: tncsrv06.tnetconsulting.net; arc=none header.d=tnetconsulting.net ARC-Seal: i=1; a=rsa-sha256; d=tnetconsulting.net; s=2015; t=1553093247; cv=none; b=k7yHh6B645sLsaWCZBC3UKyOnIJiFBd71oNwbyd2MjqLj57Y6qxm5IbllEChvtj9Ajw8YRCOZ5efX5pwY4Be7SULYX+LGHQJx3i1yVOxEcpJxLAOc+ARifVA8DmhQikU8zSY/bUqPc7yqBoBq98pIIZcw3cDXWySiopXfgFSo30= ARC-Message-Signature: i=1; a=rsa-sha256; d=tnetconsulting.net; s=2015; t=1553093247; c=relaxed/simple; bh=0oFxzpw3M18wRCUuG3PlLAaV4e2crjtcpSlAB/i6l34=; h=DKIM-Signature:Subject:To:From:Message-ID:Date:User-Agent: MIME-Version:Content-Type; b=NEjJPArBX75YRA5QiaU7LTkna50WNCXuDrnBiRh0lF3pfP0IL/WUZlsZ8/I4tUWZXd7CJc1fUu3gH2bggBnn82cWL3xNSUUkEp0XvJopEKD2Zb8eyqMzZ4APktTh3WKkXTq1P9A7Ha2CQrmdnCKk418KqSXDh6x59lmBAr866dA= ARC-Authentication-Results: i=1; tncsrv06.tnetconsulting.net; none DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=tnetconsulting.net; s=2019; t=1553093247; bh=0oFxzpw3M18wRCUuG3PlLAaV4e2crjtcpSlAB/i6l34=; h=Subject:To:References:From:Message-ID:Date:User-Agent: MIME-Version:In-Reply-To:Content-Type:Cc:Content-Disposition: Content-Language:Content-Transfer-Encoding:Content-Type:Date:From: In-Reply-To:Message-ID:MIME-Version:References:Reply-To: Resent-Date:Resent-From:Resent-To:Resent-Cc:Sender:Subject:To: User-Agent; b=KdUj0bshUdDyO9sTGsL7exHTb+QUQWLMy5phSllSZ70uTyAl42CXFsBTp3JDGIsA6 X8IHY09unPQ+dOjSMT3qFFzjlXLiHmAj1GhNounoBgZ6pScf9gICJ8GCZpIZia6wvR PvsDCLeqQ9U0BiZ7JVbpPVc/hI7OFepT4XlQbeuo= To: dmarc@ietf.org References: <1dc451a973a8443a87d37b6e5c41fe38@bayviewphysicians.com> <90b936ec488f41108bc4e528eb7933f6@PEXC01.upu.ch> <002a01d4de81$18ac27b0$4a047710$@bayviewphysicians.com> <8e26770d45b14816b3a5b9da33acf83a@PEXC01.upu.ch> <98e1d7e3-625e-ac9c-fd13-f25b5c380e3f@gmail.com> From: Grant Taylor Organization: TNet Consulting Message-ID: <227ea49c-c397-be6f-976e-929909d40d78@spamtrap.tnetconsulting.net> Date: Wed, 20 Mar 2019 08:47:24 -0600 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Thunderbird/60.5.1 MIME-Version: 1.0 In-Reply-To: <98e1d7e3-625e-ac9c-fd13-f25b5c380e3f@gmail.com> Content-Type: multipart/signed; protocol="application/pkcs7-signature"; micalg=sha-256; boundary="------------ms090705040002030603070705" Archived-At: Subject: Re: [dmarc-ietf] Email security beyond DMARC? X-BeenThere: dmarc@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Domain-based Message Authentication, Reporting, and Compliance \(DMARC\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 20 Mar 2019 14:47:30 -0000 This is a cryptographically signed message in MIME format. --------------ms090705040002030603070705 Content-Type: text/plain; charset=utf-8; format=flowed Content-Language: en-US Content-Transfer-Encoding: quoted-printable On 3/20/19 8:25 AM, Dave Crocker wrote: > well, mime uses IANA for registering types, and that's certainly a=20 > centralized operation... True. However there is a distinct difference in a central numbering authority=20 verses a central certificate authority. The former has little impact on = system security (presuming that everyone agrees / uses the same value=20 for things) compared to the latter, which has significant impact on=20 security. We can also operate without said central numbering authority if we all=20 agree that specific things are specific values. We can't (effectively)=20 operate without central certificate authorities. At least not given our = current operating model at the scale that we operate ate. --=20 Grant. . . . unix || die --------------ms090705040002030603070705 Content-Type: application/pkcs7-signature; name="smime.p7s" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="smime.p7s" Content-Description: S/MIME Cryptographic Signature MIAGCSqGSIb3DQEHAqCAMIACAQExDzANBglghkgBZQMEAgEFADCABgkqhkiG9w0BBwEAAKCC Cy4wggVAMIIEKKADAgECAhEA01fiRe1k2R6LEQCcImIMYTANBgkqhkiG9w0BAQsFADCBlzEL MAkGA1UEBhMCR0IxGzAZBgNVBAgTEkdyZWF0ZXIgTWFuY2hlc3RlcjEQMA4GA1UEBxMHU2Fs Zm9yZDEaMBgGA1UEChMRQ09NT0RPIENBIExpbWl0ZWQxPTA7BgNVBAMTNENPTU9ETyBSU0Eg Q2xpZW50IEF1dGhlbnRpY2F0aW9uIGFuZCBTZWN1cmUgRW1haWwgQ0EwHhcNMTgxMTE4MDAw MDAwWhcNMTkxMTE4MjM1OTU5WjArMSkwJwYJKoZIhvcNAQkBFhpndGF5bG9yQHRuZXRjb25z dWx0aW5nLm5ldDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBANgOhvncDgc4KAlD +pyhFpw6wCfeERlSOAXowjdTjlOR2zcIgzL0TM9A+hkSv2wsVh6fn6VvHGxKrLemReiGd7fQ 15Y9J/pxKOmShkw9DDtFsa18ozydp95X2IuzY8Z2JukxouqrfpSH4fOrrHLkOgvlFG4xaQHW 0KB8xUP5DFWyyZM5QCdq278GSJ5pUd+B6qmzwHESNF6syyvgLppXkFatLTz8pWf6eEngDA0Y 3fQ3Q2gnbgpryRhVQMa1GjQJ7LDroUGQhX2zBWePW+sShiTwo8jADYKsbgSGtvZ/42A8zxyg s9YZMHQoCeeuLNuX/MBp9rCTl5nlzP3jGWQTC5ECAwEAAaOCAfAwggHsMB8GA1UdIwQYMBaA FIKvbIz4xf6WYXzoHz0rcUhexIvAMB0GA1UdDgQWBBQg2PeEKxHWd4FaHe0T+gqAOWkC1jAO BgNVHQ8BAf8EBAMCBaAwDAYDVR0TAQH/BAIwADAgBgNVHSUEGTAXBggrBgEFBQcDBAYLKwYB BAGyMQEDBQIwEQYJYIZIAYb4QgEBBAQDAgUgMEYGA1UdIAQ/MD0wOwYMKwYBBAGyMQECAQEB MCswKQYIKwYBBQUHAgEWHWh0dHBzOi8vc2VjdXJlLmNvbW9kby5uZXQvQ1BTMFoGA1UdHwRT MFEwT6BNoEuGSWh0dHA6Ly9jcmwuY29tb2RvY2EuY29tL0NPTU9ET1JTQUNsaWVudEF1dGhl bnRpY2F0aW9uYW5kU2VjdXJlRW1haWxDQS5jcmwwgYsGCCsGAQUFBwEBBH8wfTBVBggrBgEF BQcwAoZJaHR0cDovL2NydC5jb21vZG9jYS5jb20vQ09NT0RPUlNBQ2xpZW50QXV0aGVudGlj YXRpb25hbmRTZWN1cmVFbWFpbENBLmNydDAkBggrBgEFBQcwAYYYaHR0cDovL29jc3AuY29t b2RvY2EuY29tMCUGA1UdEQQeMByBGmd0YXlsb3JAdG5ldGNvbnN1bHRpbmcubmV0MA0GCSqG SIb3DQEBCwUAA4IBAQCPxlHHG57PA5GUYlQuC8VHB7TcMQeEJKnB/S+bamyrck4vpIEaF9rG EM+OnAQsJzSkSVHD2707jxh1ng0jrsH2+F9qNGTpCksXo0fMqm4tf28Ag092+CZ5sfdjVZ4E ELG4xNhFZF9/aFaAY7RIeJ89Vvn6s6BnKsaAPjVB/sO+5gIm0BIeoVauq71ue6jS7o2Jn94o BuAhjuh34gk/Wxzcku96MLmEwCY63GWWKVRYbqrDhqROmnQPdyrDYrU8uD0vb4SAdpSKfRqO DrerlQgX3euyYqcnVJSA8Ec+NdiJrGKXW76C7DrTi7IxDgjIHL+DPyFgtj+p6wYOEkYJwKtp MIIF5jCCA86gAwIBAgIQapvhODv/K2ufAdXZuKdSVjANBgkqhkiG9w0BAQwFADCBhTELMAkG A1UEBhMCR0IxGzAZBgNVBAgTEkdyZWF0ZXIgTWFuY2hlc3RlcjEQMA4GA1UEBxMHU2FsZm9y ZDEaMBgGA1UEChMRQ09NT0RPIENBIExpbWl0ZWQxKzApBgNVBAMTIkNPTU9ETyBSU0EgQ2Vy dGlmaWNhdGlvbiBBdXRob3JpdHkwHhcNMTMwMTEwMDAwMDAwWhcNMjgwMTA5MjM1OTU5WjCB lzELMAkGA1UEBhMCR0IxGzAZBgNVBAgTEkdyZWF0ZXIgTWFuY2hlc3RlcjEQMA4GA1UEBxMH U2FsZm9yZDEaMBgGA1UEChMRQ09NT0RPIENBIExpbWl0ZWQxPTA7BgNVBAMTNENPTU9ETyBS U0EgQ2xpZW50IEF1dGhlbnRpY2F0aW9uIGFuZCBTZWN1cmUgRW1haWwgQ0EwggEiMA0GCSqG SIb3DQEBAQUAA4IBDwAwggEKAoIBAQC+s55XrCh2dUAWxzgDmNPGGHYhUPMleQtMtaDRfTpY PpynMS6n9jR22YRq2tA9NEjk6vW7rN/5sYFLIP1of3l0NKZ6fLWfF2VgJ5cijKYy/qlAckY1 wgOkUMgzKlWlVJGyK+UlNEQ1/5ErCsHq9x9aU/x1KwTdF/LCrT03Rl/FwFrf1XTCwa2QZYL5 5AqLPikFlgqOtzk06kb2qvGlnHJvijjI03BOrNpo+kZGpcHsgyO1/u1OZTaOo8wvEU17VVeP 1cHWse9tGKTDyUGg2hJZjrqck39UIm/nKbpDSZ0JsMoIw/JtOOg0JC56VzQgBo7ictReTQE5 LFLG3yQK+xS1AgMBAAGjggE8MIIBODAfBgNVHSMEGDAWgBS7r34CPfqm8TyEjq3uOJjs2TIy 1DAdBgNVHQ4EFgQUgq9sjPjF/pZhfOgfPStxSF7Ei8AwDgYDVR0PAQH/BAQDAgGGMBIGA1Ud EwEB/wQIMAYBAf8CAQAwEQYDVR0gBAowCDAGBgRVHSAAMEwGA1UdHwRFMEMwQaA/oD2GO2h0 dHA6Ly9jcmwuY29tb2RvY2EuY29tL0NPTU9ET1JTQUNlcnRpZmljYXRpb25BdXRob3JpdHku Y3JsMHEGCCsGAQUFBwEBBGUwYzA7BggrBgEFBQcwAoYvaHR0cDovL2NydC5jb21vZG9jYS5j b20vQ09NT0RPUlNBQWRkVHJ1c3RDQS5jcnQwJAYIKwYBBQUHMAGGGGh0dHA6Ly9vY3NwLmNv bW9kb2NhLmNvbTANBgkqhkiG9w0BAQwFAAOCAgEAeFyygSg0TzzuX1bOn5dW7I+iaxf28/ZJ CAbU2C81zd9A/tNx4+jsQgwRGiHjZrAYayZrrm78hOx7aEpkfNPQIHGG6Fvq3EzWf/Lvx7/h k6zSPwIal9v5IkDcZoFD7f3iT7PdkHJY9B51csvU50rxpEg1OyOT8fk2zvvPBuM4qQNqbGWl nhMpIMwpWZT89RY0wpJO+2V6eXEGGHsROs3njeP9DqqqAJaBa4wBeKOdGCWn1/Jp2oY6dyNm NppI4ZNMUH4Tam85S1j6E95u4+1Nuru84OrMIzqvISE2HN/56ebTOWlcrurffade2022O/tU U1gb4jfWCcyvB8czm12FgX/y/lRjmDbEA08QJNB2729Y+io1IYO3ztveBdvUCIYZojTq/OCR 6MvnzS6X72HP0PRLRTiOSEmIDsS5N5w/8IW1Hva5hEFy6fDAfd9yI+O+IMMAj1KcL/Zo9jzJ 16HO5m60ttl1Enk8MQkz/W3JlHaeI5iKFn4UJu1/cP2YHXYPiWf2JyBzsLBrGk1II+3yL8ao rYew6CQvdVifC3HtwlSam9V1niiCfOBe2C12TdKGu05LWIA3ZkFcWJGaNXOZ6Ggyh/TqvXG5 v7zmEVDNXFnHn9tFpMpOUvxhcsjycBtH0dZ0WrNw6gH+HF8TIhCnH3+zzWuDN0Rk6h9KVkfK ehIxggQ4MIIENAIBATCBrTCBlzELMAkGA1UEBhMCR0IxGzAZBgNVBAgTEkdyZWF0ZXIgTWFu Y2hlc3RlcjEQMA4GA1UEBxMHU2FsZm9yZDEaMBgGA1UEChMRQ09NT0RPIENBIExpbWl0ZWQx PTA7BgNVBAMTNENPTU9ETyBSU0EgQ2xpZW50IEF1dGhlbnRpY2F0aW9uIGFuZCBTZWN1cmUg RW1haWwgQ0ECEQDTV+JF7WTZHosRAJwiYgxhMA0GCWCGSAFlAwQCAQUAoIICWzAYBgkqhkiG 9w0BCQMxCwYJKoZIhvcNAQcBMBwGCSqGSIb3DQEJBTEPFw0xOTAzMjAxNDQ3MjVaMC8GCSqG SIb3DQEJBDEiBCDSLnRphlILr2JTbgm5B/iHurZpu6StEZINCDJ9JwVk2TBsBgkqhkiG9w0B CQ8xXzBdMAsGCWCGSAFlAwQBKjALBglghkgBZQMEAQIwCgYIKoZIhvcNAwcwDgYIKoZIhvcN AwICAgCAMA0GCCqGSIb3DQMCAgFAMAcGBSsOAwIHMA0GCCqGSIb3DQMCAgEoMIG+BgkrBgEE AYI3EAQxgbAwga0wgZcxCzAJBgNVBAYTAkdCMRswGQYDVQQIExJHcmVhdGVyIE1hbmNoZXN0 ZXIxEDAOBgNVBAcTB1NhbGZvcmQxGjAYBgNVBAoTEUNPTU9ETyBDQSBMaW1pdGVkMT0wOwYD VQQDEzRDT01PRE8gUlNBIENsaWVudCBBdXRoZW50aWNhdGlvbiBhbmQgU2VjdXJlIEVtYWls IENBAhEA01fiRe1k2R6LEQCcImIMYTCBwAYLKoZIhvcNAQkQAgsxgbCgga0wgZcxCzAJBgNV BAYTAkdCMRswGQYDVQQIExJHcmVhdGVyIE1hbmNoZXN0ZXIxEDAOBgNVBAcTB1NhbGZvcmQx GjAYBgNVBAoTEUNPTU9ETyBDQSBMaW1pdGVkMT0wOwYDVQQDEzRDT01PRE8gUlNBIENsaWVu dCBBdXRoZW50aWNhdGlvbiBhbmQgU2VjdXJlIEVtYWlsIENBAhEA01fiRe1k2R6LEQCcImIM YTANBgkqhkiG9w0BAQEFAASCAQBWw8vMuFgO4T/dXKRGdnCeswuFvc00btUOr7zUchiemOn0 DYhEsO1pyBeOUJYJsnQTHZL0xs6BLtUrqaLOP+rGNKIS+FcqIruLYfOIEnCaOFuQdOJ+Rh8b NvRXz7Sf2oa4Y9CK3TLajc8qa2eIxIQflQdXLQMFa4SADrQMLZaRmnMTLO1nCM/PW9ugfgI/ njVnDDjtuSUm2YpM0WgGsYrKWDb32fx/OJn2xkIZ5yauN1ADEHby6yhoAlMZnW6OhegYbRxN 1iChO86/2Ne0WhibdTtLKWnjmCmcNH4JOVf7gFfWkIB+NeRJTGIvkZcu9RUqDuIywluIaZG4 h7FNxqUFAAAAAAAA --------------ms090705040002030603070705-- From nobody Wed Mar 20 07:48:56 2019 Return-Path: X-Original-To: dmarc@ietfa.amsl.com Delivered-To: dmarc@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2F41E12950A for ; Wed, 20 Mar 2019 07:48:54 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.001 X-Spam-Level: X-Spam-Status: No, score=-2.001 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1536-bit key) header.d=iecc.com header.b=ndreWg+Q; dkim=pass (1536-bit key) header.d=taugh.com header.b=N0OSAyZh Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id kL4dCdUGD_ql for ; Wed, 20 Mar 2019 07:48:52 -0700 (PDT) Received: from gal.iecc.com (gal.iecc.com [IPv6:2001:470:1f07:1126:0:43:6f73:7461]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id BF2481279A8 for ; Wed, 20 Mar 2019 07:48:51 -0700 (PDT) Received: (qmail 90903 invoked from network); 20 Mar 2019 14:48:49 -0000 DKIM-Signature: v=1; a=rsa-sha256; c=simple; d=iecc.com; h=date:message-id:from:to:cc:subject:in-reply-to:references:mime-version:content-type:user-agent; s=16313.5c9252d1.k1903; bh=j4SfjPBDuqmnFsUYFTtHirdxo+Yv10GYSEu7mH1dOY8=; b=ndreWg+QnoO1+mXxeKboF+X8LT6t6KUavB/zMJRY9cb8yvqCWwjG5y3sDynG0ClsPY//9O+x0WAk+sypb4q5h8moW5NXB/D0uREJw0AjPvrraWuARwl5iMd0AOMDXnz8RFpDRqunAKM80NWp2WNzOq2DRUMM8qf4PaZcqmKu0i3AKUAN6hm3TPkyL0/unU/XwWs1SCmMEmtSuPi5rrL1UvN/8ridaO7nkLbtKwAxHY9PoF+VBRypuWucSr7ghS94 DKIM-Signature: v=1; a=rsa-sha256; c=simple; d=taugh.com; h=date:message-id:from:to:cc:subject:in-reply-to:references:mime-version:content-type:user-agent; s=16313.5c9252d1.k1903; bh=j4SfjPBDuqmnFsUYFTtHirdxo+Yv10GYSEu7mH1dOY8=; b=N0OSAyZh0DnCpFrEN9klNJpSrVwT5kHtQx98SciSHgVhw+uwUWe6xdyg9an1gayFTtA6atODqtJf3TveZNshRng56xH0+P0xaTDlbZtgWAqdgv9DQiOj0e2f/9QlNd/V5JocppPKI1w3kK9YMhSDuxZxHiEZd6c2iBh98kglG7Gy5UngB0rimruCNJGgqtsw3+c8wDV363jocN8Wh8Qs9DbCIiF5Ks+wCf//zMInRWxQleYrA6Rc9lPnaoODRp87 Received: from localhost ([IPv6:2001:470:1f07:1126::78:696d:6170]) by imap.iecc.com ([IPv6:2001:470:1f07:1126::78:696d:6170]) with ESMTP via TCP6; 20 Mar 2019 14:48:49 -0000 Date: 20 Mar 2019 10:48:48 -0400 Message-ID: From: "John R Levine" To: "Bernie Hoeneisen" Cc: dmarc@ietf.org In-Reply-To: References: <20190319184209.804E42010381DB@ary.qy> User-Agent: Alpine 2.21 (OSX 202 2017-01-01) MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII; format=flowed Archived-At: Subject: Re: [dmarc-ietf] Email security beyond DMARC? X-BeenThere: dmarc@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Domain-based Message Authentication, Reporting, and Compliance \(DMARC\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 20 Mar 2019 14:48:54 -0000 On Wed, 20 Mar 2019, Bernie Hoeneisen wrote: >> I presume that PeP would make spam filtering much harder since the filters >> can't look inside the messages. > > This is a mutual challenge of email systems that use true end-to-end > encryption. While those improve Privacy, spam mitigation means need to be > adjusted. I'm assuming that you don't have have much experience with spam filtering at scale. Let me just say that if you can't look inside the messages, there is a vast amount of spam you can't catch. Many systems send a mixture of spam and legit mail, which from the outside look the same. > On the other hand, pEp (inherently) also provides some additional means for > spam mitigation / detection (on the client), e.g. end-to-end authentication > of the peer user. This is a common misconception among people unfamiliar with spam filtering. The majority of the spam that makes it into my inbox is sent from real accounts that are either compromised or created in bulk at free mail sytstems. Authentication would make no difference since all that spam could authenticate perfectly. > If pEp is applied on top of existing email infrastructure (which is likely > the case in most scenarios), DMARC can also be used in conjunction with pEp > emails. DMARC has never been an anti-spam scheme. It's about phishing, which is not the same thing. Regards, John Levine, johnl@taugh.com, Taughannock Networks, Trumansburg NY Please consider the environment before reading this e-mail. https://jl.ly From nobody Thu Mar 21 06:01:06 2019 Return-Path: X-Original-To: dmarc@ietfa.amsl.com Delivered-To: dmarc@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B7AD512795E for ; Thu, 21 Mar 2019 06:01:04 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.001 X-Spam-Level: X-Spam-Status: No, score=-2.001 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=upu.int Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Smdal09nRpF0 for ; Thu, 21 Mar 2019 06:01:01 -0700 (PDT) Received: from mgw3.upu.int (mgw3.upu.int [193.247.49.9]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 9BE3012423B for ; Thu, 21 Mar 2019 06:01:00 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=upu.int; i=@upu.int; q=dns/txt; s=default; t=1553173257; x=1584709257; h=from:to:cc:subject:date:message-id:references: in-reply-to:content-transfer-encoding:mime-version; bh=f4SMIhuJkth27pQSgrvU4vUzNGBkUe05PWXd5x6NmO8=; b=XYOwIQsBbLDRmZf4BOCM8cCe4Ws955HII1hR960iqQLqxBvczarNeryw cPjSsW+Oqg/9fsyjYZuXl1qzrvMo2exKdqFhCKgs4Z+IDoD8ozZYRq6tz dfreQSh7Xxe6brfftlxy368kZw0xxpP/DJnGk/8g+R2/QSc70hjg8tqhF 0ZkMmQMgGvFApu/1RcgobtOQQ1PcOinQJwESkflEcCtQDGBgYTtV4I6T8 T7gW3q99OU4pvhn48SHHYRzwfuiEHDcRxW1u0sDYilawBORM7VvCAKSyk siLmJXxz1fGhYiNknbR7bT5ub2EPJOSmVquXTvSN1BkJSUk45hPkqLgK8 w==; Authentication-Results: mgw3.upu.ch; spf=Pass smtp.mailfrom=gustavo.DAMY@upu.int; spf=None smtp.helo=postmaster@PEXC01.upu.ch Received-SPF: Pass (mgw3.upu.ch: domain of gustavo.DAMY@upu.int designates 193.247.55.160 as permitted sender) identity=mailfrom; client-ip=193.247.55.160; receiver=mgw3.upu.ch; envelope-from="gustavo.DAMY@upu.int"; x-sender="gustavo.DAMY@upu.int"; x-conformance=spf_only; x-record-type="v=spf1"; x-record-text="v=spf1 ip4:193.247.55.160/32 ip4:193.247.55.161/32 ip4:80.80.227.166/32 ip4:193.247.63.15/32 +a:erecruit.noreply.upu.int +mx -all" Received-SPF: None (mgw3.upu.ch: no sender authenticity information available from domain of postmaster@PEXC01.upu.ch) identity=helo; client-ip=193.247.55.160; receiver=mgw3.upu.ch; envelope-from="gustavo.DAMY@upu.int"; x-sender="postmaster@PEXC01.upu.ch"; x-conformance=spf_only IronPort-SDR: czVtZW+iOLisXABtQfivxis5vzZfXC+yT/rKbcbU7FILjsDo13eQK5GC0/Oq9EVOJlmjEb5lJ/ 4dc3iGWRWP9qeoOCStHOjuiG9p40SfnOVNK/zejvpNn8L09/0U2Itb8VUTddDnX4kO+oMO12Yu SMTPCzNAvIkGVcG+Up+R21WzGC8nFlUjRg8TngQOjcX3vC2mC6Eoyxjv2lMEWopXJMJPP2M80r Qyh+3frm391BV0LZWUCvCk3bsrl3i3NKbwbmwFThe13m2/GhnsZMmXDak74L6v3jh/YPOsdkYI +OA= X-IronPort-AV: E=Sophos;i="5.60,252,1549926000"; d="scan'208";a="1863314" Received: from PEXC01.upu.ch (2002:c1f7:37a0::c1f7:37a0) by PEXC01.upu.ch (2002:c1f7:37a0::c1f7:37a0) with Microsoft SMTP Server (TLS) id 15.0.1130.7; Thu, 21 Mar 2019 14:00:47 +0100 Received: from PEXC01.upu.ch ([fe80::28c1:e4c1:2f2e:11fc]) by PEXC01.upu.ch ([fe80::28c1:e4c1:2f2e:11fc%13]) with mapi id 15.00.1130.005; Thu, 21 Mar 2019 14:00:47 +0100 From: DAMY gustavo To: John R Levine CC: "dmarc@ietf.org" , Bernie Hoeneisen Thread-Topic: [dmarc-ietf] Email security beyond DMARC? Thread-Index: AQHU3093v/AeslasNkiUwE096qOcBKYWC7zA Date: Thu, 21 Mar 2019 13:00:46 +0000 Message-ID: References: <20190319184209.804E42010381DB@ary.qy> In-Reply-To: Accept-Language: en-GB, fr-CH, en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [172.22.0.30] Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Archived-At: Subject: Re: [dmarc-ietf] Email security beyond DMARC? X-BeenThere: dmarc@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Domain-based Message Authentication, Reporting, and Compliance \(DMARC\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 21 Mar 2019 13:01:05 -0000 Dear John, But if the AIM is to have an end to end easier to implement encryption + p= hishing protection, probably it would make sense?=20 This will not reduce the SPAM but using DMARC and properly tune the policy = P=3Dreject; pct=3D100 would help to secure the content and reduce the phish= ing, (and sure definitely will not help to avoid SPAM) from those compro= mised accounts. > If pEp is applied on top of existing email infrastructure (which is=20 > likely the case in most scenarios), DMARC can also be used in=20 > conjunction with pEp emails. DMARC has never been an anti-spam scheme. It's about phishing, which is no= t the same thing. Regards. Gustavo From nobody Thu Mar 21 06:36:38 2019 Return-Path: X-Original-To: dmarc@ietfa.amsl.com Delivered-To: dmarc@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2295B13111E for ; Thu, 21 Mar 2019 06:36:26 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.998 X-Spam-Level: X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id QfdkEH5w4nyW for ; Thu, 21 Mar 2019 06:36:24 -0700 (PDT) Received: from mail-wm1-x336.google.com (mail-wm1-x336.google.com [IPv6:2a00:1450:4864:20::336]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 310EC131023 for ; Thu, 21 Mar 2019 06:36:24 -0700 (PDT) Received: by mail-wm1-x336.google.com with SMTP id t124so2709004wma.4 for ; Thu, 21 Mar 2019 06:36:24 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=wiJnaf5e32y/q/z1dY2Tr041H5w4ZqjgKFdyH1vas1k=; b=IfR/OLl5shdBlvujXGChTUHtS8fse0T9e/DRJdfUnuPa4TaI3GVKlSgjYW6GrTEc2p mZa9nn4i6+nhtv+fH4vgJ9fVv6eaSQCeNv1+LEN8Cz0dr2SBdP7mt3Wb69FbNoyDsGFO usbkV+9noqjcMpDhOfZqbvJHSPlH4NJUjYg8VEHSkbonr+wbuiSWxRG6+0lUTmfMaj4A 0zRMD+hHjUiamhxSgn1kdDB7lYNG7B7C7Fhot6fAXlugZNDUWryz/Etkgua7f9JHZy5/ 6B45+Omy4FD2PUretbhzhyzPQxSfI0sPynm6io5n5DSbV+o74hWqpvrwEQs0opZuXk2b hNSw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=wiJnaf5e32y/q/z1dY2Tr041H5w4ZqjgKFdyH1vas1k=; b=ddfS/45KWzaPyAS3qm1iIGRrxKFjlWkJutvGLf/NIDID5qd8heKLsuQYnXKQMMIl+G h265M1ACOXyGRsSD4T9139iS+v+jOOhoPGzxVrrPWBSh4sS/WS1bGhcpu55R3zFO4MyM 6Bvqs5wKlXD+7hgscYM2uIPF9ON8KfhBOI3b/M29hhEbM4L9PkHK/QGoNm7UEbqwW8Md jCDfPwR11WKuGnjkAPzZCG8ykrRp3jPgDt/jVPRfinvUxnaPWEvrXOxY+dfG3MU5w0fi 1MoqNZ5l0MdRgvIZ8ot4HqgEBzfni4Kz7TTu67c0v8OeGo598yUkKub+F9src7FSPS3f 85Hw== X-Gm-Message-State: APjAAAUvv/Edg7WlDcrcybWaIiUcnVYmsi/MyfyvbLfJEU10uGpLJ3ux ajTPBldaxYqha9ONpwvIsvpnTMDMJajjWYj+GlINRA== X-Google-Smtp-Source: APXvYqw59aVGo4bVGMxuafy++0xO+k8NkLjBrinz+AgqsxNt8FlxjjUU2Ssx4ded+b1kG6VZ8tK22YPpreilTL2o8jM= X-Received: by 2002:a1c:e143:: with SMTP id y64mr2456286wmg.141.1553175382679; Thu, 21 Mar 2019 06:36:22 -0700 (PDT) MIME-Version: 1.0 References: <20190319184209.804E42010381DB@ary.qy> In-Reply-To: From: Dotzero Date: Thu, 21 Mar 2019 09:36:13 -0400 Message-ID: To: John R Levine Cc: Bernie Hoeneisen , IETF DMARC WG Content-Type: multipart/alternative; boundary="000000000000f57dfa05849ad245" Archived-At: Subject: Re: [dmarc-ietf] Email security beyond DMARC? X-BeenThere: dmarc@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Domain-based Message Authentication, Reporting, and Compliance \(DMARC\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 21 Mar 2019 13:36:36 -0000 --000000000000f57dfa05849ad245 Content-Type: text/plain; charset="UTF-8" On Wed, Mar 20, 2019 at 10:49 AM John R Levine wrote: > > DMARC has never been an anti-spam scheme. It's about phishing, which is > not the same thing. > I'm going to have to disagree with you John. DMARC is about preventing direct domain abuse. It does not specifically address phishing as the bad guys can simply use cousin domains, homoglyphs, etc. Michael Hammer --000000000000f57dfa05849ad245 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


=
On Wed, Mar 20, 2019 at 10:49 AM John= R Levine <johnl@taugh.com> wr= ote:

DMARC has never been an anti-spam scheme.=C2=A0 It's about phishing, wh= ich is
not the same thing.

I'm going to ha= ve to disagree with you John. DMARC is about preventing direct domain abuse= . It does not specifically address phishing as the bad guys can simply use = cousin domains, homoglyphs, etc.=C2=A0

Michael Ham= mer
--000000000000f57dfa05849ad245-- From nobody Thu Mar 21 07:31:06 2019 Return-Path: X-Original-To: dmarc@ietfa.amsl.com Delivered-To: dmarc@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9B212131150 for ; Thu, 21 Mar 2019 07:31:04 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2 X-Spam-Level: X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1536-bit key) header.d=iecc.com header.b=LdWg9Gnf; dkim=pass (1536-bit key) header.d=taugh.com header.b=AouKx6mW Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id AALb6osm1M5C for ; Thu, 21 Mar 2019 07:31:03 -0700 (PDT) Received: from gal.iecc.com (gal.iecc.com [IPv6:2001:470:1f07:1126:0:43:6f73:7461]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id DC9571310E1 for ; Thu, 21 Mar 2019 07:31:02 -0700 (PDT) Received: (qmail 19031 invoked from network); 21 Mar 2019 14:31:01 -0000 DKIM-Signature: v=1; a=rsa-sha256; c=simple; d=iecc.com; h=date:message-id:from:to:cc:subject:in-reply-to:references:mime-version:content-type:user-agent; s=4a54.5c93a025.k1903; bh=7jKTMufPzlo3ot4rOzrvZSyKYXAuqWE/SjASl3BIBCw=; b=LdWg9Gnf+6B0fRC2sUiH/p849L2k3iga4+0CAE56D7W3ZFs+q8U60Usfq+JjarUqe4p/4WnTZk/yKQ4MPzuKjWTishTCTsM+DGVhMkP5KXo7kAj4UHzmRD07V9Z1cdvteqZgrZaU/8QCjgOPTL2QLHAH4IzCwNKKQcXd0KUwCITbD9IxBR/EaGcrv3CZI22WAWGD7qEgGxMPHcSWWNVqdWNWWrX6jRiq/wdus8MAGJ9R5sTJkqT5FKnPSBFbPbFF DKIM-Signature: v=1; a=rsa-sha256; c=simple; d=taugh.com; h=date:message-id:from:to:cc:subject:in-reply-to:references:mime-version:content-type:user-agent; s=4a54.5c93a025.k1903; bh=7jKTMufPzlo3ot4rOzrvZSyKYXAuqWE/SjASl3BIBCw=; b=AouKx6mWHfT2UZFTqbeqT2O/7u2zKiW/sfOvmlOYaiDB6O4fvjK36gOLwNDNAyyaZEpMzFIaFMv6XwAm4blfO1Jo4EV3MR6dsTvBLZ21JlNJzNhUZhpqhNSPoPrBTP1l1wXso7mX6en5kVEApk8R+rSYx95fWcwVz+/esOUlpTLlAlKgGW8D09ITZ/rcl0VK9J8i5t8Mln5OLsZan/RJeezNyZPNB/CbIPpKKOEhr3EgfvURPfNO9vFbZTmKnNfi Received: from localhost ([IPv6:2001:470:1f07:1126::78:696d:6170]) by imap.iecc.com ([IPv6:2001:470:1f07:1126::78:696d:6170]) with ESMTP via TCP6; 21 Mar 2019 14:31:01 -0000 Date: 21 Mar 2019 10:31:00 -0400 Message-ID: From: "John R Levine" To: "DAMY gustavo" Cc: "dmarc@ietf.org" In-Reply-To: References: <20190319184209.804E42010381DB@ary.qy> User-Agent: Alpine 2.21 (OSX 202 2017-01-01) MIME-Version: 1.0 Content-Type: text/plain; format=flowed; charset=US-ASCII Archived-At: Subject: Re: [dmarc-ietf] Email security beyond DMARC? X-BeenThere: dmarc@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Domain-based Message Authentication, Reporting, and Compliance \(DMARC\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 21 Mar 2019 14:31:05 -0000 > But if the AIM is to have an end to end easier to implement encryption + > phishing protection, probably it would make sense? Not really. > This will not reduce the SPAM but using DMARC and properly tune the > policy P=reject; pct=100 would help to secure the content and reduce the > phishing, (and sure definitely will not help to avoid SPAM) from those > compromised accounts. Nope. Please review my previous message. Regards, John Levine, johnl@taugh.com, Taughannock Networks, Trumansburg NY Please consider the environment before reading this e-mail. https://jl.ly From nobody Thu Mar 21 07:32:39 2019 Return-Path: X-Original-To: dmarc@ietfa.amsl.com Delivered-To: dmarc@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7F0F8130FF3 for ; Thu, 21 Mar 2019 07:32:37 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.001 X-Spam-Level: X-Spam-Status: No, score=-2.001 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1536-bit key) header.d=iecc.com header.b=FwboxfaJ; dkim=pass (1536-bit key) header.d=taugh.com header.b=Z1NzlOeM Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id u_NNHHl05b-m for ; Thu, 21 Mar 2019 07:32:36 -0700 (PDT) Received: from gal.iecc.com (gal.iecc.com [IPv6:2001:470:1f07:1126:0:43:6f73:7461]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B97A512782C for ; Thu, 21 Mar 2019 07:32:35 -0700 (PDT) Received: (qmail 19499 invoked from network); 21 Mar 2019 14:32:34 -0000 DKIM-Signature: v=1; a=rsa-sha256; c=simple; d=iecc.com; h=date:message-id:from:to:cc:subject:in-reply-to:references:mime-version:content-type:user-agent; s=4c29.5c93a082.k1903; bh=6IspOD9IzWfRxHNBpqYC2upQrEmTs4Z42Zxtw9V3gJs=; b=FwboxfaJ9YK2ZxoIJuR0H5yyikc8ibpbhj3PC58wYojlcy36f8ZLQn2LUb5kxJ6Tt7r7SFM98g5bbvJEZMJfdq34sFEJKcnPgIZ+ps5bOxHCscH4l4NiZFIzkDkomNtU8+KNVijohqA1kAgLGuVpadfnYzg16iFuimPGisZyPwNu89mgBYQfoqjFJxgDzJUUpuetU6sCaRcYAB2OxBRMiPg7LMrOXdIWlnR3aH6dXI6TE3JRuaY+XI+CSD+UnhMU DKIM-Signature: v=1; a=rsa-sha256; c=simple; d=taugh.com; h=date:message-id:from:to:cc:subject:in-reply-to:references:mime-version:content-type:user-agent; s=4c29.5c93a082.k1903; bh=6IspOD9IzWfRxHNBpqYC2upQrEmTs4Z42Zxtw9V3gJs=; b=Z1NzlOeMCorIrUW0YkTnPK33b0PLssaNskmaEAKZxlAMoXWZQl7TAtkiwlhEzQprwwbKK9sdi/7vfMjJ47e7y8d4pfSBbEfxjL/wRsTEO4z05jd0H7OTDgZDinnNTvJUY17SWLG5Y/+CAyLnsHhX44hPJrUKww1f/wc4JhsutW7xnda2vZJAgd2m4UVsoZANvqmsnNA1KOduU+EZaQaRPOQzTSB28l9e/H/LxMIqbaFVT2DNqFKLPPJoAzw6YYSz Received: from localhost ([IPv6:2001:470:1f07:1126::78:696d:6170]) by imap.iecc.com ([IPv6:2001:470:1f07:1126::78:696d:6170]) with ESMTP via TCP6; 21 Mar 2019 14:32:34 -0000 Date: 21 Mar 2019 10:32:34 -0400 Message-ID: From: "John R Levine" To: "Dotzero" Cc: "IETF DMARC WG" In-Reply-To: References: <20190319184209.804E42010381DB@ary.qy> User-Agent: Alpine 2.21 (OSX 202 2017-01-01) MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII; format=flowed Archived-At: Subject: Re: [dmarc-ietf] Email security beyond DMARC? X-BeenThere: dmarc@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Domain-based Message Authentication, Reporting, and Compliance \(DMARC\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 21 Mar 2019 14:32:37 -0000 >> DMARC has never been an anti-spam scheme. It's about phishing, which is >> not the same thing. > > I'm going to have to disagree with you John. DMARC is about preventing > direct domain abuse. It does not specifically address phishing as the bad > guys can simply use cousin domains, homoglyphs, etc. Well, it's abount a subset of phishing. It's surely more about phishing than about spam. R's, John PS: on the other hand, if your point is that DMARC impases significant costs for small and dubious benefits, I wouldn't disagree. From ksimpson@mailchannels.com Thu Mar 21 10:01:36 2019 Return-Path: X-Original-To: dmarc@ietfa.amsl.com Delivered-To: dmarc@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id DD82413145F for ; Thu, 21 Mar 2019 10:01:36 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2 X-Spam-Level: X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=mailchannels.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id vmrFwvo0fIAf for ; Thu, 21 Mar 2019 10:01:34 -0700 (PDT) Received: from mail-ot1-x32a.google.com (mail-ot1-x32a.google.com [IPv6:2607:f8b0:4864:20::32a]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id CD4E913147D for ; Thu, 21 Mar 2019 10:01:26 -0700 (PDT) Received: by mail-ot1-x32a.google.com with SMTP id c18so5999743otl.13 for ; Thu, 21 Mar 2019 10:01:26 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=mailchannels.com; s=google; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=Zq8cgI/fCbm0EdV9udWMyaQbzTkii6fSLuPQ4DrY7dA=; b=iIMf9EJgs5MfVZIx2szjk8MzkeOBHFhFWYoGkjRhPKvP1ZkRULWKJ0UZwMnMudoDoy pSFhC7T2Ib5fy+lopVQL1Iro907lDWfIw019zNnbz3OR971QHLAc37miDQWH5rPyvLLl SKh3iUh1egADYN2n10N0+LM8J4goFO+qc8PvA= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=Zq8cgI/fCbm0EdV9udWMyaQbzTkii6fSLuPQ4DrY7dA=; b=Ddu2IIZBfRgjkwn9eQc9eBwLJk2yf0SWg5tJrURsLdpjIZlbUPLYhI3YBCMrSKLaK3 utP0afhiAtgIk3ThRsR8c6Ikw+MyQ24eIc8fthPDPzxU/oN7tlBnjCyC4x9Pc+KfuCRq w+/IIXLUp7j/oJsfW53TmJEXu/1WbYAna3FyExEmImFoYcu0EOYcC7WIveIyIAIH7Xzd Cjh0G1KNGNeA0CWea0p1KX63XjQYla4DnD/A3DuN9Ku/fs7mYDg/tJOAdgIo1UjZ0HkJ sZkK2z6aeCJAq+GnwvSGSXm2XdN1dxKJuL5si1wClh0e+wX12nnIdk7PTEEC43XdlsEr oN7g== X-Gm-Message-State: APjAAAVjDx8BhYWGSucGHfWiyDLRW5WtthVVZt+oU1WGtr2CAIQw6jxw BWB2E/HOKWrEzgi2lc4lfvsftg3x7iCw2NZHKcB28g== X-Google-Smtp-Source: APXvYqwvICbdMGI9tt6MWnubxcO2gQk09M+OEL0CqpUKZhhx4p3mOyGGIA27xEWWgShLEZcfB0BEPrf8ssmT+LA6yLU= X-Received: by 2002:a9d:7359:: with SMTP id l25mr3190240otk.189.1553187685743; Thu, 21 Mar 2019 10:01:25 -0700 (PDT) MIME-Version: 1.0 References: <20190319184209.804E42010381DB@ary.qy> In-Reply-To: From: Ken Simpson Date: Thu, 21 Mar 2019 10:00:49 -0700 Message-ID: To: John R Levine Cc: Dotzero , IETF DMARC WG Content-Type: multipart/alternative; boundary="00000000000047565e05849db01b" Archived-At: Subject: Re: [dmarc-ietf] Email security beyond DMARC? X-BeenThere: dmarc@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Domain-based Message Authentication, Reporting, and Compliance \(DMARC\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 21 Mar 2019 17:02:53 -0000 --00000000000047565e05849db01b Content-Type: text/plain; charset="UTF-8" > > > > I'm going to have to disagree with you John. DMARC is about preventing > > direct domain abuse. It does not specifically address phishing as the bad > > guys can simply use cousin domains, homoglyphs, etc. > > Well, it's abount a subset of phishing. It's surely more about phishing > than about spam. IMHO, by cutting out direct domain spoofing, DMARC makes it easier for receivers to craft algorithms that spot impersonation attacks. Once you have configured DMARC, receivers can build - for example - a machine learning system that learns what your legitimate email looks like. They can use that same system to identify messages that look like your legitimate email but which do not actually originate from your domain. If you want to detect domain impersonation or "brand" impersonation, you first have to have a verifiable ground truth corpus. That is what DMARC offers. Regards, Ken --00000000000047565e05849db01b Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable

> I'm going to have to disagree with you John. DMARC is about= preventing
> direct domain abuse. It does not specifically address phishing as the = bad
> guys can simply use cousin domains, homoglyphs, etc.

Well, it's abount a subset of phishing.=C2=A0 It's surely more abou= t phishing
than about spam.

IMHO, by cutting out direc= t domain spoofing, DMARC makes it easier for receivers to craft algorithms = that spot impersonation attacks. Once you have configured DMARC, receivers = can build - for example - a machine learning system that learns what your l= egitimate email looks like. They can use that same system to identify messa= ges that look like your legitimate email but which do not actually originat= e from your domain.

If you want to detect domain i= mpersonation or "brand" impersonation, you first have to have a v= erifiable ground truth corpus. That is what DMARC offers.

Regards,
Ken=C2=A0

=
--00000000000047565e05849db01b-- From nobody Thu Mar 21 10:09:25 2019 Return-Path: X-Original-To: dmarc@ietfa.amsl.com Delivered-To: dmarc@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7E8F2131313 for ; Thu, 21 Mar 2019 10:09:22 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2 X-Spam-Level: X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1536-bit key) header.d=iecc.com header.b=xq20VO4r; dkim=pass (1536-bit key) header.d=taugh.com header.b=a3EoaFHF Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 3RKPzfRB9_iS for ; Thu, 21 Mar 2019 10:09:20 -0700 (PDT) Received: from gal.iecc.com (gal.iecc.com [IPv6:2001:470:1f07:1126:0:43:6f73:7461]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A7A4913140D for ; Thu, 21 Mar 2019 10:09:20 -0700 (PDT) Received: (qmail 72914 invoked from network); 21 Mar 2019 17:09:19 -0000 DKIM-Signature: v=1; a=rsa-sha256; c=simple; d=iecc.com; h=date:message-id:from:to:cc:subject:in-reply-to:references:mime-version:content-type:user-agent; s=11cce.5c93c53f.k1903; bh=niQLwMITi/WBwN5Ch6lBEkgsHLcEW2oUz7a+pA9XfGw=; b=xq20VO4r/tHqUrVcRomiZE8AB7lcqY0H3xsuW1b2S+56dWSR1gkm82mmP/VuInsNBJbWb0PhC0y3HYxl82cmV2F/PPpSi404l5bEFvy+sDkFqgXwk4qaZFdJR0Km7CilH1xhptysJRlPCBwy1AMA0bnMmOdFrM0UhQS6kTXOpXc/dhpCZlGHaz0tWUdBRuGpJ2bEQFpG/Z48b0G8OYyGhIFp13AIKRntAcFc4lq5OgspuwfaHHg6EnfC4dRmnnsq DKIM-Signature: v=1; a=rsa-sha256; c=simple; d=taugh.com; h=date:message-id:from:to:cc:subject:in-reply-to:references:mime-version:content-type:user-agent; s=11cce.5c93c53f.k1903; bh=niQLwMITi/WBwN5Ch6lBEkgsHLcEW2oUz7a+pA9XfGw=; b=a3EoaFHFOYKnkmB1yUXntkZrDySowRZxyTnnMMaRu/2MazGL+nWAH+JYbYDjhexXX5FvZHPW2k6ACZoV44lQquXsXgZCIpmOhx1bMB3AQxyuWaBxFA96yXGFAj28OQTwt1TfMhvx+hEsEniZEpmuEQEZU3FmmIgSkcbP43QYqfJqDqdPt/7Vrv9r0jbeDaXwsvhUgSduBIZNjp34JLLVJEa8owLvWffUUpdx2s8MtdWdRg96+VtrPLyExB1kBIOI Received: from localhost ([IPv6:2001:470:1f07:1126::78:696d:6170]) by imap.iecc.com ([IPv6:2001:470:1f07:1126::78:696d:6170]) with ESMTP via TCP6; 21 Mar 2019 17:09:19 -0000 Date: 21 Mar 2019 13:09:18 -0400 Message-ID: From: "John R Levine" To: "Ken Simpson" Cc: "IETF DMARC WG" In-Reply-To: References: <20190319184209.804E42010381DB@ary.qy> User-Agent: Alpine 2.21 (OSX 202 2017-01-01) MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII; format=flowed Archived-At: Subject: Re: [dmarc-ietf] Email security beyond DMARC? X-BeenThere: dmarc@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Domain-based Message Authentication, Reporting, and Compliance \(DMARC\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 21 Mar 2019 17:09:22 -0000 > IMHO, by cutting out direct domain spoofing, DMARC makes it easier for > receivers to craft algorithms that spot impersonation attacks. I realize that's the theory, but do we know how well that works in practice? Regards, John Levine, johnl@taugh.com, Taughannock Networks, Trumansburg NY Please consider the environment before reading this e-mail. https://jl.ly From nobody Thu Mar 21 10:13:34 2019 Return-Path: X-Original-To: dmarc@ietfa.amsl.com Delivered-To: dmarc@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id DDAA2131457 for ; Thu, 21 Mar 2019 10:13:31 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.999 X-Spam-Level: X-Spam-Status: No, score=-1.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=mailchannels.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id J8YJXiiwN2Mz for ; Thu, 21 Mar 2019 10:13:30 -0700 (PDT) Received: from mail-ot1-x331.google.com (mail-ot1-x331.google.com [IPv6:2607:f8b0:4864:20::331]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 60F13131451 for ; Thu, 21 Mar 2019 10:13:29 -0700 (PDT) Received: by mail-ot1-x331.google.com with SMTP id 64so1523953otb.8 for ; Thu, 21 Mar 2019 10:13:29 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=mailchannels.com; s=google; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=wdBKn/ynvD1l48HbWc1P1poJAcf09GrkO4+bRxbeN5o=; b=btz4w8eZ1jN04VomgAcmrBddIPsSe9WWNE++aKtUnObsvZh2B9u+CG1Ka2qU34ikpJ PlDJZYGqGfnsV1B+EZNGC1IKYkFHi3s/I9axDRP7HOHlFLCVvfl71+KUhbt4rPDnAQX1 NeITtg3YIlkqx+V1+rjApCqeXq/KXCoUULw6s= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=wdBKn/ynvD1l48HbWc1P1poJAcf09GrkO4+bRxbeN5o=; b=eaHlc0HRogRvVmtkGayBKyBZY8fOJA1WEbFLI6EW2oIE4FfKxcATNDwvM5pg1RLKFB 5KdazA0fB6mtA6CkAJ5s+nJrVQZas7OOqFzvbvXYbw9nnrm5rj3XMjdpKzu7AJCdEVHc jMMhCASdTP/3Opg+t0SYec+zp9lUhvDQbn1HnxLxTwp6jWRW9YjYMYXx7t+soFKM+Io7 QEVCCP1i9kV4KrFwNhmtexu81kP2W0t/xc7v330Q09QXCqHYw7I0jYLAgJ6TQShQKDJH gYiIo1PmuRQV8/1J1QjFTbeCdbLVYIXxSoTXIsPyCnjGD/F4hz3YcWHvZUWJBRk2rxkG maIQ== X-Gm-Message-State: APjAAAWB82oXUjkiikfl9+pr8LO40vWSb6vISg43METy1mwYxaoLr8l2 uQYNdVdhaAylk7rD2spZHGbQEDJntTOdmMpO6PmZKg== X-Google-Smtp-Source: APXvYqxpF9Yps+hAWngjCHbHXSaBwkqKm18XicQiD4KtBsna6JCf7p/tXZ7lMTkjwuVJjLKCjFh7HODf4BFPdunW7bw= X-Received: by 2002:a9d:3e02:: with SMTP id a2mr3370926otd.232.1553188408496; Thu, 21 Mar 2019 10:13:28 -0700 (PDT) MIME-Version: 1.0 References: <20190319184209.804E42010381DB@ary.qy> In-Reply-To: From: Ken Simpson Date: Thu, 21 Mar 2019 10:12:52 -0700 Message-ID: To: John R Levine Cc: IETF DMARC WG Content-Type: multipart/alternative; boundary="0000000000005bb4db05849ddb9e" Archived-At: Subject: Re: [dmarc-ietf] Email security beyond DMARC? X-BeenThere: dmarc@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Domain-based Message Authentication, Reporting, and Compliance \(DMARC\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 21 Mar 2019 17:13:32 -0000 --0000000000005bb4db05849ddb9e Content-Type: text/plain; charset="UTF-8" On Thu, Mar 21, 2019 at 10:09 AM John R Levine wrote: > > IMHO, by cutting out direct domain spoofing, DMARC makes it easier for > > receivers to craft algorithms that spot impersonation attacks. > > I realize that's the theory, but do we know how well that works in > practice? > That would be crossing into the realm of tradecraft. Regards, Ken --0000000000005bb4db05849ddb9e Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
On Thu, Mar 21, 2019 at 10:09 AM John R L= evine <johnl@taugh.com> wrote:=
> IMHO, by cutting= out direct domain spoofing, DMARC makes it easier for
> receivers to craft algorithms that spot impersonation attacks.

I realize that's the theory, but do we know how well that works in
practice?

That would be crossing into t= he realm of tradecraft.

Regards,
Ken=C2= =A0
--0000000000005bb4db05849ddb9e-- From nobody Thu Mar 21 10:45:54 2019 Return-Path: X-Original-To: dmarc@ietfa.amsl.com Delivered-To: dmarc@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E637013151C for ; Thu, 21 Mar 2019 10:45:52 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.4 X-Spam-Level: X-Spam-Status: No, score=-2.4 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_INVALID=0.1, DKIM_SIGNED=0.1, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=fail (1024-bit key) reason="fail (message has been altered)" header.d=dcrocker.net Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 5VKfPHNW5Eqy for ; Thu, 21 Mar 2019 10:45:51 -0700 (PDT) Received: from simon.songbird.com (simon.songbird.com [72.52.113.5]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 42A24131507 for ; Thu, 21 Mar 2019 10:45:51 -0700 (PDT) Received: from [192.168.1.85] (108-226-162-63.lightspeed.sntcca.sbcglobal.net [108.226.162.63]) (authenticated bits=0) by simon.songbird.com (8.14.4/8.14.4/Debian-4.1ubuntu1.1) with ESMTP id x2LHlSKj011540 (version=TLSv1/SSLv3 cipher=AES128-SHA bits=128 verify=NOT); Thu, 21 Mar 2019 10:47:28 -0700 DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=dcrocker.net; s=default; t=1553190449; bh=xq4RQmIrq9w1mSANGZkFlf/SMhnSty29iEDh06u+LnA=; h=Subject:To:Cc:References:Reply-To:From:Date:In-Reply-To:From; b=DtcyHq+CAtEdPcfIjigNoTchtSmEPPPueX4ZvCht9JsyAXvxyoPpfw0XmICwBeY7E H4h0deYeV+aWzEpUSPUCWdqvGG483rBdoSELyRuUzeJHVnWJw4UWfUUUP7irLB3V74 3CzYhTC0f6Ew6MkoZ96iLKuCPBK7AAymQ47DjAjE= To: Ken Simpson , John R Levine Cc: IETF DMARC WG References: <20190319184209.804E42010381DB@ary.qy> Reply-To: dcrocker@bbiw.net From: Dave Crocker Organization: Brandenburg InternetWorking Message-ID: <1c998977-c7aa-49ce-11f6-9b78c5faa39e@dcrocker.net> Date: Thu, 21 Mar 2019 10:45:42 -0700 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:60.0) Gecko/20100101 Thunderbird/60.6.0 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=utf-8; format=flowed Content-Language: en-US Content-Transfer-Encoding: 7bit Archived-At: Subject: Re: [dmarc-ietf] Email security beyond DMARC? X-BeenThere: dmarc@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Domain-based Message Authentication, Reporting, and Compliance \(DMARC\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 21 Mar 2019 17:45:53 -0000 On 3/21/2019 10:12 AM, Ken Simpson wrote: > That would be crossing into the realm of tradecraft. While I understand and respect the reality of that point, I fear it is problematic from an industry standpoint... d/ -- Dave Crocker Brandenburg InternetWorking bbiw.net From btv1==98346c22364==fosterd@bayviewphysicians.com Thu Mar 21 11:36:18 2019 Return-Path: X-Original-To: dmarc@ietfa.amsl.com Delivered-To: dmarc@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 467D6131580 for ; Thu, 21 Mar 2019 11:36:18 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.999 X-Spam-Level: X-Spam-Status: No, score=-1.999 tagged_above=-999 required=5 tests=[AC_DIV_BONANZA=0.001, BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=bayviewphysicians.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id UQDCKhr1w07r for ; Thu, 21 Mar 2019 11:36:15 -0700 (PDT) Received: from mail.bayviewphysicians.com (mail.bayviewphysicians.com [216.54.111.133]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 77F1F13157B for ; Thu, 21 Mar 2019 11:36:15 -0700 (PDT) X-ASG-Debug-ID: 1553193373-0990574bec948c0001-K2EkT1 Received: from webmail.bayviewphysicians.com (webmail.bayviewphysicians.com [192.168.1.49]) by mail.bayviewphysicians.com with ESMTP id A1ngQmtVXqWOA7wj (version=TLSv1.2 cipher=ECDHE-RSA-AES256-SHA384 bits=256 verify=NO); Thu, 21 Mar 2019 14:36:13 -0400 (EDT) X-Barracuda-Envelope-From: fosterd@bayviewphysicians.com X-Barracuda-RBL-Trusted-Forwarder: 192.168.1.49 X-ASG-Whitelist: Client X-SmarterMail-Authenticated-As: fosterd@bayviewphysicians.com DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=bayviewphysicians.com; s=s1025; h=content-type:mime-version:message-id:date:subject:to:from; bh=3tvAyoe10D/k1YqZmWajsZQfbtLZAWKpD3+hxfsRqRM=; b=SFnypvOfAlYRdZC1y2T3h8SZT1ySAKuvqmIqdUKXUuqvvLcy1919C8Y6n0g0YCKLS A6Aqqj3eePiXU7vqkkTUw3ywGtupQZXtZYDG2OZy8EPwZV9vXMdpRJQH0W2O2hOUB oeBNKUuabxiYt5/lDsm4R1TI+wbRVaaHCTfnaie20= Received: from MSA189 (MSA-189.BayviewPhysicians.com [192.168.2.94]) by webmail.bayviewphysicians.com with SMTP (version=TLS\Tls12 cipher=Aes256 bits=256); Thu, 21 Mar 2019 14:36:05 -0400 From: "Doug Foster" X-Barracuda-RBL-IP: 192.168.2.94 To: "'Ken Simpson'" , "'John R Levine'" Cc: "'IETF DMARC WG'" , "'Dotzero'" References: <20190319184209.804E42010381DB@ary.qy> In-Reply-To: Date: Thu, 21 Mar 2019 14:36:04 -0400 X-ASG-Orig-Subj: RE: [dmarc-ietf] Email security beyond DMARC? Message-ID: <002901d4e014$f0b50570$d21f1050$@bayviewphysicians.com> MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_002A_01D4DFF3.69A56140" X-Mailer: Microsoft Outlook 14.0 Thread-Index: AQE6O+S0HJlyLiYHqbQiq+xXXaEBHALEYuj6AsdeCWcB1qzo1wGfJ1scAdfzHram9OQMQA== Content-Language: en-us X-Exim-Id: 002901d4e014$f0b50570$d21f1050$ X-Barracuda-Connect: webmail.bayviewphysicians.com[192.168.1.49] X-Barracuda-Start-Time: 1553193373 X-Barracuda-Encrypted: ECDHE-RSA-AES256-SHA384 X-Barracuda-URL: https://mail.bayviewphysicians.com:443/cgi-mod/mark.cgi X-Barracuda-BRTS-Status: 1 X-Virus-Scanned: by bsmtpd at bayviewphysicians.com X-Barracuda-Scan-Msg-Size: 11994 Archived-At: Subject: Re: [dmarc-ietf] Email security beyond DMARC? X-BeenThere: dmarc@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Domain-based Message Authentication, Reporting, and Compliance \(DMARC\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 21 Mar 2019 18:38:59 -0000 This is a multipart message in MIME format. ------=_NextPart_000_002A_01D4DFF3.69A56140 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable I am all for anything that cuts unwanted email. Not sure of the need = to distinguish between spam and phishing. =20 I am assuming that I am the only one in this group not using DMARC. = You heard my problems with SPF. =20 =20 What do you do for SPF Exceptions? =C2=B7 We have never seen a legitimate sender who needed an = exception? =C2=B7 We whitelist the source IP address and trust that it will = only be used for appropriate domains? =C2=B7 We whitelist the sender domain and hope it will never be = spoofed? =C2=B7 Something else? =20 Also, how do you handle SPF non-pass: Neutral, Softfail, Syntax = errors, or Excessive nesting =20 Do you handle SPF any differently between senders with DMARC enforcement = and those without? =20 Doug Foster =20 =20 From: dmarc [mailto:dmarc-bounces@ietf.org] On Behalf Of Ken Simpson Sent: Thursday, March 21, 2019 1:01 PM To: John R Levine Cc: IETF DMARC WG; Dotzero Subject: Re: [dmarc-ietf] Email security beyond DMARC? =20 > I'm going to have to disagree with you John. DMARC is about preventing > direct domain abuse. It does not specifically address phishing as the = bad > guys can simply use cousin domains, homoglyphs, etc. Well, it's abount a subset of phishing. It's surely more about phishing = than about spam. =20 IMHO, by cutting out direct domain spoofing, DMARC makes it easier for = receivers to craft algorithms that spot impersonation attacks. Once you = have configured DMARC, receivers can build - for example - a machine = learning system that learns what your legitimate email looks like. They = can use that same system to identify messages that look like your = legitimate email but which do not actually originate from your domain. =20 If you want to detect domain impersonation or "brand" impersonation, you = first have to have a verifiable ground truth corpus. That is what DMARC = offers. =20 Regards, Ken=20 =20 ------=_NextPart_000_002A_01D4DFF3.69A56140 Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: quoted-printable

I am all for anything that cuts unwanted email.=C2=A0=C2=A0 Not sure = of the need to distinguish between spam and = phishing.

 

I am assuming that I am the only one in this group not using = DMARC.=C2=A0=C2=A0 You heard my problems with SPF.=C2=A0 =

 

What do you do for SPF Exceptions?

=C2=B7         = We have never seen a legitimate sender who needed an = exception?

=C2=B7         = We whitelist the source IP address and trust that it will only be = used for appropriate domains?

=C2=B7         = We whitelist the sender domain and hope it will never be = spoofed?

=C2=B7         = Something else?

 

Also, how do you handle SPF non-pass:=C2=A0=C2=A0 Neutral, Softfail, = Syntax errors, =C2=A0or=C2=A0 Excessive nesting

 

Do you handle SPF any differently between senders with DMARC = enforcement and those without?

 

Doug Foster

 

 

From:= = dmarc [mailto:dmarc-bounces@ietf.org] On Behalf Of Ken = Simpson
Sent: Thursday, March 21, 2019 1:01 PM
To: = John R Levine
Cc: IETF DMARC WG; Dotzero
Subject: = Re: [dmarc-ietf] Email security beyond DMARC?

 


> = I'm going to have to disagree with you John. DMARC is about = preventing
> direct domain abuse. It does not specifically address = phishing as the bad
> guys can simply use cousin domains, = homoglyphs, etc.

Well, it's abount a subset of phishing.  = It's surely more about phishing
than about = spam.

 

IMHO, by cutting out direct domain spoofing, DMARC = makes it easier for receivers to craft algorithms that spot = impersonation attacks. Once you have configured DMARC, receivers can = build - for example - a machine learning system that learns what your = legitimate email looks like. They can use that same system to identify = messages that look like your legitimate email but which do not actually = originate from your domain.

 

If you want to detect domain impersonation or = "brand" impersonation, you first have to have a verifiable = ground truth corpus. That is what DMARC = offers.

 

Regards,

Ken 

 

= ------=_NextPart_000_002A_01D4DFF3.69A56140-- From btv1==9847b0ea73a==fosterd@bayviewphysicians.com Fri Mar 22 08:11:04 2019 Return-Path: X-Original-To: dmarc@ietfa.amsl.com Delivered-To: dmarc@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 16C7F130F97 for ; Fri, 22 Mar 2019 08:11:04 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2 X-Spam-Level: X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=bayviewphysicians.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Z6ubPg8GXXYP for ; Fri, 22 Mar 2019 08:11:02 -0700 (PDT) Received: from mail.bayviewphysicians.com (mail.bayviewphysicians.com [216.54.111.133]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id CB3FF131051 for ; Fri, 22 Mar 2019 08:11:01 -0700 (PDT) X-ASG-Debug-ID: 1553267457-0990574becc7660001-K2EkT1 Received: from webmail.bayviewphysicians.com (webmail.bayviewphysicians.com [192.168.1.49]) by mail.bayviewphysicians.com with ESMTP id rt43j3P6vdEN2EJh (version=TLSv1.2 cipher=ECDHE-RSA-AES256-SHA384 bits=256 verify=NO) for ; Fri, 22 Mar 2019 11:10:57 -0400 (EDT) X-Barracuda-Envelope-From: fosterd@bayviewphysicians.com X-Barracuda-RBL-Trusted-Forwarder: 192.168.1.49 X-ASG-Whitelist: Client X-SmarterMail-Authenticated-As: fosterd@bayviewphysicians.com DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=bayviewphysicians.com; s=s1025; h= content-type:mime-version:message-id:reply-to:date:subject:to:from; bh=4SzT0nOsIt3maPRsxwn74jo9sLd47D3kc5XOqt3Qv80=; b=BlFrJNFc8AI5T1afVxqkwTmGusH/K+sYSQ1tkL9qG5ofBZJAEiW53mZUzcq+vguS3 i0mPWRfvonguyt+OiKpc5KhEnZqQFgxu0d+dmf9NKxJcToKEnbyIRwa2zp8ZRZVKQ 2iwQ14bVufdt4UHfL5doCpuE1fdicNR+Aulodg1zQ= Received: by webmail.bayviewphysicians.com via HTTP; Fri, 22 Mar 2019 11:10:50 -0400 From: "Douglas E. Foster" To: Date: Fri, 22 Mar 2019 11:10:50 -0400 X-ASG-Orig-Subj: Spam Filtering Product Guidelines? Reply-To: fosterd@bayviewphysicians.com Message-ID: <15a60f8319ed4e09948e6969af7b3a38@bayviewphysicians.com> MIME-Version: 1.0 Content-Type: multipart/alternative; boundary=84c230c1fed142789e6bed536ff77a1b X-Originating-IP: [192.168.26.116] X-Exim-Id: 15a60f8319ed4e09948e6969af7b3a38 X-Barracuda-Connect: webmail.bayviewphysicians.com[192.168.1.49] X-Barracuda-Start-Time: 1553267457 X-Barracuda-Encrypted: ECDHE-RSA-AES256-SHA384 X-Barracuda-URL: https://mail.bayviewphysicians.com:443/cgi-mod/mark.cgi X-Virus-Scanned: by bsmtpd at bayviewphysicians.com X-Barracuda-Scan-Msg-Size: 1540 X-Barracuda-BRTS-Status: 1 Archived-At: Subject: [dmarc-ietf] Spam Filtering Product Guidelines? X-BeenThere: dmarc@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Domain-based Message Authentication, Reporting, and Compliance \(DMARC\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 22 Mar 2019 15:12:25 -0000 This is a multipart message in MIME format. --84c230c1fed142789e6bed536ff77a1b Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Based on my frustration with observed product offerings, it feels like no one has articulated a reference model of how spam filters should operate -- either that, or the vendors are just ignoring such work. The SPF / DKIM / DMARC standards define what senders should do, but I don't think it says much anything about what the receiving system should do to resolve ambiguity when these features are not fully implemented by the sender. Does this group know of prior work to define such a reference model? Doug Foster --84c230c1fed142789e6bed536ff77a1b Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable =
Based on my frustration with observed product offerings, it feels like= no one has articulated a reference model of how spam filters should o= perate -- either that, or the vendors are just ignoring such work.
 
The SPF / DKIM / DMARC standards define what senders should do, but I = don't think it says much anything about what the receiving system should do= to resolve ambiguity when these features are not fully implemented by the = sender.
 
Does this group know of prior work to define such a reference model?
 
Doug Foster
 
 
--84c230c1fed142789e6bed536ff77a1b-- From nobody Fri Mar 22 09:09:17 2019 Return-Path: X-Original-To: dmarc@ietfa.amsl.com Delivered-To: dmarc@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id F1BD4131156 for ; Fri, 22 Mar 2019 09:09:09 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.998 X-Spam-Level: X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, MIME_QP_LONG_LINE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=otoh.org Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id g-au9FNEd64w for ; Fri, 22 Mar 2019 09:09:07 -0700 (PDT) Received: from suricate.otoh.org (suricate.otoh.org [173.11.101.67]) (using TLSv1.2 with cipher ADH-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 9652B13115A for ; Fri, 22 Mar 2019 09:09:07 -0700 (PDT) Received: from [172.132.14.231] (unknown [209.131.62.183]) (Authenticated sender: zwicky) by suricate.otoh.org (Postfix) with ESMTPSA id 5E79C1151F; Fri, 22 Mar 2019 16:09:06 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=otoh.org; s=2014-12-30; t=1553270946; r=y; bh=kopmBMrdd+5MMBi9KrH6RiBUtFyMojUnNxVrO5Cln1w=; h=Subject:From:In-Reply-To:Date:Cc:References:To; z=Subject:=20Re:=20[dmarc-ietf]=20Spam=20Filtering=20Product=20Guid elines?|From:=20Elizabeth=20Zwicky=20|In-Reply-To :=20<15a60f8319ed4e09948e6969af7b3a38@bayviewphysicians.com>|Date: =20Fri,=2022=20Mar=202019=2009:09:05=20-0700|Cc:=20dmarc@ietf.org| References:=20<15a60f8319ed4e09948e6969af7b3a38@bayviewphysicians. com>|To:=20fosterd@bayviewphysicians.com; b=wUaTOGIrWb3eWZ/ee7Z/7Kw91e+ZKUtmnnSFBtWciMDAy7x+oqEBIfhng3lamGXUI gkHmx1S3bweBTqazx/P3hXvH2cOWCupeZbY/7ZKIuOAoNmdBocETPBp5cJrTVfYJpt OkG7Bd5OnxSplQLBLSebhE8rov+NvbeoUzCVG/PQ= Content-Type: multipart/alternative; boundary=Apple-Mail-37B1258B-6AA0-48C8-BEC6-8BFBB55B070D Mime-Version: 1.0 (1.0) From: Elizabeth Zwicky X-Mailer: iPhone Mail (16D57) In-Reply-To: <15a60f8319ed4e09948e6969af7b3a38@bayviewphysicians.com> Date: Fri, 22 Mar 2019 09:09:05 -0700 Cc: dmarc@ietf.org Content-Transfer-Encoding: 7bit Message-Id: References: <15a60f8319ed4e09948e6969af7b3a38@bayviewphysicians.com> To: fosterd@bayviewphysicians.com Archived-At: Subject: Re: [dmarc-ietf] Spam Filtering Product Guidelines? X-BeenThere: dmarc@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Domain-based Message Authentication, Reporting, and Compliance \(DMARC\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 22 Mar 2019 16:09:10 -0000 --Apple-Mail-37B1258B-6AA0-48C8-BEC6-8BFBB55B070D Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable I=E2=80=99m not sure you realize that spam authenticates at a higher rate th= an good mail. This isn=E2=80=99t a bad thing =E2=80=94 it helps in blocking =E2= =80=94 but it means that authentication is nearly orthogonal to spam filteri= ng in large systems.=20 Elizabeth=20 > On Mar 22, 2019, at 8:10 AM, Douglas E. Foster wrote: >=20 > Based on my frustration with observed product offerings, it feels like no o= ne has articulated a reference model of how spam filters should operate -- e= ither that, or the vendors are just ignoring such work. > =20 > The SPF / DKIM / DMARC standards define what senders should do, but I don'= t think it says much anything about what the receiving system should do to r= esolve ambiguity when these features are not fully implemented by the sender= . > =20 > Does this group know of prior work to define such a reference model? > =20 > Doug Foster > =20 > =20 > _______________________________________________ > dmarc mailing list > dmarc@ietf.org > https://www.ietf.org/mailman/listinfo/dmarc --Apple-Mail-37B1258B-6AA0-48C8-BEC6-8BFBB55B070D Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: quoted-printable
I=E2=80=99m not sure you realize that spam authentic= ates at a higher rate than good mail. This isn=E2=80=99t a bad thing =E2=80=94= it helps in blocking =E2=80=94 but it means that authentication is nearly o= rthogonal to spam filtering in large systems. 
Elizabeth 

On Mar 22= , 2019, at 8:10 AM, Douglas E. Foster <fosterd@bayviewphysicians.com> wrote:

Based on my frustration with obs= erved product offerings, it feels like no one has articulated a reference&nb= sp;model of how spam filters should operate -- either that, or the vendors a= re just ignoring such work.
 
The SPF / DKIM / DMARC standards define what senders should do, but I d= on't think it says much anything about what the receiving system should do t= o resolve ambiguity when these features are not fully implemented by the sen= der.
 
Does this group know of prior work to define such a reference model?
 
Doug Foster
 
 
________= _______________________________________
dmarc mailing list
dmarc@ietf.orghttps://www.= ietf.org/mailman/listinfo/dmarc
= --Apple-Mail-37B1258B-6AA0-48C8-BEC6-8BFBB55B070D-- From nobody Sat Mar 23 21:31:22 2019 Return-Path: X-Original-To: dmarc@ietfa.amsl.com Delivered-To: dmarc@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 62E61130F08 for ; Sat, 23 Mar 2019 21:31:20 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.486 X-Spam-Level: X-Spam-Status: No, score=-0.486 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_PASS=-0.001, URIBL_BLOCKED=0.001, URIBL_RHS_DOB=1.514] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=neutral reason="invalid (unsupported algorithm ed25519-sha256)" header.d=kitterman.com header.b=1NhnXCS/; dkim=pass (2048-bit key) header.d=kitterman.com header.b=NXFBJix8 Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id h2feqRDPRTNs for ; Sat, 23 Mar 2019 21:31:18 -0700 (PDT) Received: from interserver.kitterman.com (interserver.kitterman.com [64.20.48.66]) (using TLSv1.2 with cipher ADH-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B7293130E98 for ; Sat, 23 Mar 2019 21:31:18 -0700 (PDT) Received: from interserver.kitterman.com (interserver.kitterman.com [64.20.48.66]) by interserver.kitterman.com (Postfix) with ESMTPS id 324B2F80736 for ; Sun, 24 Mar 2019 00:31:17 -0400 (EDT) DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/simple; d=kitterman.com; i=@kitterman.com; q=dns/txt; s=201903e; t=1553401877; h=from : to : subject : date : message-id : in-reply-to : references : mime-version : content-transfer-encoding : content-type : from; bh=AcYFq9OaV/jC3v0hWe4nbzUJ4kyh2+vO7reR306VJSc=; b=1NhnXCS/8jbJzyfktCyhT16bpbh0wrAn3FsqBIOj6KjOGLf7mjQXpEku OalWd5xD8e6hMw3KiX9+xW4ANvm4AQ== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kitterman.com; i=@kitterman.com; q=dns/txt; s=201903r; t=1553401877; h=from : to : subject : date : message-id : in-reply-to : references : mime-version : content-transfer-encoding : content-type : from; bh=AcYFq9OaV/jC3v0hWe4nbzUJ4kyh2+vO7reR306VJSc=; b=NXFBJix8KJ3O2uSQ7KWzMsAj/dQeqos9lg1yAoZdFyFZxYFt79jHegsO bPyezMTfWPqIK8m1QjOEd0YopunUq8DF/IIg+/tJs48RQNBQ7V0IvFncMf P92zD4ZbXoDkXfiewbI5LJCL8vTMN1LSrH/6qNvFcnyJrQmVwznsupijAh SO+fj5O93bnnul1TbptfWZp/JzcdI/GnI1tcaukPh8iUJiiyGhNul2exYX y0mbwwJ144vXg+Tvk8qVx847IA46HYBTK4lkOxE3hJvyzRkUOxdUDWAk+5 D5E5bHTP5o91F/j063Mvf9vx7cmNR2mFGo+SqFdFw+32SZd/z00epA== Received: from kitterma-e6430.localnet (static-72-81-252-22.bltmmd.fios.verizon.net [72.81.252.22]) by interserver.kitterman.com (Postfix) with ESMTPSA id F0E39F804C8 for ; Sun, 24 Mar 2019 00:31:16 -0400 (EDT) From: Scott Kitterman To: dmarc@ietf.org Date: Sun, 24 Mar 2019 00:31:16 -0400 Message-ID: <1984236.HAtKmyD7dV@kitterma-e6430> User-Agent: KMail/4.13.3 (Linux/3.13.0-164-generic; KDE/4.13.3; x86_64; ; ) In-Reply-To: <20190206015918.05BBA200DD44EF@ary.qy> References: <20190206015918.05BBA200DD44EF@ary.qy> MIME-Version: 1.0 Content-Transfer-Encoding: 7Bit Content-Type: text/plain; charset="us-ascii" Archived-At: Subject: Re: [dmarc-ietf] Fwd: I-D Action: draft-ietf-dmarc-psd-01.txt X-BeenThere: dmarc@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Domain-based Message Authentication, Reporting, and Compliance \(DMARC\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 24 Mar 2019 04:31:20 -0000 On Tuesday, February 05, 2019 08:59:17 PM John Levine wrote: > In article <6596039.Rh8MxG5e5K@kitterma-e6430> you write: > >The current PSL is over 12K lines long. What we're talking about here is > >probably .1% to 1% that size. > > Indeed, but since everyone has the PSL anyway to find organizational > domains, who cares about the size? The point of asking the PSL people > to do it is to find a credible third party to evaluate "all your > domains belong to us" assertions. So my understanding is that the answer was no, they didn't think the PSL was appropriate. Personally, I agree they would be great, but I guess not. If we come to a strong conclusion that this is the right way to go, then I guess I could make another run at it. In the mean time, in order to at least have something, we now have psddmarc.org with a way to query for PSD DMARC participants. My plan is to take some of the text from the (now removed) IANA section of -00 and make a non-normative appendix that describes why we want some kind of external mechanism to constrain which PSDs we use this for in order to mitigate the associate privacy considerations. > > Leaving aside for a moment the mechanism, would > > > >people review the latest draft and see if they think the privacy issues are > >adequately described and if they require some kind of mitigation? > > I think it's fine. At the end where you talk about failure reports, > you might note that since they contain actual messages, any domain > where the admistrator does not normally read its users' mail already > has the same issues. I'll add something about that as well as some off list comments I've gotten. I know this isn't the ideal time for people to be reviewing stuff, so I'll work on the draft and publish something during the week for discussion after people get back from the meeting. Scott K From nobody Mon Mar 25 02:11:21 2019 Return-Path: X-Original-To: dmarc@ietf.org Delivered-To: dmarc@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id BE9B8120373; Mon, 25 Mar 2019 02:11:06 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: Leif Johansson via Datatracker To: Cc: dmarc@ietf.org, draft-ietf-dmarc-eaiauth.all@ietf.org, ietf@ietf.org X-Test-IDTracker: no X-IETF-IDTracker: 6.94.1 Auto-Submitted: auto-generated Precedence: bulk Reply-To: Leif Johansson Message-ID: <155350506670.22297.2525928721965597003@ietfa.amsl.com> Date: Mon, 25 Mar 2019 02:11:06 -0700 Archived-At: Subject: [dmarc-ietf] Secdir last call review of draft-ietf-dmarc-eaiauth-03 X-BeenThere: dmarc@ietf.org X-Mailman-Version: 2.1.29 List-Id: "Domain-based Message Authentication, Reporting, and Compliance \(DMARC\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 25 Mar 2019 09:11:07 -0000 Reviewer: Leif Johansson Review result: Has Issues I have reviewed this document as part of the security directorate's ongoing effort to review all IETF documents being processed by the IESG. These comments were written primarily for the benefit of the security area directors. Document editors and WG chairs should treat these comments just like any other last call comments. The document is mostly ready. The one issue I have is that the security considerations section claims that the proposed changes attempts to mitigate some security issues in email involving SPF, DMARC and/or DKIM but it is not obvious (at least not to me) exactly what this amounts to. Additional text in the document to clarify this point seems like a good idea. Cheers Leif From nobody Mon Mar 25 04:11:35 2019 Return-Path: X-Original-To: dmarc@ietfa.amsl.com Delivered-To: dmarc@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id BFF0D1203A2 for ; Mon, 25 Mar 2019 03:57:57 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.001 X-Spam-Level: X-Spam-Status: No, score=-2.001 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_PASS=-0.001] autolearn=unavailable autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1536-bit key) header.d=iecc.com header.b=yJiL7U8K; dkim=pass (1536-bit key) header.d=taugh.com header.b=eQW5jnU3 Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Qf1251FVQTUA for ; Mon, 25 Mar 2019 03:57:55 -0700 (PDT) Received: from gal.iecc.com (gal.iecc.com [IPv6:2001:470:1f07:1126:0:43:6f73:7461]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 54E32120395 for ; Mon, 25 Mar 2019 03:57:55 -0700 (PDT) Received: (qmail 28700 invoked from network); 25 Mar 2019 10:57:52 -0000 DKIM-Signature: v=1; a=rsa-sha256; c=simple; d=iecc.com; h=date:message-id:from:to:cc:subject:in-reply-to:references:mime-version:content-type:user-agent; s=701a.5c98b430.k1903; bh=ZQffTIX3WZyloAzFprOPBBSO++oiTCMQb4K2nAU3C14=; b=yJiL7U8KOlItfUCZLryxqBaLPzXAPuchYoQ3mQ3OqCO9uD+95oPNG8Ich1TVKT45vCz7uRoKhbE5U0IbySNPZyl4t7oLRTlYgHZ2Kpb6MWpSMrVZQXO7dkv7uqPVQBazdPuX6+Kk/0TFgX6X0M1vpg7bUX/KxlzMb69tAJ0dIW0D/gQvEIZxFvw9v0IXmhGn7px+0jeaX36iyBpY85kyvZv8wPnPzMMISqPjbtX184dxsdo0j8TkQxu5vh/eiwpW DKIM-Signature: v=1; a=rsa-sha256; c=simple; d=taugh.com; h=date:message-id:from:to:cc:subject:in-reply-to:references:mime-version:content-type:user-agent; s=701a.5c98b430.k1903; bh=ZQffTIX3WZyloAzFprOPBBSO++oiTCMQb4K2nAU3C14=; b=eQW5jnU3ZdwTCutK5rhRs4fvxVS5zQOKkj4KyjUorN5Hd7vusCIbg/MtuzqMYxnvprXxmM8Zl4KXyvVst5Z8YyN/JtNLXCPlVNhyjLPx+hp/xvHpnpN2bI8CDfrP9lHH4JK5OYWHXK8ir3M5t2VPPurq4/51UYXRaly+Dk4x77czsqUqz+2cJyEOfoSgwD8XQDKmWQVFMPgVd0UgNc/MqAVlBy41L/1fq0rv2ATOQyUHj3ellWguuiqrDGMtbcoe Received: from localhost ([IPv6:2001:470:1f07:1126::78:696d:6170]) by imap.iecc.com ([IPv6:2001:470:1f07:1126::78:696d:6170]) with ESMTPS (TLS1.2 ECDHE-RSA AES-256-GCM AEAD) via TCP6; 25 Mar 2019 10:57:52 -0000 Date: 25 Mar 2019 10:57:49 +0000 Message-ID: From: "John R Levine" To: "Leif Johansson" Cc: secdir@ietf.org, dmarc@ietf.org, "Tim Wicinski" , "Murray Kucherawy" , alexey.melnikov@isode.com, ben@nostrum.com, "Barry Leiba" , adam@nostrum.com, "Kurt Andersen" In-Reply-To: <155350506670.22297.2525928721965597003@ietfa.amsl.com> References: <155350506670.22297.2525928721965597003@ietfa.amsl.com> User-Agent: Alpine 2.21 (OSX 202 2017-01-01) MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII; format=flowed Archived-At: X-Mailman-Approved-At: Mon, 25 Mar 2019 04:11:34 -0700 Subject: Re: [dmarc-ietf] [taugh.com-standards] Secdir last call review of draft-ietf-dmarc-eaiauth-03 X-BeenThere: dmarc@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Domain-based Message Authentication, Reporting, and Compliance \(DMARC\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 25 Mar 2019 10:57:58 -0000 On Mon, 25 Mar 2019, Leif Johansson via Datatracker wrote: > The one issue I have is that the security considerations section claims > that the proposed changes attempts to mitigate some security issues > in email involving SPF, DMARC and/or DKIM but it is not obvious (at > least not to me) exactly what this amounts to. > > Additional text in the document to clarify this point seems like a good idea. Maybe I should just take that out. The only issue it mitigates is that it makes DKIM and DMARC checks on EAI mail more reliable. Regards, John Levine, johnl@taugh.com, Taughannock Networks, Trumansburg NY Please consider the environment before reading this e-mail. https://jl.ly From nobody Mon Mar 25 04:11:41 2019 Return-Path: X-Original-To: dmarc@ietfa.amsl.com Delivered-To: dmarc@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5DB8C1203E0; Mon, 25 Mar 2019 03:59:13 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.901 X-Spam-Level: X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id KjIG4osKjbi3; Mon, 25 Mar 2019 03:59:11 -0700 (PDT) Received: from outgoing.mit.edu (outgoing-auth-1.mit.edu [18.9.28.11]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 84735120408; Mon, 25 Mar 2019 03:59:11 -0700 (PDT) Received: from kduck.mit.edu (24-107-191-124.dhcp.stls.mo.charter.com [24.107.191.124]) (authenticated bits=56) (User authenticated as kaduk@ATHENA.MIT.EDU) by outgoing.mit.edu (8.14.7/8.12.4) with ESMTP id x2PAx3p6001666 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Mon, 25 Mar 2019 06:59:05 -0400 Date: Mon, 25 Mar 2019 05:59:03 -0500 From: Benjamin Kaduk To: John R Levine Cc: Leif Johansson , Tim Wicinski , ben@nostrum.com, adam@nostrum.com, secdir@ietf.org, dmarc@ietf.org, Murray Kucherawy , Barry Leiba , Kurt Andersen Message-ID: <20190325105902.GC77890@kduck.mit.edu> References: <155350506670.22297.2525928721965597003@ietfa.amsl.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.10.1 (2018-07-13) Archived-At: X-Mailman-Approved-At: Mon, 25 Mar 2019 04:11:34 -0700 Subject: Re: [dmarc-ietf] [secdir] [taugh.com-standards] Secdir last call review of draft-ietf-dmarc-eaiauth-03 X-BeenThere: dmarc@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Domain-based Message Authentication, Reporting, and Compliance \(DMARC\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 25 Mar 2019 10:59:21 -0000 On Mon, Mar 25, 2019 at 10:57:49AM +0000, John R Levine wrote: > On Mon, 25 Mar 2019, Leif Johansson via Datatracker wrote: > > The one issue I have is that the security considerations section claims > > that the proposed changes attempts to mitigate some security issues > > in email involving SPF, DMARC and/or DKIM but it is not obvious (at > > least not to me) exactly what this amounts to. > > > > Additional text in the document to clarify this point seems like a good idea. > > Maybe I should just take that out. The only issue it mitigates is that > it makes DKIM and DMARC checks on EAI mail more reliable. That seems important enough to state explicitly. -Ben From nobody Mon Mar 25 04:11:47 2019 Return-Path: X-Original-To: dmarc@ietfa.amsl.com Delivered-To: dmarc@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 129DA1203DF for ; Mon, 25 Mar 2019 04:03:55 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.001 X-Spam-Level: X-Spam-Status: No, score=-2.001 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_PASS=-0.001] autolearn=unavailable autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1536-bit key) header.d=iecc.com header.b=v8IV5Xll; dkim=pass (1536-bit key) header.d=taugh.com header.b=puTi7+ni Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id qNIZz5W0xLno for ; Mon, 25 Mar 2019 04:03:52 -0700 (PDT) Received: from gal.iecc.com (gal.iecc.com [IPv6:2001:470:1f07:1126:0:43:6f73:7461]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 04CB51203D5 for ; Mon, 25 Mar 2019 04:03:51 -0700 (PDT) Received: (qmail 30611 invoked from network); 25 Mar 2019 11:03:50 -0000 DKIM-Signature: v=1; a=rsa-sha256; c=simple; d=iecc.com; h=date:message-id:from:to:cc:subject:in-reply-to:references:mime-version:content-type:user-agent; s=778d.5c98b596.k1903; bh=w0pOjR0NHBc6bv2F/2yDSVptd1QDCv5DhfdFWIhUWWQ=; b=v8IV5Xllk/kg88R15nAmE592CMFj8cAs9fUJ6AlgkjNIt4p5OvzHb2lxxpYyXPqHuwwYu2BdYEHbdIXI48X8a2Vxv8i9dYG4v3tqGCsoz2iG5HJgKXRbX2wiwF51MYhQdVDvGIob8uXSIs7xa1n6lfv7RDCCfmZf19oBLDCb7uQ9IJTa6f7QLQGpUHhW1sVHAhlGLU4GK0bG3q/jK2CUF6LrhHt3gy4i/Yr/LTfvsK5sr3wu+sKmNabmCNinDcKJ DKIM-Signature: v=1; a=rsa-sha256; c=simple; d=taugh.com; h=date:message-id:from:to:cc:subject:in-reply-to:references:mime-version:content-type:user-agent; s=778d.5c98b596.k1903; bh=w0pOjR0NHBc6bv2F/2yDSVptd1QDCv5DhfdFWIhUWWQ=; b=puTi7+niCLd67DciTIa2tDMbXneQM5X2yNw3MkHVOUIMjtMitrbFtngqUFPwRoatMDgVFUV887dGBmjMMIzAv+qJ+SYVvaWEi87DSfPYIOvKY8CTjG67yEy6IZodt/UEsLju7D33+FvZEVPEoVmT055+p8yr9oGqSFjvlXv/EDXmd8ZXP9ZVwROlWrhZjeTzMX9rwZ1a0GpucxaYh4ZJ2REb0x/GEOwZcyAt2iusnEunFMXYEyRK6GnMNlFdWMMO Received: from localhost ([IPv6:2001:470:1f07:1126::78:696d:6170]) by imap.iecc.com ([IPv6:2001:470:1f07:1126::78:696d:6170]) with ESMTPS (TLS1.2 ECDHE-RSA AES-256-GCM AEAD) via TCP6; 25 Mar 2019 11:03:50 -0000 Date: 25 Mar 2019 11:03:47 +0000 Message-ID: From: "John R Levine" To: "Benjamin Kaduk" Cc: "Leif Johansson" , "Tim Wicinski" , ben@nostrum.com, adam@nostrum.com, secdir@ietf.org, dmarc@ietf.org, "Murray Kucherawy" , "Barry Leiba" , "Kurt Andersen" In-Reply-To: <20190325105902.GC77890@kduck.mit.edu> References: <155350506670.22297.2525928721965597003@ietfa.amsl.com> <20190325105902.GC77890@kduck.mit.edu> User-Agent: Alpine 2.21 (OSX 202 2017-01-01) MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII; format=flowed Archived-At: X-Mailman-Approved-At: Mon, 25 Mar 2019 04:11:34 -0700 Subject: Re: [dmarc-ietf] [secdir] [taugh.com-standards] Secdir last call review of draft-ietf-dmarc-eaiauth-03 X-BeenThere: dmarc@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Domain-based Message Authentication, Reporting, and Compliance \(DMARC\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 25 Mar 2019 11:03:57 -0000 On Mon, 25 Mar 2019, Benjamin Kaduk wrote: >> Maybe I should just take that out. The only issue it mitigates is that >> it makes DKIM and DMARC checks on EAI mail more reliable. > > That seems important enough to state explicitly. OK, added a sentence. Regards, John Levine, johnl@taugh.com, Taughannock Networks, Trumansburg NY Please consider the environment before reading this e-mail. https://jl.ly From nobody Mon Mar 25 06:33:56 2019 Return-Path: X-Original-To: dmarc@ietfa.amsl.com Delivered-To: dmarc@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9BC6A1203EF for ; Mon, 25 Mar 2019 06:09:05 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.001 X-Spam-Level: X-Spam-Status: No, score=-2.001 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=unavailable autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=sunet.se Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id FhiYsaLBeM-B for ; Mon, 25 Mar 2019 06:09:04 -0700 (PDT) Received: from mail-wm1-x32e.google.com (mail-wm1-x32e.google.com [IPv6:2a00:1450:4864:20::32e]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 79BFD1203F0 for ; Mon, 25 Mar 2019 06:09:02 -0700 (PDT) Received: by mail-wm1-x32e.google.com with SMTP id y197so9024288wmd.0 for ; Mon, 25 Mar 2019 06:09:02 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sunet.se; s=google; h=mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=r/uEUXBJC20H4BxLHKlnamceB/hsskYcgjBpREXU2S4=; b=KH8mixXXbFjjvo2xpNMIrrszGy+Tsys6qluUFuklZsFTfafz+h8uSNTdyoalxetMf7 SOoWO924ZmngE4XLB0byJF0FtkqtLam+dom9WJmwRKQWePJnxJrVp3t3JzLPVxrPE8uO x5svMWgntZkaYw5zZHoWSvZJUx4Ms9MJGQm8kcBp5j6YWX/cCvQjni3WWLE2qCUdzZ3d 5nqp8pr1Lnksb/ap7BnJyuhWi8vscUwbcUun9detBUxCBdaUxvODomhYkGHpWOlDNwgu egpNmlvqz+kYgS5BhPlg/M7ozpmj9tP3F8sqYLSW+s7gbJmiS6fAa29S7b4FSwHn90H0 XDIA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=r/uEUXBJC20H4BxLHKlnamceB/hsskYcgjBpREXU2S4=; b=ABMO+XMb7HyfTmU20NrhJSLXUMlFvwicXgEHEgmlbmeDCE9gZ9462jzeHpye1tX6G3 askxfkd1ZrMPDs6Z+XjRy87F/gd6JhnmqYvOAIbKHKP1/QVCwuY1kxmvzvoAxUtGKkOh JLqrnl4+Nw6bnjRmX3SuE2SIgtorP4vS/wGSlSzNKfJpZY2gcSZhwfsmQYgF9fiuClJk nmdRvrvMBPQ2UJIfH0cSvF2er2z/54gKsQjMHbeT35YSi2sD9PbVeFqaC2RC/B128IrZ 59znEoAsXPyKdw5SdrWYnXqzcjso1cyYpNCv02MulgrIzjqc/vK/Lf/LLnf1WokAXpuh UOyw== X-Gm-Message-State: APjAAAX7Txmjy8Mco5ZsfjvPbJDlOY0CvAKtgzxnH7uq5IcBfwZTajqL WjDlGeOkFW7vqCsniIelTxXLZA== X-Google-Smtp-Source: APXvYqz9P2SbyEoPZH2XLp91KQS3Ycm8nd/bZDqIE+qf4vdPYVcoXsHvtP2LI8kDAgoXTgUhxTIKXA== X-Received: by 2002:a05:600c:2294:: with SMTP id 20mr5200247wmf.56.1553519340747; Mon, 25 Mar 2019 06:09:00 -0700 (PDT) Received: from ?IPv6:2001:67c:1232:144:945e:2fb5:247c:75e? ([2001:67c:1232:144:945e:2fb5:247c:75e]) by smtp.gmail.com with ESMTPSA id y5sm14674568wrw.23.2019.03.25.06.08.59 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Mon, 25 Mar 2019 06:08:59 -0700 (PDT) Content-Type: text/plain; charset=utf-8 Mime-Version: 1.0 (1.0) From: Leif Johansson X-Mailer: iPhone Mail (16D57) In-Reply-To: Date: Mon, 25 Mar 2019 14:08:59 +0100 Cc: Benjamin Kaduk , Tim Wicinski , ben@nostrum.com, adam@nostrum.com, secdir@ietf.org, dmarc@ietf.org, Murray Kucherawy , Barry Leiba , Kurt Andersen Content-Transfer-Encoding: quoted-printable Message-Id: References: <155350506670.22297.2525928721965597003@ietfa.amsl.com> <20190325105902.GC77890@kduck.mit.edu> To: John R Levine Archived-At: X-Mailman-Approved-At: Mon, 25 Mar 2019 06:33:55 -0700 Subject: Re: [dmarc-ietf] [secdir] [taugh.com-standards] Secdir last call review of draft-ietf-dmarc-eaiauth-03 X-BeenThere: dmarc@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Domain-based Message Authentication, Reporting, and Compliance \(DMARC\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 25 Mar 2019 13:09:06 -0000 Skickat fr=C3=A5n min iPhone > 25 mars 2019 kl. 12:03 skrev John R Levine : >=20 > On Mon, 25 Mar 2019, Benjamin Kaduk wrote: >>> Maybe I should just take that out. The only issue it mitigates is that >>> it makes DKIM and DMARC checks on EAI mail more reliable. >>=20 >> That seems important enough to state explicitly. >=20 > OK, added a sentence. Thx! >=20 > Regards, > John Levine, johnl@taugh.com, Taughannock Networks, Trumansburg NY > Please consider the environment before reading this e-mail. https://jl.ly From nobody Mon Mar 25 10:14:16 2019 Return-Path: X-Original-To: dmarc@ietf.org Delivered-To: dmarc@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 73DD01204E9; Mon, 25 Mar 2019 10:14:09 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: internet-drafts@ietf.org To: Cc: dmarc@ietf.org X-Test-IDTracker: no X-IETF-IDTracker: 6.94.1 Auto-Submitted: auto-generated Precedence: bulk Reply-To: dmarc@ietf.org Message-ID: <155353404941.28944.10330457171208779516@ietfa.amsl.com> Date: Mon, 25 Mar 2019 10:14:09 -0700 Archived-At: Subject: [dmarc-ietf] I-D Action: draft-ietf-dmarc-eaiauth-04.txt X-BeenThere: dmarc@ietf.org X-Mailman-Version: 2.1.29 List-Id: "Domain-based Message Authentication, Reporting, and Compliance \(DMARC\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 25 Mar 2019 17:14:10 -0000 A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the Domain-based Message Authentication, Reporting & Conformance WG of the IETF. Title : E-mail Authentication for Internationalized Mail Author : John Levine Filename : draft-ietf-dmarc-eaiauth-04.txt Pages : 7 Date : 2019-03-25 Abstract: SPF (RFC7208), DKIM (RFC6376), and DMARC (RFC7489) enable a domain owner to publish e-mail authentication and policy information in the DNS. In internationalized e-mail, domain names can occur both as U-labels and A-labels. This specification updates the SPF, DKIM, and DMARC specifications to clarify which form of internationalized domain names to use in those specifications. The IETF datatracker status page for this draft is: https://datatracker.ietf.org/doc/draft-ietf-dmarc-eaiauth/ There are also htmlized versions available at: https://tools.ietf.org/html/draft-ietf-dmarc-eaiauth-04 https://datatracker.ietf.org/doc/html/draft-ietf-dmarc-eaiauth-04 A diff from the previous version is available at: https://www.ietf.org/rfcdiff?url2=draft-ietf-dmarc-eaiauth-04 Please note that it may take a couple of minutes from the time of submission until the htmlized version and diff are available at tools.ietf.org. Internet-Drafts are also available by anonymous FTP at: ftp://ftp.ietf.org/internet-drafts/ From nobody Tue Mar 26 09:58:02 2019 Return-Path: X-Original-To: dmarc@ietfa.amsl.com Delivered-To: dmarc@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5A5351206A1 for ; Tue, 26 Mar 2019 09:57:53 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.998 X-Spam-Level: X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id WcSaw4ZKr8kW for ; Tue, 26 Mar 2019 09:57:49 -0700 (PDT) Received: from mail-lj1-x22b.google.com (mail-lj1-x22b.google.com [IPv6:2a00:1450:4864:20::22b]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 7013412050E for ; Tue, 26 Mar 2019 09:57:49 -0700 (PDT) Received: by mail-lj1-x22b.google.com with SMTP id p14so10812731ljg.5 for ; Tue, 26 Mar 2019 09:57:49 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:from:date:message-id:subject:to; bh=J+5q9vYtJUVswzTKcJ9eAdWYu2qdBeUhmz0ieIJ91ZU=; b=CAppydFOGuaYlhm80DClQKJp9g8AdgkPr8gLqtBt39s81pGjxgQdCdGJTtz+GabUX3 qyNgkJNCO57mTacFOanmwujckmJf6XXi4MUP0rHC/Cf7NNWT3kqcq7KGlCsPPY4pfsk5 LUXEDRuRdkPlEvZqZXRCBxPieHfbHpPAUQgwKeLrCtgeVxa0K2c1ifSqIQDC3zCiSUtE MVOMC0kU9X6VRGEWqvL3FJLkfXfNiFOJ85nO9wJ3VRl8xIYzSF7KMLlid1E1F4l8tUtp AvYw442CTDKw0AVc8b2+b7yIxfbKwTWwPZIqU36C88jKRKOG89FOS/CQCAdjyoDsrqWb uyBw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:from:date:message-id:subject:to; bh=J+5q9vYtJUVswzTKcJ9eAdWYu2qdBeUhmz0ieIJ91ZU=; b=hWEus2T5ybi/2n5eSczKazkC2Qc8BwUi29rLii2iurzct15yOucTZcSINJ52m8etkN /mW7qMUm5sFsX7C6F8uBBml4P5DzJXr2DVSeSsYXdd883vNQqc7DzSgaRISb1LZw6trc V+XOLXPtd+FdhqWpM49/+An/BXyR/9HzbYUvuEgQyRrCn3Iy74wXe2eh0r0UwY6FBmBS LJGuvGRX+QnwFJ+EIose68RvsnulJUFizjhDLibfcDttBS2MoXfjSUwP6z+zADa8xfDJ IPf6IUN7A3yzPCE2H6a4GqKRoH7E9YYL9mtluz++RcDDIWs5nDVzfOqvRRLHCDBR+Ds7 8i1Q== X-Gm-Message-State: APjAAAU6I7PWGNyU9ZhcotrpQ7uEEfhEKTzOfLjA806FG5OubP6WogSO S238mkXlrDfAtYDgD5Mf1ZNjV5DFGDsxPbsE9Rza9INJCjI= X-Google-Smtp-Source: APXvYqyCWJICznTOYXKA4hAAbDPxDZJ023dkPvhOKijGDHgxzZIjsySPQOdH691m/FHNeobyg7h9IAqh91NztCyzGQI= X-Received: by 2002:a2e:390c:: with SMTP id g12mr10610371lja.174.1553619467391; Tue, 26 Mar 2019 09:57:47 -0700 (PDT) MIME-Version: 1.0 From: "Murray S. Kucherawy" Date: Tue, 26 Mar 2019 17:57:33 +0100 Message-ID: To: IETF DMARC WG Content-Type: multipart/alternative; boundary="0000000000007855e9058502380e" Archived-At: Subject: [dmarc-ietf] Working group next steps X-BeenThere: dmarc@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Domain-based Message Authentication, Reporting, and Compliance \(DMARC\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 26 Mar 2019 16:58:01 -0000 --0000000000007855e9058502380e Content-Type: text/plain; charset="UTF-8" DMARC colleagues, Tim and I met in Prague to get things rolling in terms of getting us progressing again toward our remaining deliverables. Producing a DMARC on the standards track is the endgame for us. We're keen to identify and focus on work that is in direct service of that goal; anything else can be parked for now and we can return to it once the main work is done, assuming we still have the energy to do it. Accordingly, we propose to formally park draft-ietf-dmarc-arc-multi and draft-ietf-dmarc-arc-usage. The working group should, in the short term, focus on development and completion of draft-ietf-dmarc-psd. Among the questions to be answered is its urgency: If there is pressure to get this finished and published in some form, we suggest the WG consider moving this to Experimental status, aligning it with the ARC base work, and come back around to merge it into DMARC when it goes to the Standards Track. Toward the goal of getting to the work on the standards track base specification, we should start collecting issues, from nits on up to things that need overhaul, in the WG's tracker. We would like this list to be as exhaustive as possible. When we do finally get to the work of standards track DMARC, we can run it like a checklist. Please take some time to go over the list that's already in the tracker, and add anything you think is missing: https://trac.ietf.org/trac/dmarc/report You may need a login credential if you haven't already established one. This can be done via the IETF datatracker: https://datatracker.ietf.org/ Previously (at IETF 99), the WG has discussed an augmentation of DMARC's reporting capabilities to include attributes of ARC evaluation of a message. It's been suggested that this is a critical thing to include in the ARC experiment and thus input to standards track DMARC work; it was left out of ARC's base document to keep ARC decoupled from DMARC for now. If consensus concurs with this position, we're looking for document editor(s) to spin up that effort. The chairs are, however, cognizant that each new work item we take up has the effect of pushing standards track DMARC further down the road, so we would like to keep this sort of thing to a minimum. Finally, there have been some hallway inquiries here at IETF 104 about canonicalizations that can survive mailing list transit. I thought it worth checking with the WG to see if there's any energy or interest in revisiting this kind of work; it does fit within our charter, but previously attempts at this kind of work have waned. We look forward to hearing your views on any or all of the above. We can start by having everyone begin logging their open DMARC specification issues into the tracker, and ask that everyone please review and comment on the PSD draft and provide comments. In particular, anyone that has implemented it is particularly requested to comment (including Scott, since we imagine he's tried this by now). -MSK --0000000000007855e9058502380e Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
DMARC colleagues,

Tim and I met in Prague to get things rolling in te= rms of getting us progressing again toward our remaining deliverables.

Producing a DMARC on the standards track is the endgam= e for us.=C2=A0 We're keen to identify and focus on work that is in dir= ect service of that goal; anything else can be parked for now and we can re= turn to it once the main work is done, assuming we still have the energy to= do it.=C2=A0 Accordingly, we propose to formally park draft-ietf-dmarc-arc= -multi and draft-ietf-dmarc-arc-usage.

The working= group should, in the short term, focus on development and completion of dr= aft-ietf-dmarc-psd.=C2=A0 Among the questions to be answered is its urgency= : If there is pressure to get this finished and published in some form, we = suggest the WG consider moving this to Experimental status, aligning it wit= h the ARC base work, and come back around to merge it into DMARC when it go= es to the Standards Track.

Toward the goal of gett= ing to the work on the standards track base specification, we should start = collecting issues, from nits on up to things that need overhaul, in the WG&= #39;s tracker.=C2=A0 We would like this list to be as exhaustive as possibl= e.=C2=A0 When we do finally get to the work of standards track DMARC, we ca= n run it like a checklist.=C2=A0 Please take some time to go over the list = that's already in the tracker, and add anything you think is missing:
https://trac.ietf= .org/trac/dmarc/report

You may need a login credentia= l if you haven't already established one.=C2=A0 This can be done via th= e IETF datatracker: https://datat= racker.ietf.org/

Previously (at IETF 99), the = WG has discussed an augmentation of DMARC's reporting capabilities to i= nclude attributes of ARC evaluation of a message.=C2=A0 It's been sugge= sted that this is a critical thing to include in the ARC experiment and thu= s input to standards track DMARC work; it was left out of ARC's base do= cument to keep ARC decoupled from DMARC for now.=C2=A0 If consensus concurs= with this position, we're looking for document editor(s) to spin up th= at effort.=C2=A0 The chairs are, however, cognizant that each new work item= we take up has the effect of pushing standards track DMARC further down th= e road, so we would like to keep this sort of thing to a minimum.

Finally, there have been some hallway inquiries here at IETF 104 a= bout canonicalizations that can survive mailing list transit.=C2=A0 I thoug= ht it worth checking with the WG to see if there's any energy or intere= st in revisiting this kind of work; it does fit within our charter, but pre= viously attempts at this kind of work have waned.

= We look forward to hearing your views on any or all of the above.=C2=A0 We = can start by having everyone begin logging their open DMARC specification i= ssues into the tracker, and ask that everyone please review and comment on = the PSD draft and provide comments.=C2=A0 In particular, anyone that has im= plemented it is particularly requested to comment (including Scott, since w= e imagine he's tried this by now).

-MSK
--0000000000007855e9058502380e-- From nobody Tue Mar 26 10:05:55 2019 Return-Path: X-Original-To: dmarc@ietfa.amsl.com Delivered-To: dmarc@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id AF47C1203E3 for ; Tue, 26 Mar 2019 10:05:53 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2 X-Spam-Level: X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=valimail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id emTmVfHCWtaV for ; Tue, 26 Mar 2019 10:05:51 -0700 (PDT) Received: from mail-wr1-x430.google.com (mail-wr1-x430.google.com [IPv6:2a00:1450:4864:20::430]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D3C3A1203A0 for ; Tue, 26 Mar 2019 10:05:50 -0700 (PDT) Received: by mail-wr1-x430.google.com with SMTP id k11so7867151wro.5 for ; Tue, 26 Mar 2019 10:05:50 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=valimail.com; s=google2048; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=pLNa9Mn2PWe2eW0oBD+B3aa9bXKIdxlUmqzLOLfAWeo=; b=bpxvMkhGSUfNyQiOwpW/rR1kYCISObd0VFKYvmWGSSkgioPPCEgB459hFMr3eX/pRa yMwdpxVwfh8yepEu5dj3JVGiRNfLo8Z5mUOOlfv8xrN3nU/J3ZIIBK/lLIYfRk6muG2L /9YZw7gpkr2B2dogmq5aj7yrDXrDF/4a86UtjIcauINZk0CankpeolqLZvT4sMu6swKN rBwoxtTQ2sR0PjbNDhBLUQ+Y9kf7Yy138P8B0NBx/ArTG9ws+KEwGmh1/Arw3owKu5iX hv7jP9X8tdabujpbc+gGPdB1wjlMmOquV7LtfyODlKSEpWxCrz4hh2OqONjfvJfoSUd2 prNQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=pLNa9Mn2PWe2eW0oBD+B3aa9bXKIdxlUmqzLOLfAWeo=; b=PIJoHfR52WNDBLkQSkLmV3mTh7x9wWFMJqbLNlhO+DltBN7YuP4pDZbGRQM11pTGTZ 0IycC/VaQT0sKnJ84TbdGZA08hS6HPLbqo92d0GZfpGhzDxt31m35M8NkwMdimIZwIoO nae+nrJiOaxOqn4mAv1Cvy0eKuxlWdfJx81oUKx+iqRaGCMZqZvfJCOZ32wbVdim+Jkx dyKazhZZ85GV4SsYHz1TA5jwFKAvhufxa4BstT2kbAid2bVRxmYZsr00jgtCgHixW9oR uI+wkbD3qwGqKYVdk7JAd5ULTihqC/F3krDO/viokhis6Z5eRJVVasdcEUuXvKnx4ci5 WFuA== X-Gm-Message-State: APjAAAVc7KPe2mwPR1MnQPJjh2vVhgUtLqqz+rpRmb43jvrtS5n+xfjn tE7k9Ea7LUEAZMRpXSO1Ch94HlNqc0IqZOGCW6n7ZHrWUJ+MSA== X-Google-Smtp-Source: APXvYqx3D0w4qnwpzY2ySfOdBFDG6NvKNiSykF8+L/NRyaGBGXtf0+p7Gnjux51wgAFzH18M3aBniuESFkfMd0Kn08E= X-Received: by 2002:adf:f451:: with SMTP id f17mr16899506wrp.272.1553619949086; Tue, 26 Mar 2019 10:05:49 -0700 (PDT) MIME-Version: 1.0 References: In-Reply-To: From: Seth Blank Date: Tue, 26 Mar 2019 18:05:36 +0100 Message-ID: To: IETF DMARC WG Cc: "Murray S. Kucherawy" Content-Type: multipart/alternative; boundary="0000000000002e7c4305850255c8" Archived-At: Subject: Re: [dmarc-ietf] Working group next steps X-BeenThere: dmarc@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Domain-based Message Authentication, Reporting, and Compliance \(DMARC\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 26 Mar 2019 17:05:54 -0000 --0000000000002e7c4305850255c8 Content-Type: text/plain; charset="UTF-8" On Tue, Mar 26, 2019 at 5:58 PM Murray S. Kucherawy wrote: > The working group should, in the short term, focus on development and > completion of draft-ietf-dmarc-psd. Among the questions to be answered is > its urgency: If there is pressure to get this finished and published in > some form, we suggest the WG consider moving this to Experimental status, > aligning it with the ARC base work, and come back around to merge it into > DMARC when it goes to the Standards Track. > +1. This draft addresses several clear use cases and is critical to standards track DMARC. > Previously (at IETF 99), the WG has discussed an augmentation of DMARC's > reporting capabilities to include attributes of ARC evaluation of a > message. It's been suggested that this is a critical thing to include in > the ARC experiment and thus input to standards track DMARC work; it was > left out of ARC's base document to keep ARC decoupled from DMARC for now. > If consensus concurs with this position, we're looking for document > editor(s) to spin up that effort. The chairs are, however, cognizant that > each new work item we take up has the effect of pushing standards track > DMARC further down the road, so we would like to keep this sort of thing to > a minimum. > +1. At IETF99 I signed up to be the author of this. I'm still happy to do this work, and believe it's critical a) for the success of ARC, and b) for standards track DMARC. Seth --0000000000002e7c4305850255c8 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
On Tue, Mar 26, 2019 at 5:58 PM Murray S.= Kucherawy <superuser@gmail.com> wrote:

Previously (at IETF 99), the WG has discussed an= augmentation of DMARC's reporting capabilities to include attributes o= f ARC evaluation of a message.=C2=A0 It's been suggested that this is a= critical thing to include in the ARC experiment and thus input to standard= s track DMARC work; it was left out of ARC's base document to keep ARC = decoupled from DMARC for now.=C2=A0 If consensus concurs with this position= , we're looking for document editor(s) to spin up that effort.=C2=A0 Th= e chairs are, however, cognizant that each new work item we take up has the= effect of pushing standards track DMARC further down the road, so we would= like to keep this sort of thing to a minimum.
<= /blockquote>

+1. At IETF99 I signed up to be the author = of this. I'm still happy to do this work, and believe it's critical= a) for the success of ARC, and b) for standards track DMARC.
Seth

--0000000000002e7c4305850255c8-- From nobody Tue Mar 26 14:34:14 2019 Return-Path: X-Original-To: dmarc@ietfa.amsl.com Delivered-To: dmarc@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 983AE120385 for ; Tue, 26 Mar 2019 14:34:12 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2 X-Spam-Level: X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=neutral reason="invalid (unsupported algorithm ed25519-sha256)" header.d=kitterman.com header.b=z0hIGtHQ; dkim=pass (2048-bit key) header.d=kitterman.com header.b=gFmIRw9M Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 53-3leHx6dZo for ; Tue, 26 Mar 2019 14:34:10 -0700 (PDT) Received: from interserver.kitterman.com (interserver.kitterman.com [64.20.48.66]) (using TLSv1.2 with cipher ADH-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 77D8B1200B1 for ; Tue, 26 Mar 2019 14:34:10 -0700 (PDT) Received: from interserver.kitterman.com (interserver.kitterman.com [64.20.48.66]) by interserver.kitterman.com (Postfix) with ESMTPS id 168FEF807E0; Tue, 26 Mar 2019 17:34:09 -0400 (EDT) DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/simple; d=kitterman.com; i=@kitterman.com; q=dns/txt; s=201903e; t=1553636048; h=date : in-reply-to : references : mime-version : content-type : content-transfer-encoding : subject : to : from : message-id : from; bh=ekXdU9NlRAk62jjN0MG0rEvNqJDgQBrW88Tom0dLjAY=; b=z0hIGtHQsnnG9BQ7RIiWSZCyLJWOiPbEtFdNeahAXe+E7iNQIlT/fYkI DyjdJBSvWBlpXOkQLVwuYYDOWy9WAg== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kitterman.com; i=@kitterman.com; q=dns/txt; s=201903r; t=1553636048; h=date : in-reply-to : references : mime-version : content-type : content-transfer-encoding : subject : to : from : message-id : from; bh=ekXdU9NlRAk62jjN0MG0rEvNqJDgQBrW88Tom0dLjAY=; b=gFmIRw9M1WJp+fJ9Ef356PyPHFnm4tqF1ij5JK1jM7FT6yKgRCFC+C9Z Ysl+3Vou03xXNZGZXha/RrBpU4n5dRgT+B4AUMKr03d7cVTQDFyGhGNlxL Dvk/qFn7AxEdmJqV93MTUw+14qmhSfMuwDA0zmletQLQyrlaFgUtdg6XHb Yn1sDn7lRqyMG63JTubOcaOHAbcBBuzcviYovf1jFBmxWEoPY2NELgGmmP d84dkqyX60pQPWl3PoUVwEO1u8Uw0a3JnjriR1955b/37IDR+jKl+V4Ire 4iqgI8R275IVEIqXr0H5/sOUgBca2S1H4gZewhk3LozLYBkIkgwMoQ== Received: from [10.49.178.245] (mobile-166-170-35-8.mycingular.net [166.170.35.8]) by interserver.kitterman.com (Postfix) with ESMTPSA id 64920F807C7; Tue, 26 Mar 2019 17:34:08 -0400 (EDT) Date: Tue, 26 Mar 2019 21:34:06 +0000 In-Reply-To: References: MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable To: dmarc@ietf.org From: Scott Kitterman Message-ID: <8BD8FBEC-B242-48F3-BC10-BB79DA4CD452@kitterman.com> Archived-At: Subject: Re: [dmarc-ietf] Working group next steps X-BeenThere: dmarc@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Domain-based Message Authentication, Reporting, and Compliance \(DMARC\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 26 Mar 2019 21:34:13 -0000 On March 26, 2019 5:05:36 PM UTC, Seth Blank wrote: >On Tue, Mar 26, 2019 at 5:58 PM Murray S=2E Kucherawy > >wrote: > >> The working group should, in the short term, focus on development and >> completion of draft-ietf-dmarc-psd=2E Among the questions to be >answered is >> its urgency: If there is pressure to get this finished and published >in >> some form, we suggest the WG consider moving this to Experimental >status, >> aligning it with the ARC base work, and come back around to merge it >into >> DMARC when it goes to the Standards Track=2E >> > >+1=2E This draft addresses several clear use cases and is critical to >standards track DMARC=2E +1 here too=2E As I understand it, getting this done sooner rather than later is importan= t as supporting this operationally for non-CC TLDs requires ICANN changes t= hat having it as an RFC would help=2E These will probably take awhile, so = it's important to started=2E Scott K From nobody Tue Mar 26 20:45:33 2019 Return-Path: X-Original-To: dmarc@ietfa.amsl.com Delivered-To: dmarc@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1DCE2120222 for ; Tue, 26 Mar 2019 20:45:32 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2 X-Spam-Level: X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=isdg.net header.b=Xh03AWfj; dkim=pass (1024-bit key) header.d=beta.winserver.com header.b=BUT2LwKQ Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 5IBpnImIhC0R for ; Tue, 26 Mar 2019 20:45:29 -0700 (PDT) Received: from mail.winserver.com (ntbbs.santronics.com [76.245.57.69]) by ietfa.amsl.com (Postfix) with ESMTP id BE12412020A for ; Tue, 26 Mar 2019 20:45:28 -0700 (PDT) DKIM-Signature: v=1; d=isdg.net; s=tms1; a=rsa-sha1; c=simple/relaxed; l=3482; t=1553658318; atps=ietf.org; atpsh=sha1; h=Received:Received:Received:Received:Message-ID:Date:From: Organization:To:Subject:List-ID; bh=FKWQwkci3IENWq891ktJQe9IF8s=; b=Xh03AWfjAu+BWOxAgqwsv7KqSeEMXlqofUzAah0YOmHX2Z3OTD4fa1AGYJnGtc BpD2K5cXm6d2wMswiXVpBBvEUKv3V4oMfrtD6XjT3QS3rv5KGkoI2aEP9Pyp6r2t KQ3tTR9u6arnXkNPuljRyEt36vupOkzuHkwKdrLAddGrQ= Received: by winserver.com (Wildcat! SMTP Router v7.0.454.6) for dmarc@ietf.org; Tue, 26 Mar 2019 22:45:18 -0500 Authentication-Results: dkim.winserver.com; dkim=pass header.d=beta.winserver.com header.s=tms1 header.i=beta.winserver.com; Received: from beta.winserver.com ([76.245.57.74]) by winserver.com (Wildcat! SMTP v7.0.454.6) with ESMTP id 4065199012.1.2640; Tue, 26 Mar 2019 22:45:17 -0500 DKIM-Signature: v=1; d=beta.winserver.com; s=tms1; a=rsa-sha256; c=simple/relaxed; l=3482; t=1553658275; h=Received:Received: Message-ID:Date:From:Organization:To:Subject:List-ID; bh=Oo8PSpn HAGxT95a8WKgpUGiSekGKq1P7ou0Ip3yhcJI=; b=BUT2LwKQ3qhFiLTxErGDtNM OYfgNXcCxFGF5PpldLGW9M3OBrCuoQYbH/8FRM9NvolOChHC12V/Bd8nIoEn6/YB VPlQ1BLs4QOtIXS3d55HV+t/cFiAwkoVkM/1/q0tXl/EshKysEpTeYS23NNCGOdf JKmYBmSHbojVA0tmXoJ4= Received: by beta.winserver.com (Wildcat! SMTP Router v7.0.454.6) for dmarc@ietf.org; Tue, 26 Mar 2019 23:44:35 -0400 Received: from [192.168.1.68] ([75.26.216.248]) by beta.winserver.com (Wildcat! SMTP v7.0.454.6) with ESMTP id 318097972.9.371296; Tue, 26 Mar 2019 23:44:34 -0400 Message-ID: <5C9AF1CD.3010006@isdg.net> Date: Tue, 26 Mar 2019 23:45:17 -0400 From: Hector Santos Reply-To: hsantos@isdg.net Organization: Santronics Software, Inc. User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:24.0) Gecko/20100101 Thunderbird/24.8.1 MIME-Version: 1.0 To: dmarc@ietf.org References: In-Reply-To: Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit Archived-At: Subject: Re: [dmarc-ietf] Working group next steps X-BeenThere: dmarc@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Domain-based Message Authentication, Reporting, and Compliance \(DMARC\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 27 Mar 2019 03:45:32 -0000 Big time +1. Focus on DMARC PSD! I agree with everything mentioned and hope to allocate time very soon to assist. Thanks Murray, Great news!! On 3/26/2019 12:57 PM, Murray S. Kucherawy wrote: > DMARC colleagues, > > Tim and I met in Prague to get things rolling in terms of getting us > progressing again toward our remaining deliverables. > > Producing a DMARC on the standards track is the endgame for us. We're keen > to identify and focus on work that is in direct service of that goal; > anything else can be parked for now and we can return to it once the main > work is done, assuming we still have the energy to do it. Accordingly, we > propose to formally park draft-ietf-dmarc-arc-multi and > draft-ietf-dmarc-arc-usage. > > The working group should, in the short term, focus on development and > completion of draft-ietf-dmarc-psd. Among the questions to be answered is > its urgency: If there is pressure to get this finished and published in > some form, we suggest the WG consider moving this to Experimental status, > aligning it with the ARC base work, and come back around to merge it into > DMARC when it goes to the Standards Track. > > Toward the goal of getting to the work on the standards track base > specification, we should start collecting issues, from nits on up to things > that need overhaul, in the WG's tracker. We would like this list to be as > exhaustive as possible. When we do finally get to the work of standards > track DMARC, we can run it like a checklist. Please take some time to go > over the list that's already in the tracker, and add anything you think is > missing: > > https://trac.ietf.org/trac/dmarc/report > > You may need a login credential if you haven't already established one. > This can be done via the IETF datatracker: https://datatracker.ietf.org/ > > Previously (at IETF 99), the WG has discussed an augmentation of DMARC's > reporting capabilities to include attributes of ARC evaluation of a > message. It's been suggested that this is a critical thing to include in > the ARC experiment and thus input to standards track DMARC work; it was > left out of ARC's base document to keep ARC decoupled from DMARC for now. > If consensus concurs with this position, we're looking for document > editor(s) to spin up that effort. The chairs are, however, cognizant that > each new work item we take up has the effect of pushing standards track > DMARC further down the road, so we would like to keep this sort of thing to > a minimum. > > Finally, there have been some hallway inquiries here at IETF 104 about > canonicalizations that can survive mailing list transit. I thought it > worth checking with the WG to see if there's any energy or interest in > revisiting this kind of work; it does fit within our charter, but > previously attempts at this kind of work have waned. > > We look forward to hearing your views on any or all of the above. We can > start by having everyone begin logging their open DMARC specification > issues into the tracker, and ask that everyone please review and comment on > the PSD draft and provide comments. In particular, anyone that has > implemented it is particularly requested to comment (including Scott, since > we imagine he's tried this by now). > > -MSK > > > > _______________________________________________ > dmarc mailing list > dmarc@ietf.org > https://www.ietf.org/mailman/listinfo/dmarc > -- HLS From nobody Wed Mar 27 05:06:05 2019 Return-Path: X-Original-To: dmarc@ietfa.amsl.com Delivered-To: dmarc@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E405F1202A5 for ; Wed, 27 Mar 2019 05:06:03 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2 X-Spam-Level: X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=drkurt.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id pwCjr1Qg3NpZ for ; Wed, 27 Mar 2019 05:06:01 -0700 (PDT) Received: from mail-it1-x12c.google.com (mail-it1-x12c.google.com [IPv6:2607:f8b0:4864:20::12c]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 872CF1202A3 for ; Wed, 27 Mar 2019 05:06:01 -0700 (PDT) Received: by mail-it1-x12c.google.com with SMTP id l4so5429441ite.1 for ; Wed, 27 Mar 2019 05:06:01 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=drkurt.com; s=20130612; h=mime-version:references:in-reply-to:from:date:message-id:subject:to; bh=kQ1zfoHZtI8zBUTwHGwiEqZ64pIJrERxp5o2f8pUxko=; b=d59L0CdNETcFfc7TGqkBXaGApZQQ9XVXTebH39NMrR0m3UYAXnosttli9EQjwg0eLd 3svqGPtT3EwpQyKQEuvLP+FLjkMGAm3gJNXRgJY92ai6pEDMvs1n9DHMjJvLeqsx14xS uW1lF9ZX4K1VFQrcDzD27FhovTJ+6SsyQ9Oxg= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to; bh=kQ1zfoHZtI8zBUTwHGwiEqZ64pIJrERxp5o2f8pUxko=; b=MvbDXFJwlXYaD5IZUmyv4go4rfFL7IwTMwbt3HOHnxs7AX1RwAW8VIzMs2Lp6VCHWP 2BlWC0c6nCndNtIpm0kjUAeSD8IWwlfHD8rTUC5n8m6akkX7TM4T3kXLpSUGhOqG/Ytk BdAOuL6hDxZEupxS41O7+1vlTgto2JmI13cZSRl4wAHubedt4yU4Wz0qvuZhy3Au9Y8r 696e9w6+cqQ7p+vaozap/YxCuUwIMKWB+EbHWsJkVpVCM/z0qprmm3wXgHG++lrRvU24 JxYeMQn+y5U1ZBK5eWNdETswgAbgCBx4cJDVqqLYMdzS2pnQMcvUBRDFBu8Q40eqCU90 bWbA== X-Gm-Message-State: APjAAAWYOndmq7gQAnNuAMg55NBGZNboMg61S8c3YnAETxGJdX82cFn3 n+102AVYeOcNFOwHJZdUBwRSudoLNbF+L9EKVYCox1+SMXQ= X-Google-Smtp-Source: APXvYqzhzL+SxCNSo3yLBpAjOvxyzc1eCEmsRGzMRk+ZpNWqB67eADPEZu8pt+JQd31Xgn3TOWR2eh/l7ycKpj0it/4= X-Received: by 2002:a24:39ca:: with SMTP id l193mr3170256ita.173.1553688360535; Wed, 27 Mar 2019 05:06:00 -0700 (PDT) MIME-Version: 1.0 References: <8BD8FBEC-B242-48F3-BC10-BB79DA4CD452@kitterman.com> In-Reply-To: <8BD8FBEC-B242-48F3-BC10-BB79DA4CD452@kitterman.com> From: "Kurt Andersen (b)" Date: Wed, 27 Mar 2019 08:05:43 -0400 Message-ID: To: "dmarc@ietf.org" Content-Type: multipart/alternative; boundary="000000000000d263d105851242e8" Archived-At: Subject: Re: [dmarc-ietf] Working group next steps X-BeenThere: dmarc@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Domain-based Message Authentication, Reporting, and Compliance \(DMARC\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 27 Mar 2019 12:06:04 -0000 --000000000000d263d105851242e8 Content-Type: text/plain; charset="UTF-8" > > On Tue, Mar 26, 2019 at 5:58 PM Murray S. Kucherawy > wrote: > > > > The working group should, in the short term, focus on development and > > completion of draft-ietf-dmarc-psd. Among the questions to be answered > is > > its urgency: If there is pressure to get this finished and published in > > some form, we suggest the WG consider moving this to Experimental status > Yes, also +1 on moving PSD to experimental and advancing it through the editorial process without further delay. --Kurt --000000000000d263d105851242e8 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
On Tue, Mar 26, 2019 at 5:58 PM Murray S. Kucherawy <= superuser@gmail.co= m> wrote:
>
> The working group should, in the short term, focus on development and<= br> > completion of draft-ietf-dmarc-psd.=C2=A0 Among the questions to be an= swered is
> its urgency: If there is pressure to get this finished and published i= n
> some form, we suggest the WG consider moving this to Experimental stat= us

Yes, also=C2=A0+1 on moving PSD to e= xperimental and advancing it through the editorial process without further = delay.

--Kurt=C2=A0
--000000000000d263d105851242e8-- From nobody Fri Mar 29 03:52:27 2019 Return-Path: X-Original-To: dmarc@ietfa.amsl.com Delivered-To: dmarc@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C77C31203F9 for ; Fri, 29 Mar 2019 03:52:16 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.998 X-Spam-Level: X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id fGqsnxuYuJgy for ; Fri, 29 Mar 2019 03:52:14 -0700 (PDT) Received: from mail-lj1-x230.google.com (mail-lj1-x230.google.com [IPv6:2a00:1450:4864:20::230]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 1A2F6120448 for ; Fri, 29 Mar 2019 03:52:14 -0700 (PDT) Received: by mail-lj1-x230.google.com with SMTP id v22so1504983lje.9 for ; Fri, 29 Mar 2019 03:52:13 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to; bh=jWnlWriUlb996avCpyg0ddBx4KOe99skZ9PRIsjODPM=; b=dANs+Rm8sNaY3jy8J7vK2UpMt15te0Kg8f5wv9biQqv0EY77K2hZhE6Y8MDE0mmj76 S5yGmPrY2zXlyG8nNEd+BJ5YVtnl9qfoYM5tyWfHLp1AzzCxVtSZBbARf+4u8IDlJYjz +/UA7WV6OSWu/18eWjCmOJ4qjBTaM8i4su6znlSp+n7tfmjufMHCuKLPKtsrcoQ35imv g7PpzU7xLcvTKazXfeZixKHpoQ/c/fBeHcWCx7MOJhIBRbXlJSTr2Pq8VoQLDoL6GhUf EaBc6R+jd1XfJk3xJnFVa/EdhaNUmV3oILzKwjqgz8AV7BA4AFiKAXxD+nc4cfh7eckk S9MA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to; bh=jWnlWriUlb996avCpyg0ddBx4KOe99skZ9PRIsjODPM=; b=B1EQwRFaMKbO5HCSPRg2wvUJVTFlr6xS3d3zdlPFZJwjsLu6OQcrShXjZUKM8YfVhY 6motNnXismFkAUgg+d8vF59jF5/4jjOXwJu+Hy2nUxIXGK1A9PA1Q6qEOFBHIyUHG8Cl T0D9SCOb4kCXd0dyVFhPmdQhXmqb1eegecmXzXYQqtIe7OUbSYjsH0J5jDOA4KLIXBAL GaBPFM2cTZRjs6aPs67IEL2rOWm9peLjBqARNid3RhMFYoYJo/mGOYL1jKJBa4rdWYb7 PHRXWPCQfjNP51diZjBJokstwVzB1d+lsk+8VuTqmoAKjTffsjMiwfHAmBED0T62Rg4x S58w== X-Gm-Message-State: APjAAAULygzvBJdhvOItlq8RCGP1exWIXv8XUYkKoJSXdSYkCsegraaB O8y/VB6fYFEwGlHMOXzKHNneP5fA0EGShhu2OARNJ/sb X-Google-Smtp-Source: APXvYqy6b0nAqdMhVpeOC2RwnjMobaCMOmN/fo9O9G8ddB73PLjFHEdwRn/yySKeUsmpFzP9k2qQPUluxQPjkZWthYo= X-Received: by 2002:a2e:390c:: with SMTP id g12mr20118232lja.174.1553856731697; Fri, 29 Mar 2019 03:52:11 -0700 (PDT) MIME-Version: 1.0 References: <5de9ba1c3ae34edb9c7f39e0e9c3b143@PACDCEX19.cable.comcast.com> In-Reply-To: <5de9ba1c3ae34edb9c7f39e0e9c3b143@PACDCEX19.cable.comcast.com> From: "Murray S. Kucherawy" Date: Fri, 29 Mar 2019 11:51:59 +0100 Message-ID: To: IETF DMARC WG Content-Type: multipart/alternative; boundary="00000000000086597e0585397641" Archived-At: Subject: [dmarc-ietf] Fwd: [dbound] Related Domains By DNS (RDBD) Draft X-BeenThere: dmarc@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Domain-based Message Authentication, Reporting, and Compliance \(DMARC\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 29 Mar 2019 10:52:25 -0000 --00000000000086597e0585397641 Content-Type: text/plain; charset="UTF-8" Of possible interest to this working group... ---------- Forwarded message --------- From: Brotman, Alexander Date: Mon, Feb 25, 2019 at 9:38 PM Subject: [dbound] Related Domains By DNS (RDBD) Draft To: art@ietf.org , dbound@ietf.org Cc: dnsop@ietf.org , Stephen Farrell < stephen.farrell@cs.tcd.ie> Hello, Stephen and I have spent a bit of time working on a draft to be able to show a relationship between two domains. We're aware this subject has been covered a few times previously, especially in the DBOUND drafts, but we're hopeful that a more simple approach might be more acceptable. The secondary domain will create a DNS record that shows a link to a primary domain, and the text should be able to be validated using the public key in a DNS record the primary domain shares. This is something akin to DKIM, a mechanism that the email world uses to ensure the contents of a message have not been tampered with. https://datatracker.ietf.org/doc/draft-brotman-rdbd/ We'll request that replies relating to this be sent to the dbound@ietf.org due to the nature of the topic, but it was suggested that we might want to notify a few other lists for their awareness. Thank you for your participation and comments. -- Alex Brotman Sr. Engineer, Anti-Abuse & Messaging Policy Comcast _______________________________________________ dbound mailing list dbound@ietf.org https://www.ietf.org/mailman/listinfo/dbound --00000000000086597e0585397641 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Of possible interest to this working group...

=
----------= Forwarded message ---------
From: Brotman, Alexander <Alexander_Brotman@comcast.com>
Da= te: Mon, Feb 25, 2019 at 9:38 PM
Subject: [dbound] Related Domains By DN= S (RDBD) Draft
To: art@ietf.org <= art@ietf.org>, dbound@ietf.org <db= ound@ietf.org>
Cc: dnsop@ietf.o= rg <dnsop@ietf.org>, Stephe= n Farrell <stephen.farrell@= cs.tcd.ie>


Hello,

Stephen and I have spent a bit of time working on a draft to be able to sho= w a relationship between two domains.=C2=A0 We're aware this subject ha= s been covered a few times previously, especially in the DBOUND drafts, but= we're hopeful that a more simple approach might be more acceptable.=C2= =A0 =C2=A0The secondary domain will create a DNS record that shows a link t= o a primary domain, and the text should be able to be validated using the p= ublic key in a DNS record the primary domain shares.=C2=A0 This is somethin= g akin to DKIM, a mechanism that the email world uses to ensure the content= s of a message have not been tampered with.

https://datatracker.ietf.org/doc/draft-brotman-r= dbd/

We'll request that replies relating to this be sent to the dbound@ietf.org due to the nat= ure of the topic, but it was suggested that we might want to notify a few o= ther lists for their awareness.=C2=A0 Thank you for your participation and = comments.

--
Alex Brotman
Sr. Engineer, Anti-Abuse & Messaging Policy
Comcast

_______________________________________________
dbound mailing list
dbound@ietf.org https://www.ietf.org/mailman/listinfo/dbound
--00000000000086597e0585397641-- From nobody Fri Mar 29 10:14:42 2019 Return-Path: X-Original-To: dmarc@ietfa.amsl.com Delivered-To: dmarc@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id F29781202F6 for ; Fri, 29 Mar 2019 10:14:39 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.011 X-Spam-Level: X-Spam-Status: No, score=-0.011 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, HTTPS_HTTP_MISMATCH=1.989, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=ncsc.gov.uk Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 4rXZ1-s5qJ3n for ; Fri, 29 Mar 2019 10:14:35 -0700 (PDT) Received: from GBR01-CWL-obe.outbound.protection.outlook.com (mail-eopbgr110130.outbound.protection.outlook.com [40.107.11.130]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 21A4F120141 for ; Fri, 29 Mar 2019 10:14:34 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ncsc.gov.uk; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=I/xrrY9B83IysDmBiQ12YcZhpNJsynWNITXcV12Rldk=; b=LOtgtW7kT+CIp/gowbAIk+QL76rGZuYhl1G6AOmtuo3TA5Pqjkj9SGzGqsNt5ls6gDe35LuotXLz6lOtNxVoz6zzItcbXiFUVuC+u8dUBT9KnQg3Ma6Ly1YgEUvUgnTni/x0+OdlA0v9gXTV+WJMebBX3YIV1zLOok3nXQB7eVA= Received: from LO2P123MB2285.GBRP123.PROD.OUTLOOK.COM (20.176.157.151) by LO2P123MB1792.GBRP123.PROD.OUTLOOK.COM (20.176.157.78) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.1750.15; Fri, 29 Mar 2019 17:14:31 +0000 Received: from LO2P123MB2285.GBRP123.PROD.OUTLOOK.COM ([fe80::41ac:f60c:6d07:7769]) by LO2P123MB2285.GBRP123.PROD.OUTLOOK.COM ([fe80::41ac:f60c:6d07:7769%6]) with mapi id 15.20.1750.017; Fri, 29 Mar 2019 17:14:31 +0000 From: Ian Levy To: "Murray S. Kucherawy" , IETF DMARC WG Thread-Topic: [dmarc-ietf] Working group next steps Thread-Index: AQHU4/UzfZiqOr8RXUGmzJ8BTa45jqYi2lBA Date: Fri, 29 Mar 2019 17:14:31 +0000 Message-ID: References: In-Reply-To: Accept-Language: en-GB, en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=ian.levy@ncsc.gov.uk; x-originating-ip: [51.141.26.231] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: f3a84ac7-49a1-4e02-cdea-08d6b46a025f x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(8989299)(4534185)(7168020)(4627221)(201703031133081)(201702281549075)(8990200)(5600127)(711020)(4605104)(2017052603328)(7153060)(7193020); SRVR:LO2P123MB1792; x-ms-traffictypediagnostic: LO2P123MB1792: x-ms-exchange-purlcount: 2 x-microsoft-antispam-prvs: x-forefront-prvs: 0991CAB7B3 x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(979002)(376002)(396003)(346002)(366004)(136003)(39850400004)(199004)(189003)(25786009)(105586002)(11346002)(66066001)(106356001)(53936002)(74482002)(606006)(97736004)(6246003)(71190400001)(33656002)(6436002)(99286004)(71200400001)(68736007)(790700001)(6116002)(14454004)(236005)(966005)(102836004)(186003)(55016002)(9686003)(2906002)(8936002)(8676002)(3846002)(7696005)(229853002)(316002)(52536014)(81166006)(54896002)(6306002)(478600001)(7736002)(14444005)(5660300002)(81156014)(256004)(486006)(26005)(75922002)(476003)(53546011)(44832011)(86362001)(55236004)(446003)(76176011)(110136005)(6506007)(74316002)(969003)(989001)(999001)(1009001)(1019001); DIR:OUT; SFP:1102; SCL:1; SRVR:LO2P123MB1792; H:LO2P123MB2285.GBRP123.PROD.OUTLOOK.COM; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; A:1; MX:1; received-spf: None (protection.outlook.com: ncsc.gov.uk does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: WW/1JMEhplstRpW9QtwXaPyyQB6NrdNkCnefFfVdDA6DkXc624XZpSLZImSsAmuCLAdjTfjV+jux5PkShW6lhlMt+9OH7m0sU4rpJNt/Zf1Js4oyBEX9iKAIxcvDypJwimesdknb2DBBjh4ILQ2Zt4iEM9+z7qArsXd4fxN/eDspvZr4IBywmbiWgU94Trgi245UfIl7lwlR3tUGsHZWeeEWMk2U78nVrJ1ciwvAd5SkwdC0Us0fCdUNm84z6zA2EhEPRAxYM4lqudoJESQBpUHj5lCBs6inKgVTsNVmjPGsb4AcbWe9M5HYy3/WmZVdT4uIH5X3I0VGbe5qqNY+h4hY5mItS7EtgfRhjUf1MBjCRr5ahgdd7lEhl72PZ6C34QK7TdEqs8XsayUrG0lTMaIgcjepfL2tXXhFuhmqJU8= Content-Type: multipart/alternative; boundary="_000_LO2P123MB22857A6A1EDD9D54A817C4F5C95A0LO2P123MB2285GBRP_" MIME-Version: 1.0 X-OriginatorOrg: ncsc.gov.uk X-MS-Exchange-CrossTenant-Network-Message-Id: f3a84ac7-49a1-4e02-cdea-08d6b46a025f X-MS-Exchange-CrossTenant-originalarrivaltime: 29 Mar 2019 17:14:31.7609 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 14aa5744-ece1-474e-a2d7-34f46dda64a1 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-Transport-CrossTenantHeadersStamped: LO2P123MB1792 Archived-At: Subject: Re: [dmarc-ietf] Working group next steps X-BeenThere: dmarc@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Domain-based Message Authentication, Reporting, and Compliance \(DMARC\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 29 Mar 2019 17:14:41 -0000 --_000_LO2P123MB22857A6A1EDD9D54A817C4F5C95A0LO2P123MB2285GBRP_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 ICAqICAgVGhlIHdvcmtpbmcgZ3JvdXAgc2hvdWxkLCBpbiB0aGUgc2hvcnQgdGVybSwgZm9jdXMg b24gZGV2ZWxvcG1lbnQgYW5kIGNvbXBsZXRpb24gb2YgZHJhZnQtaWV0Zi1kbWFyYy1wc2QuICBB bW9uZyB0aGUgcXVlc3Rpb25zIHRvIGJlIGFuc3dlcmVkIGlzIGl0cyB1cmdlbmN5DQoNCknigJlt IGNlcnRhaW5seSBrZWVuIHRvIHNlZSB0aGF0IHByb2dyZXNzZWQuIEFzIHdl4oCZdmUgcm9sbGVk IG91dCBETUFSQyBhY3Jvc3MgZ292LnVrIHN1YmRvbWFpbnMsIHdl4oCZdmUgc2VlbiBjcmltaW5h bCBiZWhhdmlvdXJzIGNoYW5nZSBpbiByZXNwb25zZS4gU29tZSBvZiB5b3UgbWF5IHJlY2FsbCB3 ZSBhc2tlZCBmb3IgaGVscCBhIHdoaWxlIGFnbyBmb3IgaWRlYXMgaW4gZ2VuZXJhdGluZyBTUEYv RE1BUkMgcmVjb3JkcyBmb3Igbm9uLWV4aXN0ZW50IHN1YmRvbWFpbnMuIFdlbGwsIHRoYXTigJlz IHJ1bm5pbmcgYW5kIHdlIGFuc3dlcmVkIDQzMCwwMDAgcXVlcmllcyBmb3IgdGhlbSBiZXR3ZWVu IEF1Z3VzdCBhbmQgTm92ZW1iZXIgbGFzdCB5ZWFyIChtb3JlIGN1cnJlbnQgZGF0YSBjb21pbmcp LiBXZSBkbyBrbm93IHRoYXQgdGhlIGVmZmVjdCBvZiBzeW50aGVzaXNpbmcgdGhlc2UgcmVjb3Jk cyBtZWFucyB0aGF0IHNvbWUgcmVjZWl2ZXJzIGRvbuKAmXQgaG9ub3VyIHRoZW0sIHNvIGdldHRp bmcgYSBtb3JlIGFjY2VwdGFibGUgd2F5IG9mIGNvbnRyb2xsaW5nIHN1YmRvbWFpbnMgb2YgYSBQ U0Qgd291bGQgYmUgZ29vZC4gQXMgd2UgcHVzaCBmb3Igd2lkZXIgRE1BUkMgYWRvcHRpb24gYW5k IG90aGVyIGF1dGhlbnRpY2F0aW9uIG1lYXN1cmVzLCB3ZeKAmWxsIG5lZWQgdG8gZG8gdGhpcyBt dWNoIG1vcmUgd2lkZWx5IHNvIGl0IG5lZWRzIHRvIGJlIGVhc3kuDQoNCknigJlsbCBhbHNvIG9m ZmVyIGdvdi51ayBhcyBhbiBleHBlcmltZW50YWwgZ3JvdW5kICh3aXRoaW4gcmVhc29uISkuDQoN ClRhLg0KDQpJLg0KDQotLQ0KRHIgSWFuIExldnkNClRlY2huaWNhbCBEaXJlY3Rvcg0KTmF0aW9u YWwgQ3liZXIgU2VjdXJpdHkgQ2VudHJlDQppYW5AbmNzYy5nb3YudWs8bWFpbHRvOmlhbkBuY3Nj Lmdvdi51az4NCg0KU3RhZmYgT2ZmaWNlciA6IEthdGUgQXRraW5zLCBrYXRlLmFAbmNzYy5nb3Yu dWs8bWFpbHRvOmthdGUuYUBuY3NjLmdvdi51az4NCg0KKEkgd29yayBzdHVwaWQgaG91cnMgYW5k IHdlaXJkIHRpbWVzIOKAkyB0aGF0IGRvZXNu4oCZdCBtZWFuIHlvdSBoYXZlIHRvLiBJZiB0aGlz IGFycml2ZXMgb3V0c2lkZSB5b3VyIG5vcm1hbCB3b3JraW5nIGhvdXJzLCBkb27igJl0IGZlZWwg Y29tcGVsbGVkIHRvIHJlc3BvbmQgaW1tZWRpYXRlbHkhKQ0KDQpGcm9tOiBkbWFyYyA8ZG1hcmMt Ym91bmNlc0BpZXRmLm9yZz4gT24gQmVoYWxmIE9mIE11cnJheSBTLiBLdWNoZXJhd3kNClNlbnQ6 IDI2IE1hcmNoIDIwMTkgMTY6NTgNClRvOiBJRVRGIERNQVJDIFdHIDxkbWFyY0BpZXRmLm9yZz4N ClN1YmplY3Q6IFtkbWFyYy1pZXRmXSBXb3JraW5nIGdyb3VwIG5leHQgc3RlcHMNCg0KRE1BUkMg Y29sbGVhZ3VlcywNCg0KVGltIGFuZCBJIG1ldCBpbiBQcmFndWUgdG8gZ2V0IHRoaW5ncyByb2xs aW5nIGluIHRlcm1zIG9mIGdldHRpbmcgdXMgcHJvZ3Jlc3NpbmcgYWdhaW4gdG93YXJkIG91ciBy ZW1haW5pbmcgZGVsaXZlcmFibGVzLg0KDQpQcm9kdWNpbmcgYSBETUFSQyBvbiB0aGUgc3RhbmRh cmRzIHRyYWNrIGlzIHRoZSBlbmRnYW1lIGZvciB1cy4gIFdlJ3JlIGtlZW4gdG8gaWRlbnRpZnkg YW5kIGZvY3VzIG9uIHdvcmsgdGhhdCBpcyBpbiBkaXJlY3Qgc2VydmljZSBvZiB0aGF0IGdvYWw7 IGFueXRoaW5nIGVsc2UgY2FuIGJlIHBhcmtlZCBmb3Igbm93IGFuZCB3ZSBjYW4gcmV0dXJuIHRv IGl0IG9uY2UgdGhlIG1haW4gd29yayBpcyBkb25lLCBhc3N1bWluZyB3ZSBzdGlsbCBoYXZlIHRo ZSBlbmVyZ3kgdG8gZG8gaXQuICBBY2NvcmRpbmdseSwgd2UgcHJvcG9zZSB0byBmb3JtYWxseSBw YXJrIGRyYWZ0LWlldGYtZG1hcmMtYXJjLW11bHRpIGFuZCBkcmFmdC1pZXRmLWRtYXJjLWFyYy11 c2FnZS4NCkF1Z3UNClRoZSB3b3JraW5nIGdyb3VwIHNob3VsZCwgaW4gdGhlIHNob3J0IHRlcm0s IGZvY3VzIG9uIGRldmVsb3BtZW50IGFuZCBjb21wbGV0aW9uIG9mIGRyYWZ0LWlldGYtZG1hcmMt cHNkLiAgQW1vbmcgdGhlIHF1ZXN0aW9ucyB0byBiZSBhbnN3ZXJlZCBpcyBpdHMgdXJnZW5jeTog SWYgdGhlcmUgaXMgcHJlc3N1cmUgdG8gZ2V0IHRoaXMgZmluaXNoZWQgYW5kIHB1Ymxpc2hlZCBp biBzb21lIGZvcm0sIHdlIHN1Z2dlc3QgdGhlIFdHIGNvbnNpZGVyIG1vdmluZyB0aGlzIHRvIEV4 cGVyaW1lbnRhbCBzdGF0dXMsIGFsaWduaW5nIGl0IHdpdGggdGhlIEFSQyBiYXNlIHdvcmssIGFu ZCBjb21lIGJhY2sgYXJvdW5kIHRvIG1lcmdlIGl0IGludG8gRE1BUkMgd2hlbiBpdCBnb2VzIHRv IHRoZSBTdGFuZGFyZHMgVHJhY2suDQoNClRvd2FyZCB0aGUgZ29hbCBvZiBnZXR0aW5nIHRvIHRo ZSB3b3JrIG9uIHRoZSBzdGFuZGFyZHMgdHJhY2sgYmFzZSBzcGVjaWZpY2F0aW9uLCB3ZSBzaG91 bGQgc3RhcnQgY29sbGVjdGluZyBpc3N1ZXMsIGZyb20gbml0cyBvbiB1cCB0byB0aGluZ3MgdGhh dCBuZWVkIG92ZXJoYXVsLCBpbiB0aGUgV0cncyB0cmFja2VyLiAgV2Ugd291bGQgbGlrZSB0aGlz IGxpc3QgdG8gYmUgYXMgZXhoYXVzdGl2ZSBhcyBwb3NzaWJsZS4gIFdoZW4gd2UgZG8gZmluYWxs eSBnZXQgdG8gdGhlIHdvcmsgb2Ygc3RhbmRhcmRzIHRyYWNrIERNQVJDLCB3ZSBjYW4gcnVuIGl0 IGxpa2UgYSBjaGVja2xpc3QuICBQbGVhc2UgdGFrZSBzb21lIHRpbWUgdG8gZ28gb3ZlciB0aGUg bGlzdCB0aGF0J3MgYWxyZWFkeSBpbiB0aGUgdHJhY2tlciwgYW5kIGFkZCBhbnl0aGluZyB5b3Ug dGhpbmsgaXMgbWlzc2luZzoNCg0KaHR0cHM6Ly90cmFjLmlldGYuLm9yZy90cmFjL2RtYXJjL3Jl cG9ydDxodHRwczovL2VtZWEwMS5zYWZlbGlua3MucHJvdGVjdGlvbi5vdXRsb29rLmNvbS8/dXJs PWh0dHBzJTNBJTJGJTJGdHJhYy5pZXRmLm9yZyUyRnRyYWMlMkZkbWFyYyUyRnJlcG9ydCZkYXRh PTAyJTdDMDElN0NpYW4ubGV2eSU0MG5jc2MuZ292LnVrJTdDMDYyYTRiMGVhMTFiNDRiZTZiNGYw OGQ2YjIwYzU0NzglN0MxNGFhNTc0NGVjZTE0NzRlYTJkNzM0ZjQ2ZGRhNjRhMSU3QzAlN0MwJTdD NjM2ODkyMTYzMzY4NDgyNDQ3JnNkYXRhPTVzOXFWbXAzRFRCVFpuWmFLZnRTR09kNkVuJTJGU1RQ bnA5UmplbzU4ZkhQbyUzRCZyZXNlcnZlZD0wPg0KWW91IG1heSBuZWVkIGEgbG9naW4gY3JlZGVu dGlhbCBpZiB5b3UgaGF2ZW4ndCBhbHJlYWR5IGVzdGFibGlzaGVkIG9uZS4gIFRoaXMgY2FuIGJl IGRvbmUgdmlhIHRoZSBJRVRGIGRhdGF0cmFja2VyOiBodHRwczovL2RhdGF0cmFja2VyLmlldGYu b3JnLzxodHRwczovL2VtZWEwMS5zYWZlbGlua3MucHJvdGVjdGlvbi5vdXRsb29rLmNvbS8/dXJs PWh0dHBzJTNBJTJGJTJGZGF0YXRyYWNrZXIuaWV0Zi5vcmclMkYmZGF0YT0wMiU3QzAxJTdDaWFu LmxldnklNDBuY3NjLmdvdi51ayU3QzA2MmE0YjBlYTExYjQ0YmU2YjRmMDhkNmIyMGM1NDc4JTdD MTRhYTU3NDRlY2UxNDc0ZWEyZDczNGY0NmRkYTY0YTElN0MwJTdDMCU3QzYzNjg5MjE2MzM2ODQ4 MjQ0NyZzZGF0YT1KQXNjWjdxYlpjb1RIcXEycmxLeThrMEFRN1JrR05OZGJVY2RrY240eFRrJTNE JnJlc2VydmVkPTA+DQoNClByZXZpb3VzbHkgKGF0IElFVEYgOTkpLCB0aGUgV0cgaGFzIGRpc2N1 c3NlZCBhbiBhdWdtZW50YXRpb24gb2YgRE1BUkMncyByZXBvcnRpbmcgY2FwYWJpbGl0aWVzIHRv IGluY2x1ZGUgYXR0cmlidXRlcyBvZiBBUkMgZXZhbHVhdGlvbiBvZiBhIG1lc3NhZ2UuICBJdCdz IGJlZW4gc3VnZ2VzdGVkIHRoYXQgdGhpcyBpcyBhIGNyaXRpY2FsIHRoaW5nIHRvIGluY2x1ZGUg aW4gdGhlIEFSQyBleHBlcmltZW50IGFuZCB0aHVzIGlucHV0IHRvIHN0YW5kYXJkcyB0cmFjayBE TUFSQyB3b3JrOyBpdCB3YXMgbGVmdCBvdXQgb2YgQVJDJ3MgYmFzZSBkb2N1bWVudCB0byBrZWVw IEFSQyBkZWNvdXBsZWQgZnJvbSBETUFSQyBmb3Igbm93LiAgSWYgY29uc2Vuc3VzIGNvbmN1cnMg d2l0aCB0aGlzIHBvc2l0aW9uLCB3ZSdyZSBsb29raW5nIGZvciBkb2N1bWVudCBlZGl0b3Iocykg dG8gc3BpbiB1cCB0aGF0IGVmZm9ydC4gIFRoZSBjaGFpcnMgYXJlLCBob3dldmVyLCBjb2duaXph bnQgdGhhdCBlYWNoIG5ldyB3b3JrIGl0ZW0gd2UgdGFrZSB1cCBoYXMgdGhlIGVmZmVjdCBvZiBw dXNoaW5nIHN0YW5kYXJkcyB0cmFjayBETUFSQyBmdXJ0aGVyIGRvd24gdGhlIHJvYWQsIHNvIHdl IHdvdWxkIGxpa2UgdG8ga2VlcCB0aGlzIHNvcnQgb2YgdGhpbmcgdG8gYSBtaW5pbXVtLg0KRmlu YWxseSwgdGhlcmUgaGF2ZSBiZWVuIHNvbWUgaGFsbHdheSBpbnF1aXJpZXMgaGVyZSBhdCBJRVRG IDEwNCBhYm91dCBjYW5vbmljYWxpemF0aW9ucyB0aGF0IGNhbiBzdXJ2aXZlIG1haWxpbmcgbGlz dCB0cmFuc2l0LiAgSSB0aG91Z2h0IGl0IHdvcnRoIGNoZWNraW5nIHdpdGggdGhlIFdHIHRvIHNl ZSBpZiB0aGVyZSdzIGFueSBlbmVyZ3kgb3IgaW50ZXJlc3QgaW4gcmV2aXNpdGluZyB0aGlzIGtp bmQgb2Ygd29yazsgaXQgZG9lcyBmaXQgd2l0aGluIG91ciBjaGFydGVyLCBidXQgcHJldmlvdXNs eSBhdHRlbXB0cyBhdCB0aGlzIGtpbmQgb2Ygd29yayBoYXZlIHdhbmVkLg0KDQpXZSBsb29rIGZv cndhcmQgdG8gaGVhcmluZyB5b3VyIHZpZXdzIG9uIGFueSBvciBhbGwgb2YgdGhlIGFib3ZlLiAg V2UgY2FuIHN0YXJ0IGJ5IGhhdmluZyBldmVyeW9uZSBiZWdpbiBsb2dnaW5nIHRoZWlyIG9wZW4g RE1BUkMgc3BlY2lmaWNhdGlvbiBpc3N1ZXMgaW50byB0aGUgdHJhY2tlciwgYW5kIGFzayB0aGF0 IGV2ZXJ5b25lIHBsZWFzZSByZXZpZXcgYW5kIGNvbW1lbnQgb24gdGhlIFBTRCBkcmFmdCBhbmQg cHJvdmlkZSBjb21tZW50cy4gIEluIHBhcnRpY3VsYXIsIGFueW9uZSB0aGF0IGhhcyBpbXBsZW1l bnRlZCBpdCBpcyBwYXJ0aWN1bGFybHkgcmVxdWVzdGVkIHRvIGNvbW1lbnQgKGluY2x1ZGluZyBT Y290dCwgc2luY2Ugd2UgaW1hZ2luZSBoZSdzIHRyaWVkIHRoaXMgYnkgbm93KS4NCg0KLU1TSw0K DQoNClRoaXMgaW5mb3JtYXRpb24gaXMgZXhlbXB0IHVuZGVyIHRoZSBGcmVlZG9tIG9mIEluZm9y bWF0aW9uIEFjdCAyMDAwIChGT0lBKSBhbmQgbWF5IGJlIGV4ZW1wdCB1bmRlciBvdGhlciBVSyBp bmZvcm1hdGlvbiBsZWdpc2xhdGlvbi4gUmVmZXIgYW55IEZPSUEgcXVlcmllcyB0byBuY3NjaW5m b2xlZ0BuY3NjLmdvdi51aw0K --_000_LO2P123MB22857A6A1EDD9D54A817C4F5C95A0LO2P123MB2285GBRP_ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IkdlbmVyYXRv ciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUgKGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxl PjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6 V2luZ2RpbmdzOw0KCXBhbm9zZS0xOjUgMCAwIDAgMCAwIDAgMCAwIDA7fQ0KQGZvbnQtZmFjZQ0K CXtmb250LWZhbWlseToiQ2FtYnJpYSBNYXRoIjsNCglwYW5vc2UtMToyIDQgNSAzIDUgNCA2IDMg MiA0O30NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6Q2FsaWJyaTsNCglwYW5vc2UtMToyIDE1 IDUgMiAyIDIgNCAzIDIgNDt9DQovKiBTdHlsZSBEZWZpbml0aW9ucyAqLw0KcC5Nc29Ob3JtYWws IGxpLk1zb05vcm1hbCwgZGl2Lk1zb05vcm1hbA0KCXttYXJnaW46MGNtOw0KCW1hcmdpbi1ib3R0 b206LjAwMDFwdDsNCglmb250LXNpemU6MTEuMHB0Ow0KCWZvbnQtZmFtaWx5OiJDYWxpYnJpIixz YW5zLXNlcmlmO30NCmE6bGluaywgc3Bhbi5Nc29IeXBlcmxpbmsNCgl7bXNvLXN0eWxlLXByaW9y aXR5Ojk5Ow0KCWNvbG9yOmJsdWU7DQoJdGV4dC1kZWNvcmF0aW9uOnVuZGVybGluZTt9DQphOnZp c2l0ZWQsIHNwYW4uTXNvSHlwZXJsaW5rRm9sbG93ZWQNCgl7bXNvLXN0eWxlLXByaW9yaXR5Ojk5 Ow0KCWNvbG9yOnB1cnBsZTsNCgl0ZXh0LWRlY29yYXRpb246dW5kZXJsaW5lO30NCnAuTXNvTGlz dFBhcmFncmFwaCwgbGkuTXNvTGlzdFBhcmFncmFwaCwgZGl2Lk1zb0xpc3RQYXJhZ3JhcGgNCgl7 bXNvLXN0eWxlLXByaW9yaXR5OjM0Ow0KCW1hcmdpbi10b3A6MGNtOw0KCW1hcmdpbi1yaWdodDow Y207DQoJbWFyZ2luLWJvdHRvbTowY207DQoJbWFyZ2luLWxlZnQ6MzYuMHB0Ow0KCW1hcmdpbi1i b3R0b206LjAwMDFwdDsNCglmb250LXNpemU6MTEuMHB0Ow0KCWZvbnQtZmFtaWx5OiJDYWxpYnJp IixzYW5zLXNlcmlmO30NCnAubXNvbm9ybWFsMCwgbGkubXNvbm9ybWFsMCwgZGl2Lm1zb25vcm1h bDANCgl7bXNvLXN0eWxlLW5hbWU6bXNvbm9ybWFsOw0KCW1zby1tYXJnaW4tdG9wLWFsdDphdXRv Ow0KCW1hcmdpbi1yaWdodDowY207DQoJbXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87DQoJbWFy Z2luLWxlZnQ6MGNtOw0KCWZvbnQtc2l6ZToxMS4wcHQ7DQoJZm9udC1mYW1pbHk6IkNhbGlicmki LHNhbnMtc2VyaWY7fQ0Kc3Bhbi5FbWFpbFN0eWxlMTgNCgl7bXNvLXN0eWxlLXR5cGU6cGVyc29u YWwtcmVwbHk7DQoJZm9udC1mYW1pbHk6IkNhbGlicmkiLHNhbnMtc2VyaWY7DQoJY29sb3I6d2lu ZG93dGV4dDt9DQouTXNvQ2hwRGVmYXVsdA0KCXttc28tc3R5bGUtdHlwZTpleHBvcnQtb25seTsN Cglmb250LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1zZXJpZjsNCgltc28tZmFyZWFzdC1sYW5ndWFn ZTpFTi1VUzt9DQpAcGFnZSBXb3JkU2VjdGlvbjENCgl7c2l6ZTo2MTIuMHB0IDc5Mi4wcHQ7DQoJ bWFyZ2luOjcyLjBwdCA3Mi4wcHQgNzIuMHB0IDcyLjBwdDt9DQpkaXYuV29yZFNlY3Rpb24xDQoJ e3BhZ2U6V29yZFNlY3Rpb24xO30NCi8qIExpc3QgRGVmaW5pdGlvbnMgKi8NCkBsaXN0IGwwDQoJ e21zby1saXN0LWlkOjMxNzczMDkwODsNCgltc28tbGlzdC10eXBlOmh5YnJpZDsNCgltc28tbGlz dC10ZW1wbGF0ZS1pZHM6LTI0NDc0MjM4IDEwNzMxMDc4MDggMTM0ODA3NTU1IDEzNDgwNzU1NyAx MzQ4MDc1NTMgMTM0ODA3NTU1IDEzNDgwNzU1NyAxMzQ4MDc1NTMgMTM0ODA3NTU1IDEzNDgwNzU1 Nzt9DQpAbGlzdCBsMDpsZXZlbDENCgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0K CW1zby1sZXZlbC10ZXh0Ou+DmDsNCgltc28tbGV2ZWwtdGFiLXN0b3A6bm9uZTsNCgltc28tbGV2 ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LTE4LjBwdDsNCglmb250LWZh bWlseTpXaW5nZGluZ3M7DQoJbXNvLWZhcmVhc3QtZm9udC1mYW1pbHk6Q2FsaWJyaTsNCgltc28t YmlkaS1mb250LWZhbWlseToiVGltZXMgTmV3IFJvbWFuIjt9DQpAbGlzdCBsMDpsZXZlbDINCgl7 bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0Om87DQoJbXNv LWxldmVsLXRhYi1zdG9wOm5vbmU7DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0K CXRleHQtaW5kZW50Oi0xOC4wcHQ7DQoJZm9udC1mYW1pbHk6IkNvdXJpZXIgTmV3Ijt9DQpAbGlz dCBsMDpsZXZlbDMNCgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZl bC10ZXh0Ou+CpzsNCgltc28tbGV2ZWwtdGFiLXN0b3A6bm9uZTsNCgltc28tbGV2ZWwtbnVtYmVy LXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LTE4LjBwdDsNCglmb250LWZhbWlseTpXaW5n ZGluZ3M7fQ0KQGxpc3QgbDA6bGV2ZWw0DQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxl dDsNCgltc28tbGV2ZWwtdGV4dDrvgrc7DQoJbXNvLWxldmVsLXRhYi1zdG9wOm5vbmU7DQoJbXNv LWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0xOC4wcHQ7DQoJZm9u dC1mYW1pbHk6U3ltYm9sO30NCkBsaXN0IGwwOmxldmVsNQ0KCXttc28tbGV2ZWwtbnVtYmVyLWZv cm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ6bzsNCgltc28tbGV2ZWwtdGFiLXN0b3A6bm9u ZTsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LTE4LjBw dDsNCglmb250LWZhbWlseToiQ291cmllciBOZXciO30NCkBsaXN0IGwwOmxldmVsNg0KCXttc28t bGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ674KnOw0KCW1zby1s ZXZlbC10YWItc3RvcDpub25lOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0 ZXh0LWluZGVudDotMTguMHB0Ow0KCWZvbnQtZmFtaWx5OldpbmdkaW5nczt9DQpAbGlzdCBsMDps ZXZlbDcNCgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0 Ou+CtzsNCgltc28tbGV2ZWwtdGFiLXN0b3A6bm9uZTsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0 aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LTE4LjBwdDsNCglmb250LWZhbWlseTpTeW1ib2w7fQ0K QGxpc3QgbDA6bGV2ZWw4DQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxldDsNCgltc28t bGV2ZWwtdGV4dDpvOw0KCW1zby1sZXZlbC10YWItc3RvcDpub25lOw0KCW1zby1sZXZlbC1udW1i ZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotMTguMHB0Ow0KCWZvbnQtZmFtaWx5OiJD b3VyaWVyIE5ldyI7fQ0KQGxpc3QgbDA6bGV2ZWw5DQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0 OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4dDrvgqc7DQoJbXNvLWxldmVsLXRhYi1zdG9wOm5vbmU7 DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0xOC4wcHQ7 DQoJZm9udC1mYW1pbHk6V2luZ2RpbmdzO30NCkBsaXN0IGwxDQoJe21zby1saXN0LWlkOjE3MzY3 NzkzOTg7DQoJbXNvLWxpc3QtdHlwZTpoeWJyaWQ7DQoJbXNvLWxpc3QtdGVtcGxhdGUtaWRzOjY1 MTg3NzczMCAxNzY4NzM5Mjk2IDEzNDgwNzU1NSAxMzQ4MDc1NTcgMTM0ODA3NTUzIDEzNDgwNzU1 NSAxMzQ4MDc1NTcgMTM0ODA3NTUzIDEzNDgwNzU1NSAxMzQ4MDc1NTc7fQ0KQGxpc3QgbDE6bGV2 ZWwxDQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4dDrv g5g7DQoJbXNvLWxldmVsLXRhYi1zdG9wOm5vbmU7DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlv bjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0xOC4wcHQ7DQoJZm9udC1mYW1pbHk6V2luZ2RpbmdzOw0K CW1zby1mYXJlYXN0LWZvbnQtZmFtaWx5OkNhbGlicmk7DQoJbXNvLWJpZGktZm9udC1mYW1pbHk6 IlRpbWVzIE5ldyBSb21hbiI7fQ0KQGxpc3QgbDE6bGV2ZWwyDQoJe21zby1sZXZlbC1udW1iZXIt Zm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4dDpvOw0KCW1zby1sZXZlbC10YWItc3RvcDpu b25lOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotMTgu MHB0Ow0KCWZvbnQtZmFtaWx5OiJDb3VyaWVyIE5ldyI7fQ0KQGxpc3QgbDE6bGV2ZWwzDQoJe21z by1sZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4dDrvgqc7DQoJbXNv LWxldmVsLXRhYi1zdG9wOm5vbmU7DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0K CXRleHQtaW5kZW50Oi0xOC4wcHQ7DQoJZm9udC1mYW1pbHk6V2luZ2RpbmdzO30NCkBsaXN0IGwx OmxldmVsNA0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRl eHQ674K3Ow0KCW1zby1sZXZlbC10YWItc3RvcDpub25lOw0KCW1zby1sZXZlbC1udW1iZXItcG9z aXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotMTguMHB0Ow0KCWZvbnQtZmFtaWx5OlN5bWJvbDt9 DQpAbGlzdCBsMTpsZXZlbDUNCgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1z by1sZXZlbC10ZXh0Om87DQoJbXNvLWxldmVsLXRhYi1zdG9wOm5vbmU7DQoJbXNvLWxldmVsLW51 bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0xOC4wcHQ7DQoJZm9udC1mYW1pbHk6 IkNvdXJpZXIgTmV3Ijt9DQpAbGlzdCBsMTpsZXZlbDYNCgl7bXNvLWxldmVsLW51bWJlci1mb3Jt YXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0Ou+CpzsNCgltc28tbGV2ZWwtdGFiLXN0b3A6bm9u ZTsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LTE4LjBw dDsNCglmb250LWZhbWlseTpXaW5nZGluZ3M7fQ0KQGxpc3QgbDE6bGV2ZWw3DQoJe21zby1sZXZl bC1udW1iZXItZm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4dDrvgrc7DQoJbXNvLWxldmVs LXRhYi1zdG9wOm5vbmU7DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQt aW5kZW50Oi0xOC4wcHQ7DQoJZm9udC1mYW1pbHk6U3ltYm9sO30NCkBsaXN0IGwxOmxldmVsOA0K CXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ6bzsNCglt c28tbGV2ZWwtdGFiLXN0b3A6bm9uZTsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7 DQoJdGV4dC1pbmRlbnQ6LTE4LjBwdDsNCglmb250LWZhbWlseToiQ291cmllciBOZXciO30NCkBs aXN0IGwxOmxldmVsOQ0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxl dmVsLXRleHQ674KnOw0KCW1zby1sZXZlbC10YWItc3RvcDpub25lOw0KCW1zby1sZXZlbC1udW1i ZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotMTguMHB0Ow0KCWZvbnQtZmFtaWx5Oldp bmdkaW5nczt9DQpvbA0KCXttYXJnaW4tYm90dG9tOjBjbTt9DQp1bA0KCXttYXJnaW4tYm90dG9t OjBjbTt9DQotLT48L3N0eWxlPjwhLS1baWYgZ3RlIG1zbyA5XT48eG1sPg0KPG86c2hhcGVkZWZh dWx0cyB2OmV4dD0iZWRpdCIgc3BpZG1heD0iMTAyNiIgLz4NCjwveG1sPjwhW2VuZGlmXS0tPjwh LS1baWYgZ3RlIG1zbyA5XT48eG1sPg0KPG86c2hhcGVsYXlvdXQgdjpleHQ9ImVkaXQiPg0KPG86 aWRtYXAgdjpleHQ9ImVkaXQiIGRhdGE9IjEiIC8+DQo8L286c2hhcGVsYXlvdXQ+PC94bWw+PCFb ZW5kaWZdLS0+DQo8L2hlYWQ+DQo8Ym9keSBsYW5nPSJFTi1HQiIgbGluaz0iYmx1ZSIgdmxpbms9 InB1cnBsZSI+DQo8ZGl2IGNsYXNzPSJXb3JkU2VjdGlvbjEiPg0KPHVsIHN0eWxlPSJtYXJnaW4t dG9wOjBjbSIgdHlwZT0iZGlzYyI+DQo8bGkgY2xhc3M9Ik1zb0xpc3RQYXJhZ3JhcGgiIHN0eWxl PSJtYXJnaW4tbGVmdDowY207bXNvLWxpc3Q6bDAgbGV2ZWwxIGxmbzIiPlRoZSB3b3JraW5nIGdy b3VwIHNob3VsZCwgaW4gdGhlIHNob3J0IHRlcm0sIGZvY3VzIG9uIGRldmVsb3BtZW50IGFuZCBj b21wbGV0aW9uIG9mIGRyYWZ0LWlldGYtZG1hcmMtcHNkLiZuYnNwOyBBbW9uZyB0aGUgcXVlc3Rp b25zIHRvIGJlIGFuc3dlcmVkIGlzIGl0cyB1cmdlbmN5PHNwYW4gc3R5bGU9Im1zby1mYXJlYXN0 LWxhbmd1YWdlOkVOLVVTIj48bzpwPjwvbzpwPjwvc3Bhbj48L2xpPjwvdWw+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj48c3BhbiBzdHlsZT0ibXNvLWZhcmVhc3QtbGFuZ3VhZ2U6RU4tVVMiPjxvOnA+ Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxl PSJtc28tZmFyZWFzdC1sYW5ndWFnZTpFTi1VUyI+SeKAmW0gY2VydGFpbmx5IGtlZW4gdG8gc2Vl IHRoYXQgcHJvZ3Jlc3NlZC4gQXMgd2XigJl2ZSByb2xsZWQgb3V0IERNQVJDIGFjcm9zcyBnb3Yu dWsgc3ViZG9tYWlucywgd2XigJl2ZSBzZWVuIGNyaW1pbmFsIGJlaGF2aW91cnMgY2hhbmdlIGlu IHJlc3BvbnNlLiBTb21lIG9mIHlvdSBtYXkgcmVjYWxsIHdlIGFza2VkIGZvciBoZWxwIGEgd2hp bGUNCiBhZ28gZm9yIGlkZWFzIGluIGdlbmVyYXRpbmcgU1BGL0RNQVJDIHJlY29yZHMgZm9yIG5v bi1leGlzdGVudCBzdWJkb21haW5zLiBXZWxsLCB0aGF04oCZcyBydW5uaW5nIGFuZCB3ZSBhbnN3 ZXJlZCA0MzAsMDAwIHF1ZXJpZXMgZm9yIHRoZW0gYmV0d2VlbiBBdWd1c3QgYW5kIE5vdmVtYmVy IGxhc3QgeWVhciAobW9yZSBjdXJyZW50IGRhdGEgY29taW5nKS4gV2UgZG8ga25vdyB0aGF0IHRo ZSBlZmZlY3Qgb2Ygc3ludGhlc2lzaW5nIHRoZXNlIHJlY29yZHMNCiBtZWFucyB0aGF0IHNvbWUg cmVjZWl2ZXJzIGRvbuKAmXQgaG9ub3VyIHRoZW0sIHNvIGdldHRpbmcgYSBtb3JlIGFjY2VwdGFi bGUgd2F5IG9mIGNvbnRyb2xsaW5nIHN1YmRvbWFpbnMgb2YgYSBQU0Qgd291bGQgYmUgZ29vZC4g QXMgd2UgcHVzaCBmb3Igd2lkZXIgRE1BUkMgYWRvcHRpb24gYW5kIG90aGVyIGF1dGhlbnRpY2F0 aW9uIG1lYXN1cmVzLCB3ZeKAmWxsIG5lZWQgdG8gZG8gdGhpcyBtdWNoIG1vcmUgd2lkZWx5IHNv IGl0IG5lZWRzIHRvIGJlDQogZWFzeS4gPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9Im1zby1mYXJlYXN0LWxhbmd1YWdlOkVOLVVTIj48bzpw PiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHls ZT0ibXNvLWZhcmVhc3QtbGFuZ3VhZ2U6RU4tVVMiPknigJlsbCBhbHNvIG9mZmVyIGdvdi51ayBh cyBhbiBleHBlcmltZW50YWwgZ3JvdW5kICh3aXRoaW4gcmVhc29uISkuICZuYnNwOzxvOnA+PC9v OnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJtc28tZmFy ZWFzdC1sYW5ndWFnZTpFTi1VUyI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xh c3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9Im1zby1mYXJlYXN0LWxhbmd1YWdlOkVOLVVTIj5U YS48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHls ZT0ibXNvLWZhcmVhc3QtbGFuZ3VhZ2U6RU4tVVMiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwv cD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJtc28tZmFyZWFzdC1sYW5ndWFn ZTpFTi1VUyI+SS48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48 c3BhbiBzdHlsZT0ibXNvLWZhcmVhc3QtbGFuZ3VhZ2U6RU4tVVMiPjxvOnA+Jm5ic3A7PC9vOnA+ PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPi0tPG86cD48L286cD48L3A+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIj5EciBJYW4gTGV2eTxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+VGVjaG5pY2FsIERpcmVjdG9yPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIj5OYXRpb25hbCBDeWJlciBTZWN1cml0eSBDZW50cmU8bzpwPjwvbzpwPjwvcD4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiPjxhIGhyZWY9Im1haWx0bzppYW5AbmNzYy5nb3YudWsiPjxzcGFu IHN0eWxlPSJjb2xvcjojMDU2M0MxIj5pYW5AbmNzYy5nb3YudWs8L3NwYW4+PC9hPjxvOnA+PC9v OnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIj5TdGFmZiBPZmZpY2VyIDogS2F0ZSBBdGtpbnMsIDxhIGhyZWY9Im1h aWx0bzprYXRlLmFAbmNzYy5nb3YudWsiPg0KPHNwYW4gc3R5bGU9ImNvbG9yOiMwNTYzQzEiPmth dGUuYUBuY3NjLmdvdi51azwvc3Bhbj48L2E+PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPihJIHdv cmsgc3R1cGlkIGhvdXJzIGFuZCB3ZWlyZCB0aW1lcyDigJMgdGhhdCBkb2VzbuKAmXQgbWVhbiB5 b3UgaGF2ZSB0by4gSWYgdGhpcyBhcnJpdmVzIG91dHNpZGUgeW91ciBub3JtYWwgd29ya2luZyBo b3VycywgZG9u4oCZdCBmZWVsIGNvbXBlbGxlZCB0byByZXNwb25kIGltbWVkaWF0ZWx5ISk8bzpw PjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJtc28tZmFyZWFz dC1sYW5ndWFnZTpFTi1VUyI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCI+PGI+PHNwYW4gbGFuZz0iRU4tVVMiPkZyb206PC9zcGFuPjwvYj48c3BhbiBs YW5nPSJFTi1VUyI+IGRtYXJjICZsdDtkbWFyYy1ib3VuY2VzQGlldGYub3JnJmd0Ow0KPGI+T24g QmVoYWxmIE9mIDwvYj5NdXJyYXkgUy4gS3VjaGVyYXd5PGJyPg0KPGI+U2VudDo8L2I+IDI2IE1h cmNoIDIwMTkgMTY6NTg8YnI+DQo8Yj5Ubzo8L2I+IElFVEYgRE1BUkMgV0cgJmx0O2RtYXJjQGll dGYub3JnJmd0Ozxicj4NCjxiPlN1YmplY3Q6PC9iPiBbZG1hcmMtaWV0Zl0gV29ya2luZyBncm91 cCBuZXh0IHN0ZXBzPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ PG86cD4mbmJzcDs8L286cD48L3A+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xh c3M9Ik1zb05vcm1hbCI+RE1BUkMgY29sbGVhZ3Vlcyw8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0K PGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+ DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+VGltIGFuZCBJIG1ldCBpbiBQcmFndWUgdG8g Z2V0IHRoaW5ncyByb2xsaW5nIGluIHRlcm1zIG9mIGdldHRpbmcgdXMgcHJvZ3Jlc3NpbmcgYWdh aW4gdG93YXJkIG91ciByZW1haW5pbmcgZGVsaXZlcmFibGVzLjxvOnA+PC9vOnA+PC9wPg0KPC9k aXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8 L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5Qcm9kdWNpbmcgYSBETUFSQyBvbiB0 aGUgc3RhbmRhcmRzIHRyYWNrIGlzIHRoZSBlbmRnYW1lIGZvciB1cy4mbmJzcDsgV2UncmUga2Vl biB0byBpZGVudGlmeSBhbmQgZm9jdXMgb24gd29yayB0aGF0IGlzIGluIGRpcmVjdCBzZXJ2aWNl IG9mIHRoYXQgZ29hbDsgYW55dGhpbmcgZWxzZSBjYW4gYmUgcGFya2VkIGZvciBub3cgYW5kIHdl IGNhbiByZXR1cm4gdG8gaXQgb25jZSB0aGUgbWFpbiB3b3JrIGlzIGRvbmUsIGFzc3VtaW5nDQog d2Ugc3RpbGwgaGF2ZSB0aGUgZW5lcmd5IHRvIGRvIGl0LiZuYnNwOyBBY2NvcmRpbmdseSwgd2Ug cHJvcG9zZSB0byBmb3JtYWxseSBwYXJrIGRyYWZ0LWlldGYtZG1hcmMtYXJjLW11bHRpIGFuZCBk cmFmdC1pZXRmLWRtYXJjLWFyYy11c2FnZS48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiPkF1Z3U8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiPlRoZSB3b3JraW5nIGdyb3VwIHNob3VsZCwgaW4gdGhlIHNo b3J0IHRlcm0sIGZvY3VzIG9uIGRldmVsb3BtZW50IGFuZCBjb21wbGV0aW9uIG9mIGRyYWZ0LWll dGYtZG1hcmMtcHNkLiZuYnNwOyBBbW9uZyB0aGUgcXVlc3Rpb25zIHRvIGJlIGFuc3dlcmVkIGlz IGl0cyB1cmdlbmN5OiBJZiB0aGVyZSBpcyBwcmVzc3VyZSB0byBnZXQgdGhpcyBmaW5pc2hlZCBh bmQgcHVibGlzaGVkIGluIHNvbWUgZm9ybSwgd2Ugc3VnZ2VzdA0KIHRoZSBXRyBjb25zaWRlciBt b3ZpbmcgdGhpcyB0byBFeHBlcmltZW50YWwgc3RhdHVzLCBhbGlnbmluZyBpdCB3aXRoIHRoZSBB UkMgYmFzZSB3b3JrLCBhbmQgY29tZSBiYWNrIGFyb3VuZCB0byBtZXJnZSBpdCBpbnRvIERNQVJD IHdoZW4gaXQgZ29lcyB0byB0aGUgU3RhbmRhcmRzIFRyYWNrLjxvOnA+PC9vOnA+PC9wPg0KPC9k aXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8 L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWJvdHRvbTox Mi4wcHQiPlRvd2FyZCB0aGUgZ29hbCBvZiBnZXR0aW5nIHRvIHRoZSB3b3JrIG9uIHRoZSBzdGFu ZGFyZHMgdHJhY2sgYmFzZSBzcGVjaWZpY2F0aW9uLCB3ZSBzaG91bGQgc3RhcnQgY29sbGVjdGlu ZyBpc3N1ZXMsIGZyb20gbml0cyBvbiB1cCB0byB0aGluZ3MgdGhhdCBuZWVkIG92ZXJoYXVsLCBp biB0aGUgV0cncyB0cmFja2VyLiZuYnNwOyBXZSB3b3VsZCBsaWtlIHRoaXMgbGlzdA0KIHRvIGJl IGFzIGV4aGF1c3RpdmUgYXMgcG9zc2libGUuJm5ic3A7IFdoZW4gd2UgZG8gZmluYWxseSBnZXQg dG8gdGhlIHdvcmsgb2Ygc3RhbmRhcmRzIHRyYWNrIERNQVJDLCB3ZSBjYW4gcnVuIGl0IGxpa2Ug YSBjaGVja2xpc3QuJm5ic3A7IFBsZWFzZSB0YWtlIHNvbWUgdGltZSB0byBnbyBvdmVyIHRoZSBs aXN0IHRoYXQncyBhbHJlYWR5IGluIHRoZSB0cmFja2VyLCBhbmQgYWRkIGFueXRoaW5nIHlvdSB0 aGluayBpcyBtaXNzaW5nOjxicj4NCjxicj4NCjxhIGhyZWY9Imh0dHBzOi8vZW1lYTAxLnNhZmVs aW5rcy5wcm90ZWN0aW9uLm91dGxvb2suY29tLz91cmw9aHR0cHMlM0ElMkYlMkZ0cmFjLmlldGYu b3JnJTJGdHJhYyUyRmRtYXJjJTJGcmVwb3J0JmFtcDtkYXRhPTAyJTdDMDElN0NpYW4ubGV2eSU0 MG5jc2MuZ292LnVrJTdDMDYyYTRiMGVhMTFiNDRiZTZiNGYwOGQ2YjIwYzU0NzglN0MxNGFhNTc0 NGVjZTE0NzRlYTJkNzM0ZjQ2ZGRhNjRhMSU3QzAlN0MwJTdDNjM2ODkyMTYzMzY4NDgyNDQ3JmFt cDtzZGF0YT01czlxVm1wM0RUQlRablphS2Z0U0dPZDZFbiUyRlNUUG5wOVJqZW81OGZIUG8lM0Qm YW1wO3Jlc2VydmVkPTAiPmh0dHBzOi8vdHJhYy5pZXRmLi5vcmcvdHJhYy9kbWFyYy9yZXBvcnQ8 L2E+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5Z b3UgbWF5IG5lZWQgYSBsb2dpbiBjcmVkZW50aWFsIGlmIHlvdSBoYXZlbid0IGFscmVhZHkgZXN0 YWJsaXNoZWQgb25lLiZuYnNwOyBUaGlzIGNhbiBiZSBkb25lIHZpYSB0aGUgSUVURiBkYXRhdHJh Y2tlcjoNCjxhIGhyZWY9Imh0dHBzOi8vZW1lYTAxLnNhZmVsaW5rcy5wcm90ZWN0aW9uLm91dGxv b2suY29tLz91cmw9aHR0cHMlM0ElMkYlMkZkYXRhdHJhY2tlci5pZXRmLm9yZyUyRiZhbXA7ZGF0 YT0wMiU3QzAxJTdDaWFuLmxldnklNDBuY3NjLmdvdi51ayU3QzA2MmE0YjBlYTExYjQ0YmU2YjRm MDhkNmIyMGM1NDc4JTdDMTRhYTU3NDRlY2UxNDc0ZWEyZDczNGY0NmRkYTY0YTElN0MwJTdDMCU3 QzYzNjg5MjE2MzM2ODQ4MjQ0NyZhbXA7c2RhdGE9SkFzY1o3cWJaY29USHFxMnJsS3k4azBBUTdS a0dOTmRiVWNka2NuNHhUayUzRCZhbXA7cmVzZXJ2ZWQ9MCI+DQpodHRwczovL2RhdGF0cmFja2Vy LmlldGYub3JnLzwvYT48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1ib3R0b206MTIuMHB0Ij5QcmV2aW91c2x5IChhdCBJ RVRGIDk5KSwgdGhlIFdHIGhhcyBkaXNjdXNzZWQgYW4gYXVnbWVudGF0aW9uIG9mIERNQVJDJ3Mg cmVwb3J0aW5nIGNhcGFiaWxpdGllcyB0byBpbmNsdWRlIGF0dHJpYnV0ZXMgb2YgQVJDIGV2YWx1 YXRpb24gb2YgYSBtZXNzYWdlLiZuYnNwOyBJdCdzIGJlZW4gc3VnZ2VzdGVkIHRoYXQgdGhpcyBp cyBhIGNyaXRpY2FsIHRoaW5nIHRvIGluY2x1ZGUNCiBpbiB0aGUgQVJDIGV4cGVyaW1lbnQgYW5k IHRodXMgaW5wdXQgdG8gc3RhbmRhcmRzIHRyYWNrIERNQVJDIHdvcms7IGl0IHdhcyBsZWZ0IG91 dCBvZiBBUkMncyBiYXNlIGRvY3VtZW50IHRvIGtlZXAgQVJDIGRlY291cGxlZCBmcm9tIERNQVJD IGZvciBub3cuJm5ic3A7IElmIGNvbnNlbnN1cyBjb25jdXJzIHdpdGggdGhpcyBwb3NpdGlvbiwg d2UncmUgbG9va2luZyBmb3IgZG9jdW1lbnQgZWRpdG9yKHMpIHRvIHNwaW4gdXAgdGhhdCBlZmZv cnQuJm5ic3A7IFRoZQ0KIGNoYWlycyBhcmUsIGhvd2V2ZXIsIGNvZ25pemFudCB0aGF0IGVhY2gg bmV3IHdvcmsgaXRlbSB3ZSB0YWtlIHVwIGhhcyB0aGUgZWZmZWN0IG9mIHB1c2hpbmcgc3RhbmRh cmRzIHRyYWNrIERNQVJDIGZ1cnRoZXIgZG93biB0aGUgcm9hZCwgc28gd2Ugd291bGQgbGlrZSB0 byBrZWVwIHRoaXMgc29ydCBvZiB0aGluZyB0byBhIG1pbmltdW0uPG86cD48L286cD48L3A+DQo8 L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5GaW5hbGx5LCB0aGVyZSBoYXZlIGJl ZW4gc29tZSBoYWxsd2F5IGlucXVpcmllcyBoZXJlIGF0IElFVEYgMTA0IGFib3V0IGNhbm9uaWNh bGl6YXRpb25zIHRoYXQgY2FuIHN1cnZpdmUgbWFpbGluZyBsaXN0IHRyYW5zaXQuJm5ic3A7IEkg dGhvdWdodCBpdCB3b3J0aCBjaGVja2luZyB3aXRoIHRoZSBXRyB0byBzZWUgaWYgdGhlcmUncyBh bnkgZW5lcmd5IG9yIGludGVyZXN0IGluIHJldmlzaXRpbmcgdGhpcyBraW5kIG9mDQogd29yazsg aXQgZG9lcyBmaXQgd2l0aGluIG91ciBjaGFydGVyLCBidXQgcHJldmlvdXNseSBhdHRlbXB0cyBh dCB0aGlzIGtpbmQgb2Ygd29yayBoYXZlIHdhbmVkLjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8 ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4N CjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5XZSBsb29rIGZvcndhcmQgdG8gaGVhcmluZyB5 b3VyIHZpZXdzIG9uIGFueSBvciBhbGwgb2YgdGhlIGFib3ZlLiZuYnNwOyBXZSBjYW4gc3RhcnQg YnkgaGF2aW5nIGV2ZXJ5b25lIGJlZ2luIGxvZ2dpbmcgdGhlaXIgb3BlbiBETUFSQyBzcGVjaWZp Y2F0aW9uIGlzc3VlcyBpbnRvIHRoZSB0cmFja2VyLCBhbmQgYXNrIHRoYXQgZXZlcnlvbmUgcGxl YXNlIHJldmlldyBhbmQgY29tbWVudCBvbiB0aGUgUFNEIGRyYWZ0IGFuZA0KIHByb3ZpZGUgY29t bWVudHMuJm5ic3A7IEluIHBhcnRpY3VsYXIsIGFueW9uZSB0aGF0IGhhcyBpbXBsZW1lbnRlZCBp dCBpcyBwYXJ0aWN1bGFybHkgcmVxdWVzdGVkIHRvIGNvbW1lbnQgKGluY2x1ZGluZyBTY290dCwg c2luY2Ugd2UgaW1hZ2luZSBoZSdzIHRyaWVkIHRoaXMgYnkgbm93KS48bzpwPjwvbzpwPjwvcD4N CjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9w Pg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+LU1TSzxvOnA+PC9vOnA+PC9w Pg0KPC9kaXY+DQo8ZGl2Pg0KPHRhYmxlIGNsYXNzPSJNc29Ob3JtYWxUYWJsZSIgYm9yZGVyPSIw IiBjZWxscGFkZGluZz0iMCI+DQo8dGJvZHk+DQo8dHI+DQo8dGQgc3R5bGU9InBhZGRpbmc6Ljc1 cHQgLjc1cHQgLjc1cHQgLjc1cHQiPjwvdGQ+DQo8dGQgc3R5bGU9InBhZGRpbmc6Ljc1cHQgLjc1 cHQgLjc1cHQgLjc1cHQiPjwvdGQ+DQo8L3RyPg0KPC90Ym9keT4NCjwvdGFibGU+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rp dj4NCjwvZGl2Pg0KPC9kaXY+DQpUaGlzIGluZm9ybWF0aW9uIGlzIGV4ZW1wdCB1bmRlciB0aGUg RnJlZWRvbSBvZiBJbmZvcm1hdGlvbiBBY3QgMjAwMCAoRk9JQSkgYW5kIG1heSBiZSBleGVtcHQg dW5kZXIgb3RoZXIgVUsgaW5mb3JtYXRpb24gbGVnaXNsYXRpb24uIFJlZmVyIGFueSBGT0lBIHF1 ZXJpZXMgdG8gbmNzY2luZm9sZWdAbmNzYy5nb3YudWsNCjwvYm9keT4NCjwvaHRtbD4NCg== --_000_LO2P123MB22857A6A1EDD9D54A817C4F5C95A0LO2P123MB2285GBRP_-- From nobody Fri Mar 29 10:19:04 2019 Return-Path: X-Original-To: dmarc@ietfa.amsl.com Delivered-To: dmarc@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9AC6E120467 for ; Fri, 29 Mar 2019 10:18:53 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2 X-Spam-Level: X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=neutral reason="invalid (unsupported algorithm ed25519-sha256)" header.d=kitterman.com header.b=G4WrqBNk; dkim=pass (2048-bit key) header.d=kitterman.com header.b=hLgZwoLo Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id TQvaYABJHNqH for ; Fri, 29 Mar 2019 10:18:51 -0700 (PDT) Received: from interserver.kitterman.com (interserver.kitterman.com [64.20.48.66]) (using TLSv1.2 with cipher ADH-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 4BB9412039F for ; Fri, 29 Mar 2019 10:18:50 -0700 (PDT) Received: from interserver.kitterman.com (interserver.kitterman.com [64.20.48.66]) by interserver.kitterman.com (Postfix) with ESMTPS id 2414BF8096F for ; Fri, 29 Mar 2019 13:18:49 -0400 (EDT) DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/simple; d=kitterman.com; i=@kitterman.com; q=dns/txt; s=201903e; t=1553879928; h=from : to : subject : date : message-id : in-reply-to : references : mime-version : content-transfer-encoding : content-type : from; bh=Rd4QuxjPtMPhFrvQRA6lrszydgCULSr070d3VFScBrI=; b=G4WrqBNkZeUQN+NPTxz8uNG+kaB2xc37ONSCX2SZu3nGVx31fYiiwxqN 22inVB44tHcZWvacX3VqxPnDhYzNBw== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kitterman.com; i=@kitterman.com; q=dns/txt; s=201903r; t=1553879928; h=from : to : subject : date : message-id : in-reply-to : references : mime-version : content-transfer-encoding : content-type : from; bh=Rd4QuxjPtMPhFrvQRA6lrszydgCULSr070d3VFScBrI=; b=hLgZwoLoByofAp7XIfxAb9k41wgY69MreLmR28HKCB9aTSZGfmpE0XKv 7QSJGV+MBsS5/yOA+iETRECt2jSrv24PUoDGRKAIijdVRsQ1EizhJ3YSZg WULmLG93IqwK56cuKC3gNebZoXgFFJogsTaaLLzJbSU9MRSupZGZ90Nhr1 a1dt553evJfl7BrcZbtaEyQX+ulpaNkEsfBMQ1bQBTI/k8+6xobsyRzJgq SmgDUUxwiMhguGzRPIIeeanXMYNElfqHDZE1Dr0s4spfnFenAN8iy9C8as 5v8VbZSgEwb1ICN4wO83VkDssCQmUl8l6sf0bGpm31Q4FTU3ySU6Kw== Received: from kitterma-e6430.localnet (static-72-81-252-22.bltmmd.fios.verizon.net [72.81.252.22]) by interserver.kitterman.com (Postfix) with ESMTPSA id E9333F80864 for ; Fri, 29 Mar 2019 13:18:48 -0400 (EDT) From: Scott Kitterman To: IETF DMARC WG Date: Fri, 29 Mar 2019 13:18:47 -0400 Message-ID: <3802074.4RGYGbXOYh@kitterma-e6430> User-Agent: KMail/4.13.3 (Linux/3.13.0-164-generic; KDE/4.13.3; x86_64; ; ) In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Archived-At: Subject: Re: [dmarc-ietf] Working group next steps X-BeenThere: dmarc@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Domain-based Message Authentication, Reporting, and Compliance \(DMARC\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 29 Mar 2019 17:19:02 -0000 On Friday, March 29, 2019 05:14:31 PM Ian Levy wrote: > * The working group should, in the short term, focus on developme= nt and > completion of draft-ietf-dmarc-psd. Among the questions to be answer= ed is > its urgency =20 > I=E2=80=99m certainly keen to see that progressed. As we=E2=80=99ve r= olled out DMARC across > gov.uk subdomains, we=E2=80=99ve seen criminal behaviours change in r= esponse. Some > of you may recall we asked for help a while ago for ideas in generati= ng > SPF/DMARC records for non-existent subdomains. Well, that=E2=80=99s r= unning and we > answered 430,000 queries for them between August and November last ye= ar > (more current data coming). We do know that the effect of synthesisin= g > these records means that some receivers don=E2=80=99t honour them, so= getting a > more acceptable way of controlling subdomains of a PSD would be good.= As we > push for wider DMARC adoption and other authentication measures, we=E2= =80=99ll need > to do this much more widely so it needs to be easy. =20 > I=E2=80=99ll also offer gov.uk as an experimental ground (within reas= on!). Excellent. I've listed it in the experimental registry at psddmarc.org= . =20 Since you already had a live DMARC record for that domain, people can=20= experiment with this now. Scott K From nobody Fri Mar 29 14:32:48 2019 Return-Path: X-Original-To: dmarc@ietfa.amsl.com Delivered-To: dmarc@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C1E7912030B for ; Fri, 29 Mar 2019 14:32:46 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.699 X-Spam-Level: X-Spam-Status: No, score=-1.699 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_INVALID=0.1, DKIM_SIGNED=0.1, RCVD_IN_DNSWL_NONE=-0.0001, URIBL_BLOCKED=0.001] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=fail (4096-bit key) reason="fail (message has been altered)" header.d=aegee.org Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id VYG4OxanGpg0 for ; Fri, 29 Mar 2019 14:32:45 -0700 (PDT) Received: from mail.aegee.org (mail.aegee.org [144.76.142.78]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 6D8801202F5 for ; Fri, 29 Mar 2019 14:32:43 -0700 (PDT) Authentication-Results: mail.aegee.org/x2TLWXw9006956; auth=pass (PLAIN) smtp.auth=didopalauzov DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=aegee.org; s=k4096; t=1553895155; i=dkim+MSA-tls@aegee.org; r=y; bh=fK4mrtaZT56WrW59gCLY4YwHChv8QWo0rYBCZ2FZgQo=; h=Subject:From:To:Cc:In-Reply-To:References:Date; b=Srohqv8LWxUH0ydbY3JRdWs835FfLrUaze8m5iwCwa3fOy5pftG8MHYNnrTQNrShv PEyizwMwlZi012DUo4hRsPEGEiMDZTmx1ZkIiGwne4i9XSncpzrU1c6AgsZlZVlKCn gXl4i5cYN+DRQXkDsYgnol8j/DroTz8NTozLL4kqQ6M7cY1ibVLnRyCt+xJRwqoDtf 60dOa0gK+l7M5uakYN794xg90qlf3Yy/jZe6BZvZTXTAzkwVBrxT3o3/aEckKxD67I dzKgkGPmyKKa7/UPMNYoFFIWObuH+7jKrTMTJvo+851ta07h2YzvK2Z/HDd4yGePiI 6p95Jufhs5LMlBrgtHHKjqcuh9rBeR0AYhAyH/Tz/r86eni0Lk2PwoxPNkJMbpspfK exQNNFQ5C3Ri7lqI9TrfxrMk53N25k5D5Pw5mEIL319D1u4KoHVrsxqF+0lsWM5UKF IF8Du6Bk2fRSgujl7xlmOkUDl7CNhPBz49CK4+UCx40BEsM7FworOcXQAzK8+T0Sam 7mdN+HDii3kG1GVzpUs0xo1nNdf3uYCAU2lWWF0l5AgYtAMR18x4Fm5UJay2regXxi SrZY5Qh0fHf2F8CG6pg8+bPkO+Zea1oJwYWQs8/HLwqrP1nAbM1cG/SNsFM3l8spsc eS/dp80n88ReJ5FLqIa0pnLY= Authentication-Results: mail.aegee.org/x2TLWXw9006956; dkim=none Received: from Tylan ([185.109.153.2]) (authenticated bits=0) by mail.aegee.org (8.15.2/8.15.2) with ESMTPSA id x2TLWXw9006956 (version=TLSv1.3 cipher=TLS_AES_256_GCM_SHA384 bits=256 verify=NO); Fri, 29 Mar 2019 21:32:34 GMT Message-ID: <52e91dfdce6ac4bca896924455455a874773a108.camel@aegee.org> From: =?UTF-8?Q?=D0=94=D0=B8=D0=BB=D1=8F=D0=BD_?= =?UTF-8?Q?=D0=9F=D0=B0=D0=BB=D0=B0=D1=83=D0=B7=D0=BE=D0=B2?= To: Doug Foster , "'Ken Simpson'" , "'John R Levine'" Cc: "'IETF DMARC WG'" , "'Dotzero'" In-Reply-To: <002901d4e014$f0b50570$d21f1050$@bayviewphysicians.com> References: <20190319184209.804E42010381DB@ary.qy> <002901d4e014$f0b50570$d21f1050$@bayviewphysicians.com> Content-Type: text/plain; charset="UTF-8" Date: Fri, 29 Mar 2019 21:12:31 +0000 MIME-Version: 1.0 User-Agent: Evolution 3.33.1 Content-Transfer-Encoding: 8bit X-Virus-Scanned: clamav-milter 0.101.2 at mail.aegee.org X-Virus-Status: Clean Archived-At: Subject: [dmarc-ietf] SPF / Re: Email security beyond DMARC? X-BeenThere: dmarc@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Domain-based Message Authentication, Reporting, and Compliance \(DMARC\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 29 Mar 2019 21:32:47 -0000 Hello Doug, my understanding is, that SPF complements DKIM only in the cases, where the MTA is not capable to sign an email, e.g. a bounce. So, if your MTA can DKIM-sign everything, you do not need SPF. > Do you handle SPF any differently between senders with DMARC enforcement and those without? No, SPF does not work with aliases (where no SRS is applied). My experience sending email over a mailing list to some domains directly and to the same domains indirectly (over other hosts, which in fact do aliasing) for a DKIM signature that failed is, that due SPF the direct emails were delivered, whereas the indirect emails were not. This also created indirect feedback, that is not in my logs very precise. So I concluded to remove SPF TXT records and next time such things happen, I can check in the logs which message in particular was rejected and maybe avoid such situations in the future. Regards Дилян On Thu, 2019-03-21 at 14:36 -0400, Doug Foster wrote: > I am all for anything that cuts unwanted email. Not sure of the need to distinguish between spam and phishing. > > I am assuming that I am the only one in this group not using DMARC. You heard my problems with SPF. > > What do you do for SPF Exceptions? > · We have never seen a legitimate sender who needed an exception? > · We whitelist the source IP address and trust that it will only be used for appropriate domains? > · We whitelist the sender domain and hope it will never be spoofed? > · Something else? > > Also, how do you handle SPF non-pass: Neutral, Softfail, Syntax errors, or Excessive nesting > > Do you handle SPF any differently between senders with DMARC enforcement and those without? > > Doug Foster > > > From: dmarc [mailto:dmarc-bounces@ietf.org] On Behalf Of Ken Simpson > Sent: Thursday, March 21, 2019 1:01 PM > To: John R Levine > Cc: IETF DMARC WG; Dotzero > Subject: Re: [dmarc-ietf] Email security beyond DMARC? > > > > I'm going to have to disagree with you John. DMARC is about preventing > > > direct domain abuse. It does not specifically address phishing as the bad > > > guys can simply use cousin domains, homoglyphs, etc. > > > > Well, it's abount a subset of phishing. It's surely more about phishing > > than about spam. > > > IMHO, by cutting out direct domain spoofing, DMARC makes it easier for receivers to craft algorithms that spot impersonation attacks. Once you have configured DMARC, receivers can build - for example - a machine learning system that learns what your legitimate email looks like. They can use that same system to identify messages that look like your legitimate email but which do not actually originate from your domain. > > If you want to detect domain impersonation or "brand" impersonation, you first have to have a verifiable ground truth corpus. That is what DMARC offers. > > Regards, > Ken > > _______________________________________________ > dmarc mailing list > dmarc@ietf.org > https://www.ietf.org/mailman/listinfo/dmarc From nobody Sun Mar 31 03:18:22 2019 Return-Path: X-Original-To: dmarc@ietfa.amsl.com Delivered-To: dmarc@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0CE21120180 for ; Sun, 31 Mar 2019 03:18:21 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.002 X-Spam-Level: X-Spam-Status: No, score=-2.002 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=ncsc.gov.uk Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 7NMSUdXzN6di for ; Sun, 31 Mar 2019 03:18:19 -0700 (PDT) Received: from GBR01-LO2-obe.outbound.protection.outlook.com (mail-eopbgr100120.outbound.protection.outlook.com [40.107.10.120]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 4321C12017F for ; Sun, 31 Mar 2019 03:18:19 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ncsc.gov.uk; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=K7k5A68ZKsjL/Knbqd2bNu69yx3RAeIIMsBJHbPuQFE=; b=ZgK0fRKawgZmnWIvHwGOH9mUGvCsMGzeYORS178xumNvcA205RFeup0xuxzQlHpWdH1eK5hPnHZUxvLm69nWspvZXpZ3GZm6XGrJ882u7FWdHNPtfvm7QDoiPQ3dg4mJlNxZvjIVY8Kyea+6x4Bst9GGOjcNq+41BnpC4WQviMU= Received: from LO2P123MB2285.GBRP123.PROD.OUTLOOK.COM (20.176.157.151) by LO2P123MB1694.GBRP123.PROD.OUTLOOK.COM (20.176.154.81) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.1750.17; Sun, 31 Mar 2019 10:18:16 +0000 Received: from LO2P123MB2285.GBRP123.PROD.OUTLOOK.COM ([fe80::41ac:f60c:6d07:7769]) by LO2P123MB2285.GBRP123.PROD.OUTLOOK.COM ([fe80::41ac:f60c:6d07:7769%6]) with mapi id 15.20.1750.017; Sun, 31 Mar 2019 10:18:16 +0000 From: Ian Levy To: Scott Kitterman , IETF DMARC WG Thread-Topic: [dmarc-ietf] Working group next steps Thread-Index: AQHU4/UzfZiqOr8RXUGmzJ8BTa45jqYi2lBAgAAEtYCAAq6HsA== Date: Sun, 31 Mar 2019 10:18:16 +0000 Message-ID: References: <3802074.4RGYGbXOYh@kitterma-e6430> In-Reply-To: <3802074.4RGYGbXOYh@kitterma-e6430> Accept-Language: en-GB, en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=ian.levy@ncsc.gov.uk; x-originating-ip: [51.140.78.31] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: 9b9da102-1469-437b-dc4d-08d6b5c230b6 x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(8989299)(4534185)(7168020)(4627221)(201703031133081)(201702281549075)(8990200)(5600127)(711020)(4605104)(2017052603328)(7153060)(7193020); SRVR:LO2P123MB1694; x-ms-traffictypediagnostic: LO2P123MB1694: x-microsoft-antispam-prvs: x-forefront-prvs: 0993689CD1 x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(136003)(366004)(396003)(39830400003)(346002)(376002)(189003)(199004)(486006)(9686003)(81156014)(81166006)(52536014)(186003)(8936002)(102836004)(55236004)(6506007)(71190400001)(8676002)(3846002)(6116002)(66066001)(44832011)(71200400001)(476003)(14454004)(99286004)(229853002)(68736007)(86362001)(26005)(6436002)(25786009)(11346002)(446003)(5660300002)(2906002)(6246003)(55016002)(478600001)(33656002)(4744005)(7736002)(305945005)(74482002)(76176011)(97736004)(7696005)(105586002)(110136005)(75922002)(316002)(74316002)(256004)(53936002)(14444005)(106356001); DIR:OUT; SFP:1102; SCL:1; SRVR:LO2P123MB1694; H:LO2P123MB2285.GBRP123.PROD.OUTLOOK.COM; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; MX:1; A:1; received-spf: None (protection.outlook.com: ncsc.gov.uk does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: eyd4QuSIKpqQKOGn57VY/a/tohU5DA+w0yz+bxCMXChJBYX9ms71heJtZ5BhwN/FkefUJXLmF8sWdK509aikSTCIdcME0XuwSf2iAg5ZUDZUePeIA0pWlwnJo8C0eK9Ejf6cXaMQnBnLarfd9a+h3lys01jbBdEGHukJYizMWSL43x4fGDTA9QHD5siMAxxnmcI0aEE5o+yQ1rbAITopUvLqy/w7l0z6qoFuZc8Y8A66dqVEnpWqd7mvZv0tcu0lxTlyHD5vjaijj0OvDHe3nY2aWLWUt3Vy+VtJRUG44gIXE9DG1NEAzt2MIV8GYGSM/M0JYlM4PjdePF+VG1HOEW92LwbQGOGANVUrc+Ttoy9pZvayoj2ipPwipyZg9HAYMxkflaSl2ufvCCCvKq1au+4VL4VCQ5/yvVuLm3gVJwo= Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-OriginatorOrg: ncsc.gov.uk X-MS-Exchange-CrossTenant-Network-Message-Id: 9b9da102-1469-437b-dc4d-08d6b5c230b6 X-MS-Exchange-CrossTenant-originalarrivaltime: 31 Mar 2019 10:18:16.3295 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 14aa5744-ece1-474e-a2d7-34f46dda64a1 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-Transport-CrossTenantHeadersStamped: LO2P123MB1694 Archived-At: Subject: Re: [dmarc-ietf] Working group next steps X-BeenThere: dmarc@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Domain-based Message Authentication, Reporting, and Compliance \(DMARC\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 31 Mar 2019 10:18:21 -0000 Pj4gSeKAmWxsIGFsc28gb2ZmZXIgZ292LnVrIGFzIGFuIGV4cGVyaW1lbnRhbCBncm91bmQgKHdp dGhpbiByZWFzb24hKS4NCg0KPiBFeGNlbGxlbnQuICBJJ3ZlIGxpc3RlZCBpdCBpbiB0aGUgZXhw ZXJpbWVudGFsIHJlZ2lzdHJ5IGF0IHBzZGRtYXJjLm9yZy4NCj4gU2luY2UgeW91IGFscmVhZHkg aGFkIGEgbGl2ZSBETUFSQyByZWNvcmQgZm9yIHRoYXQgZG9tYWluLCBwZW9wbGUgY2FuIGV4cGVy aW1lbnQgd2l0aCB0aGlzIG5vdy4NCg0KSSBndWVzcyBhdCBzb21lIHBvaW50IHdlJ2xsIGhhdmUg dG8gc3RvcCBnZW5lcmF0aW5nIFNQRiBhbmQgRE1BUkMgcmVjb3JkcyBmb3IgdGhlIG5vbi1leGlz dGVudCBzdWJkb21haW5zIG9mIGdvdi51ayBzbyB3ZSBjYW4gdGVzdCB0aGUgbmV3IHN0dWZmIHBy b3Blcmx5LiBXaGVuIHdlJ3JlIGF0IHRoYXQgcG9pbnQsIGxldCBtZSBrbm93Lg0KDQpUYS4NCg0K SS4NCg0KLS0NCkRyIElhbiBMZXZ5DQpUZWNobmljYWwgRGlyZWN0b3INCk5hdGlvbmFsIEN5YmVy IFNlY3VyaXR5IENlbnRyZQ0KaWFuQG5jc2MuZ292LnVrDQoNClN0YWZmIE9mZmljZXIgOiBLYXRl IEF0a2lucywga2F0ZS5hQG5jc2MuZ292LnVrDQoNCihJIHdvcmsgc3R1cGlkIGhvdXJzIGFuZCB3 ZWlyZCB0aW1lcyDigJMgdGhhdCBkb2VzbuKAmXQgbWVhbiB5b3UgaGF2ZSB0by4gSWYgdGhpcyBh cnJpdmVzIG91dHNpZGUgeW91ciBub3JtYWwgd29ya2luZyBob3VycywgZG9u4oCZdCBmZWVsIGNv bXBlbGxlZCB0byByZXNwb25kIGltbWVkaWF0ZWx5ISkNCg0KDQpUaGlzIGluZm9ybWF0aW9uIGlz IGV4ZW1wdCB1bmRlciB0aGUgRnJlZWRvbSBvZiBJbmZvcm1hdGlvbiBBY3QgMjAwMCAoRk9JQSkg YW5kIG1heSBiZSBleGVtcHQgdW5kZXIgb3RoZXIgVUsgaW5mb3JtYXRpb24gbGVnaXNsYXRpb24u IFJlZmVyIGFueSBGT0lBIHF1ZXJpZXMgdG8gbmNzY2luZm9sZWdAbmNzYy5nb3YudWsNCg== From btv1==99374fdb37c==fosterd@bayviewphysicians.com Sun Mar 31 05:38:59 2019 Return-Path: X-Original-To: dmarc@ietfa.amsl.com Delivered-To: dmarc@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id BF84612012B for ; Sun, 31 Mar 2019 05:38:59 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2 X-Spam-Level: X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=bayviewphysicians.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id hNjw6M07lYix for ; Sun, 31 Mar 2019 05:38:57 -0700 (PDT) Received: from mail.bayviewphysicians.com (mail.bayviewphysicians.com [216.54.111.133]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 8A65212013D for ; Sun, 31 Mar 2019 05:38:57 -0700 (PDT) X-ASG-Debug-ID: 1554035933-0990574bec209bc0001-K2EkT1 Received: from webmail.bayviewphysicians.com (smartermail4.bayviewphysicians.com [192.168.1.49]) by mail.bayviewphysicians.com with ESMTP id NaDMtjbHvEKCVoj2 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-SHA384 bits=256 verify=NO); Sun, 31 Mar 2019 08:38:53 -0400 (EDT) X-Barracuda-Envelope-From: fosterd@bayviewphysicians.com X-Barracuda-RBL-Trusted-Forwarder: 192.168.1.49 X-ASG-Whitelist: Client X-SmarterMail-Authenticated-As: fosterd@bayviewphysicians.com DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=bayviewphysicians.com; s=s1025; h= content-type:mime-version:message-id:reply-to:date:subject:to:from; bh=Dmfytwzg+1wKuRrX8KeoLqzBo+odZjcEJ3SPrKF96I0=; b=E8hb2slT/UYk5V+THjhvrllhtE023YfXD2NUVwZEf1eOh1bFVOoAqbq33miFLeMfW cEWxKGK3Jqqg/MKJUuz+SbU4sJryAz2aN7KofhqEkRORYqpfLxwamGbGd7y6JL0lk JVRxc1fPevsPhBy6a7AmmklWgHxbbs1Li2BnD3XWc= Received: by webmail.bayviewphysicians.com via HTTP; Sun, 31 Mar 2019 08:38:44 -0400 From: "Douglas E. Foster" To: "Scott Kitterman" , "IETF DMARC WG" , "Ian Levy" Date: Sun, 31 Mar 2019 08:38:44 -0400 X-ASG-Orig-Subj: Re: [dmarc-ietf] Working group next steps Reply-To: fosterd@bayviewphysicians.com Message-ID: <641c4907897e4a81b12847a29bfcd3b8@bayviewphysicians.com> MIME-Version: 1.0 Content-Type: multipart/alternative; boundary=178dca5f19e449a98c262f972a93f11c X-Originating-IP: [192.168.1.239] In-Reply-To: References: <3802074.4RGYGbXOYh@kitterma-e6430> X-Exim-Id: 641c4907897e4a81b12847a29bfcd3b8 X-Barracuda-Connect: smartermail4.bayviewphysicians.com[192.168.1.49] X-Barracuda-Start-Time: 1554035933 X-Barracuda-Encrypted: ECDHE-RSA-AES256-SHA384 X-Barracuda-URL: https://mail.bayviewphysicians.com:443/cgi-mod/mark.cgi X-Virus-Scanned: by bsmtpd at bayviewphysicians.com X-Barracuda-Scan-Msg-Size: 4506 X-Barracuda-BRTS-Status: 1 Archived-At: Subject: Re: [dmarc-ietf] Working group next steps X-BeenThere: dmarc@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Domain-based Message Authentication, Reporting, and Compliance \(DMARC\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 31 Mar 2019 18:30:56 -0000 This is a multipart message in MIME format. --178dca5f19e449a98c262f972a93f11c Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Certainly not. You cannot drop existing defenses until the new standard is 100% deployed = on the Internet, which means probably never. Your experimental implement= ation will need to prioritize the new test over the SPF test, to prove that= it is working and to show that it is good at intercepting any subdomains t= hat have been newly imagined by the attackers To speed up the deployment process for existing or new standards, IETF wou= ld meed to embrace the idea of defining required features of a spam filter. Doug Fosterd ---------------------------------------- From: "Ian Levy" Sent: Sunday, March 31, 2019 6:18 AM To: "Scott Kitterman" , "IETF DMARC WG" Subject: Re: [dmarc-ietf] Working group next steps >> I'll also offer gov.uk as an experimental ground (within reason!). > Excellent. I've listed it in the experimental registry at psddmarc.org. > Since you already had a live DMARC record for that domain, people can exp= eriment with this now. I guess at some point we'll have to stop generating SPF and DMARC records f= or the non-existent subdomains of gov.uk so we can test the new stuff prope= rly. When we're at that point, let me know. Ta. I. -- Dr Ian Levy Technical Director National Cyber Security Centre ian@ncsc.gov.uk Staff Officer : Kate Atkins, kate.a@ncsc.gov.uk (I work stupid hours and weird times - that doesn't mean you have to. If th= is arrives outside your normal working hours, don't feel compelled to respo= nd immediately!) This information is exempt under the Freedom of Information Act 2000 (FOIA)= and may be exempt under other UK information legislation. Refer any FOIA q= ueries to ncscinfoleg@ncsc.gov.uk _______________________________________________ dmarc mailing list dmarc@ietf.org https://www.ietf.org/mailman/listinfo/dmarc --178dca5f19e449a98c262f972a93f11c Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable =
Certainly not.   
 
You cannot drop existing defenses until the new standard is 100% deplo= yed on the Internet, which means probably never.    Your experime= ntal implementation will need to prioritize the new test over the SPF test,= to prove that it is working and to show that it is good at intercepting an= y subdomains that have been newly imagined by the attackers
 
To speed up the deployment process for existing or new standards, IETF= would meed to embrace the idea of defining required features of a spa= m filter.
 
Doug Fosterd
 
From: "Ian Levy" <ian.levy=3D40ncsc.gov.uk@dmarc.ietf.= org>
Sent: Sunday, March 31, 2019 6:18 AM
To: "Scott Kitterman" <sklist@kitterman.com>, "= IETF DMARC WG" <dmarc@ietf.org>
Subject: Re: [dmarc-ietf] Working group next steps
 
>> I’ll also offer gov.uk as an experimental ground (within rea= son!).

> Excellent. I've listed it in the experimental registry at psddmarc.org= .
> Since you already had a live DMARC record for that domain, people can = experiment with this now.

I guess at some point we'll have to stop generating SPF and DMARC records f= or the non-existent subdomains of gov.uk so we can test the new stuff prope= rly. When we're at that point, let me know.

Ta.

I.

--
Dr Ian Levy
Technical Director
National Cyber Security Centre
ian@ncsc.gov.uk

Staff Officer : Kate Atkins, kate.a@ncsc.gov.uk

(I work stupid hours and weird times – that doesn’t mean you ha= ve to. If this arrives outside your normal working hours, don’t feel = compelled to respond immediately!)


This information is exempt under the Freedom of Information Act 2000 (FOIA)= and may be exempt under other UK information legislation. Refer any FOIA q= ueries to ncscinfoleg@ncsc.gov.uk
_______________________________________________
dmarc mailing list
dmarc@ietf.org
https://www.ietf.org/mailman/listinfo/dmarc
 
 --178dca5f19e449a98c262f972a93f11c-- From nobody Sun Mar 31 11:39:41 2019 Return-Path: X-Original-To: dmarc@ietfa.amsl.com Delivered-To: dmarc@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6FE53120096 for ; Sun, 31 Mar 2019 11:39:39 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.999 X-Spam-Level: X-Spam-Status: No, score=-1.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id xmeFoUPdweGf for ; Sun, 31 Mar 2019 11:39:37 -0700 (PDT) Received: from mail-wr1-x429.google.com (mail-wr1-x429.google.com [IPv6:2a00:1450:4864:20::429]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 6295E120048 for ; Sun, 31 Mar 2019 11:39:37 -0700 (PDT) Received: by mail-wr1-x429.google.com with SMTP id y13so9017429wrd.3 for ; Sun, 31 Mar 2019 11:39:37 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=Q4XnZVOxceE6JZrmYiQbmL2jwSFD7IzHWl/v8Qs2osI=; b=S11wjsq7qNUtFdCNxk8bQ45A/nq1QXrKJJOdd2jQEHcGVCf2/2G3G8dIR5E49aCbDX cr3cmPU26bqWwFTbtuyHjkDq5jnR965zFZjPq7Og0LGnaaS9olHyJ16q5LymLpNuphpR vpSkoUyzTb3eduyOjtZs5Ndf1glBRSr0qM8aX/DjnM2f8FJ6ZDhRWu+21yxWfH0uJ7FO 4Zr4aEED249aRJ4kKDD+kCPfrVBzsbeRRl4taQWOZqZWT2nsJb9jWrCkmGMzjOBLS340 p5uleovWvN0un6gGvzWz3nJ7UFV3NCNDhwScJCmgEnjYbdFMyT3tcCy4EtgxvOmPNO68 pNEg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=Q4XnZVOxceE6JZrmYiQbmL2jwSFD7IzHWl/v8Qs2osI=; b=eWJbbfDvI58TuzG4+cZQ5K0fiGaaXSyS+0SzWD70z0+aWcv0CBwG8TDPAgimYdJePT YxMJfWK9Pi7BF9SAgKC1hAwS99iFCZS/1BKrkr4ufjJtXFIjzJhfxJMP6cgIxP4FRiBu 3PfqiW6wnFN6J8qpQcc/AJABcz21+FMO9hKfxDn00CBx8Ceb7PyvEfPGTeQK+mQS8B1V gLAnt9dkVY6bXp/aBOxZZKfp5+75Y6jMB6El3swHZj8fdXIl+Vvk9POU6thksa0IuAoq ERiKOuuO+4C9ZRtbfUJRu7qgt+C4JhGhpLZiuSmf/rNyNWDQ5lXjl0MUDkWpT6mfrtEX nA0g== X-Gm-Message-State: APjAAAUYOX/LsYyCn+v6dRGZW1zfjxLCdDzc25XQaVWcw1V8G2YZ65rF oLQPyF1gbNXUn8udLupO8vDr837nY/BWVSYhvsGgFw== X-Google-Smtp-Source: APXvYqw61KPCGfZW3ZWQhe0JnI8/rqx1GVjGL4jXNyWyqlOGJFrLEWeFw2SqzPhi3a0Be2fiXtWGHWe9JUOFneQ6wNg= X-Received: by 2002:adf:ee91:: with SMTP id b17mr38669361wro.234.1554057575840; Sun, 31 Mar 2019 11:39:35 -0700 (PDT) MIME-Version: 1.0 References: <3802074.4RGYGbXOYh@kitterma-e6430> <641c4907897e4a81b12847a29bfcd3b8@bayviewphysicians.com> In-Reply-To: <641c4907897e4a81b12847a29bfcd3b8@bayviewphysicians.com> From: Dotzero Date: Sun, 31 Mar 2019 14:39:24 -0400 Message-ID: To: fosterd@bayviewphysicians.com Cc: Scott Kitterman , IETF DMARC WG , Ian Levy Content-Type: multipart/alternative; boundary="000000000000c4bf040585683947" Archived-At: Subject: Re: [dmarc-ietf] Working group next steps X-BeenThere: dmarc@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Domain-based Message Authentication, Reporting, and Compliance \(DMARC\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 31 Mar 2019 18:39:39 -0000 --000000000000c4bf040585683947 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Douglas, Can you show us a single email authentication standard that is 100% deployed on the Internet? There isn't anything that comes close to that achievement. Even things like DNS are not 100%. I know hosts that are only reachable by IP address. Michael Hammer On Sun, Mar 31, 2019 at 2:31 PM Douglas E. Foster < fosterd@bayviewphysicians.com> wrote: > Certainly not. > > You cannot drop existing defenses until the new standard is 100% deployed > on the Internet, which means probably never. Your experimental > implementation will need to prioritize the new test over the SPF test, to > prove that it is working and to show that it is good at intercepting > any subdomains that have been newly imagined by the attackers > > To speed up the deployment process for existing or new standards, IETF > would meed to embrace the idea of defining required features of a spam > filter. > > Doug Fosterd > > ------------------------------ > *From*: "Ian Levy" > *Sent*: Sunday, March 31, 2019 6:18 AM > *To*: "Scott Kitterman" , "IETF DMARC WG" < > dmarc@ietf.org> > *Subject*: Re: [dmarc-ietf] Working group next steps > > >> I=E2=80=99ll also offer gov.uk as an experimental ground (within reaso= n!). > > > Excellent. I've listed it in the experimental registry at psddmarc.org.= . > > Since you already had a live DMARC record for that domain, people can > experiment with this now. > > I guess at some point we'll have to stop generating SPF and DMARC records > for the non-existent subdomains of gov.uk so we can test the new stuff > properly. When we're at that point, let me know. > > Ta. > > I. > > -- > Dr Ian Levy > Technical Director > National Cyber Security Centre > ian@ncsc.gov.uk > > Staff Officer : Kate Atkins, kate.a@ncsc.gov.uk > > (I work stupid hours and weird times =E2=80=93 that doesn=E2=80=99t mean = you have to. If > this arrives outside your normal working hours, don=E2=80=99t feel compel= led to > respond immediately!) > > > This information is exempt under the Freedom of Information Act 2000 > (FOIA) and may be exempt under other UK information legislation. Refer an= y > FOIA queries to ncscinfoleg@ncsc.gov.uk > _______________________________________________ > dmarc mailing list > dmarc@ietf.org > https://www.ietf.org/mailman/listinfo/dmarc > > _______________________________________________ > dmarc mailing list > dmarc@ietf.org > https://www.ietf.org/mailman/listinfo/dmarc > --000000000000c4bf040585683947 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Douglas,

Can you show us a single email= authentication standard that is 100% deployed on the Internet? There isn&#= 39;t anything that comes close to that achievement. Even things like DNS ar= e not 100%. I know hosts that are only reachable by IP address.
<= br>
Michael Hammer

On Sun, Mar 31, 2019 at 2:31 PM Douglas E= . Foster <fosterd@bayvi= ewphysicians.com> wrote:
Certainly not.=C2=A0 =C2=A0
=C2=A0
You cannot drop existing defenses until the new standard is 100% deplo= yed on the Internet, which means probably never.=C2=A0 =C2=A0 Your experime= ntal implementation will need to prioritize the new test over the SPF test,= to prove that it is working and to show that it is good at intercepting an= y=C2=A0subdomains that have been newly imagined by the attackers
=C2=A0
To speed up the deployment process for existing or new standards, IETF= would meed to embrace the idea of defining=C2=A0required features of a spa= m filter.
=C2=A0
Doug Fosterd
=C2=A0
= From: "Ian Levy" <ian.levy=3D40ncsc.gov.uk@dmarc.ietf.org> Sent: Sunday, March 31, 2019 6:18 AM
To: "Scott Kitterman" <sklist@kitterman.com>, "IETF DMARC WG= " <dmarc@ietf.o= rg>
Subject: Re: [dmarc-ietf] Working group next steps
=C2=A0
>> I=E2=80=99ll also offer gov.uk as an experimental ground (within reason!).

> Excellent. I've listed it in the experimental registry at psddmarc.org..
> Since you already had a live DMARC record for that domain, people can = experiment with this now.

I guess at some point we'll have to stop generating SPF and DMARC recor= ds for the non-existent subdomains of gov.uk so we can test the new stuff properly. When we're at = that point, let me know.

Ta.

I.

--
Dr Ian Levy
Technical Director
National Cyber Security Centre
ian@ncsc.gov.uk
Staff Officer : Kate Atkins, kate.a@ncsc.gov.uk

(I work stupid hours and weird times =E2=80=93 that doesn=E2=80=99t mean yo= u have to. If this arrives outside your normal working hours, don=E2=80=99t= feel compelled to respond immediately!)


This information is exempt under the Freedom of Information Act 2000 (FOIA)= and may be exempt under other UK information legislation. Refer any FOIA q= ueries to ncsc= infoleg@ncsc.gov.uk
_______________________________________________
dmarc mailing list
dmarc@ietf.org
h= ttps://www.ietf.org/mailman/listinfo/dmarc
=C2=A0
 _______________________________________________
dmarc mailing list
dmarc@ietf.org
https://www.ietf.org/mailman/listinfo/dmarc
--000000000000c4bf040585683947-- From nobody Sun Mar 31 12:07:25 2019 Return-Path: X-Original-To: dmarc@ietfa.amsl.com Delivered-To: dmarc@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 958A9120021 for ; Sun, 31 Mar 2019 12:07:23 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.001 X-Spam-Level: X-Spam-Status: No, score=-2.001 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=ncsc.gov.uk Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id LQgO1wLMadPL for ; Sun, 31 Mar 2019 12:07:20 -0700 (PDT) Received: from GBR01-CWL-obe.outbound.protection.outlook.com (mail-eopbgr110124.outbound.protection.outlook.com [40.107.11.124]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 9D926120003 for ; Sun, 31 Mar 2019 12:07:19 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ncsc.gov.uk; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=+74NERd5Bl/8YrDCqy7t+3M/NUKBqfW19CJ3IK/Wr7w=; b=KnLuqa1BeezrNz12HQ0ZcvLqioIeK4CQvP8lfgt1/zJIyTqJ8HLgXyOz0YToslpLuHnBNGClDUpJFppUOxdvIPIQaju91sqOLBhFESdsyV64hucR26SDV7Pns1Iyt09XLlLyDiGwarn84sFz2B6JV35Jk7oLweCINP0zou+gSTM= Received: from LO2P123MB2285.GBRP123.PROD.OUTLOOK.COM (20.176.157.151) by LO2P123MB1824.GBRP123.PROD.OUTLOOK.COM (20.176.157.20) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.1750.17; Sun, 31 Mar 2019 19:07:16 +0000 Received: from LO2P123MB2285.GBRP123.PROD.OUTLOOK.COM ([fe80::41ac:f60c:6d07:7769]) by LO2P123MB2285.GBRP123.PROD.OUTLOOK.COM ([fe80::41ac:f60c:6d07:7769%6]) with mapi id 15.20.1750.017; Sun, 31 Mar 2019 19:07:16 +0000 From: Ian Levy To: "fosterd@bayviewphysicians.com" , Scott Kitterman , IETF DMARC WG , Ian Levy Thread-Topic: [dmarc-ietf] Working group next steps Thread-Index: AQHU4/UzfZiqOr8RXUGmzJ8BTa45jqYi2lBAgAAEtYCAAq6HsIAAJ+QAgABqa6Q= Date: Sun, 31 Mar 2019 19:07:16 +0000 Message-ID: References: <3802074.4RGYGbXOYh@kitterma-e6430> , <641c4907897e4a81b12847a29bfcd3b8@bayviewphysicians.com> In-Reply-To: <641c4907897e4a81b12847a29bfcd3b8@bayviewphysicians.com> Accept-Language: en-GB, en-US Content-Language: en-GB X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=ian.levy@ncsc.gov.uk; x-originating-ip: [51.140.114.144] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: d17c74e4-8406-4ede-e60f-08d6b60c1728 x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(8989299)(4534185)(7168020)(4627221)(201703031133081)(201702281549075)(8990200)(5600127)(711020)(4605104)(2017052603328)(7153060)(7193020); SRVR:LO2P123MB1824; x-ms-traffictypediagnostic: LO2P123MB1824: x-microsoft-antispam-prvs: x-forefront-prvs: 0993689CD1 x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(366004)(346002)(136003)(39840400004)(376002)(396003)(189003)(199004)(55016002)(476003)(81166006)(25786009)(5660300002)(106356001)(14454004)(97736004)(93886005)(44832011)(52536014)(8936002)(186003)(14444005)(74316002)(6116002)(316002)(110136005)(11346002)(105586002)(2501003)(86362001)(81156014)(75922002)(9686003)(6436002)(229853002)(53546011)(478600001)(66066001)(256004)(3846002)(26005)(99286004)(446003)(68736007)(74482002)(7736002)(6506007)(966005)(6306002)(54896002)(6246003)(66574012)(53936002)(102836004)(33656002)(486006)(8676002)(7696005)(76176011)(55236004)(2906002)(71190400001)(71200400001); DIR:OUT; SFP:1102; SCL:1; SRVR:LO2P123MB1824; H:LO2P123MB2285.GBRP123.PROD.OUTLOOK.COM; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; MX:1; A:1; received-spf: None (protection.outlook.com: ncsc.gov.uk does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: 4+eeWrDu/Xx5EwVrkMMdzGELFf8Bdt/T7kdQ5tOs1YFjnislmMqZ61zpOH3l+OchwqWG3C/Si3y6O+ynfK2B18oN5mRqMs43ZBmXMv8H/9e3fkfQfgIoQogTm3Wxmr+Ir962EjOwD2mDzT4L1yqdAXqPtUozyDNatPayNjc3cIlJPZEfY45Bni2ARVxr0vP2NgDYEvHwDYCFExdW8HaEcGqCyg7manBgu7hv3mIgC++RHMdqyvLFEyZPJ3ek9QDmQ1xaYxS70sXUCo4b/enpakyT7ZEstdzyAopkyeyVVM77f+5ZB6miNjXh1Nn2X/4TAoEMR9PklHvottvTpaCLfE1qs5Y9EfJ9N4YyQ4LM8fX0YWz9YDYm6kYaUPxYWGTx9qWxVKG10398pR1WiLLVEQWBAmlxIvHd4B4hVVuKti0= Content-Type: multipart/alternative; boundary="_000_LO2P123MB22851ED31D070E83A9CE2762C9540LO2P123MB2285GBRP_" MIME-Version: 1.0 X-OriginatorOrg: ncsc.gov.uk X-MS-Exchange-CrossTenant-Network-Message-Id: d17c74e4-8406-4ede-e60f-08d6b60c1728 X-MS-Exchange-CrossTenant-originalarrivaltime: 31 Mar 2019 19:07:16.3142 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 14aa5744-ece1-474e-a2d7-34f46dda64a1 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-Transport-CrossTenantHeadersStamped: LO2P123MB1824 Archived-At: Subject: Re: [dmarc-ietf] Working group next steps X-BeenThere: dmarc@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Domain-based Message Authentication, Reporting, and Compliance \(DMARC\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 31 Mar 2019 19:07:24 -0000 --_000_LO2P123MB22851ED31D070E83A9CE2762C9540LO2P123MB2285GBRP_ Content-Type: text/plain; charset="Windows-1252" Content-Transfer-Encoding: quoted-printable The existing defences aren=92t 100% even before the evil kludge we=92ve put= up for non existent subdomains, which certainly is not working everywhere.= The PSD draft, when implemented, will help scale existing defences to make= evolution of criminal behaviour harder and do it in a standardised way so = that it=92s more likely to be consistently implemented. That=92s worth us = collectively doing some work and me taking some risk to help early testing. Nothing is 100% in security. Except possibly the existence of a preponderan= ce of marketing hype :-). Ta. I. =97 Dr Ian Levy Technical Director National Cyber Security Centre ian@ncsc.gov.uk (I work stupid hours and weird times =96 that doesn=92t mean you have to. I= f this arrives outside your normal working hours, don=92t feel compelled to= respond immediately!) ________________________________ From: dmarc on behalf of Douglas E. Foster Sent: Sunday, March 31, 2019 7:31 pm To: Scott Kitterman; IETF DMARC WG; Ian Levy Subject: Re: [dmarc-ietf] Working group next steps Certainly not. You cannot drop existing defenses until the new standard is 100% deployed o= n the Internet, which means probably never. Your experimental implementa= tion will need to prioritize the new test over the SPF test, to prove that = it is working and to show that it is good at intercepting any subdomains th= at have been newly imagined by the attackers To speed up the deployment process for existing or new standards, IETF woul= d meed to embrace the idea of defining required features of a spam filter. Doug Fosterd ________________________________ From: "Ian Levy" Sent: Sunday, March 31, 2019 6:18 AM To: "Scott Kitterman" , "IETF DMARC WG" Subject: Re: [dmarc-ietf] Working group next steps >> I=92ll also offer gov.uk as an experimental ground (within reason!). > Excellent. I've listed it in the experimental registry at psddmarc.org.. > Since you already had a live DMARC record for that domain, people can exp= eriment with this now. I guess at some point we'll have to stop generating SPF and DMARC records f= or the non-existent subdomains of gov.uk so we can test the new stuff prope= rly. When we're at that point, let me know. Ta. I. -- Dr Ian Levy Technical Director National Cyber Security Centre ian@ncsc.gov.uk Staff Officer : Kate Atkins, kate.a@ncsc.gov.uk (I work stupid hours and weird times =96 that doesn=92t mean you have to. I= f this arrives outside your normal working hours, don=92t feel compelled to= respond immediately!) This information is exempt under the Freedom of Information Act 2000 (FOIA)= and may be exempt under other UK information legislation. Refer any FOIA q= ueries to ncscinfoleg@ncsc.gov.uk _______________________________________________ dmarc mailing list dmarc@ietf.org https://www.ietf.org/mailman/listinfo/dmarc This information is exempt under the Freedom of Information Act 2000 (FOIA)= and may be exempt under other UK information legislation. Refer any FOIA q= ueries to ncscinfoleg@ncsc.gov.uk --_000_LO2P123MB22851ED31D070E83A9CE2762C9540LO2P123MB2285GBRP_ Content-Type: text/html; charset="Windows-1252" Content-Transfer-Encoding: quoted-printable
The existing defences aren=92t 100% even bef= ore the evil kludge we=92ve put up for non existent subdomains, which certa= inly is not working everywhere. The PSD draft, when implemented, will help = scale existing defences to make evolution of criminal behaviour harder and do it in a standardised way so that it=92= s more likely to be consistently implemented.  That=92s worth us colle= ctively doing some work and me taking some risk to help early testing. = ;

Nothing is 100% in security. Except possibly= the existence of a preponderance of marketing hype :-). 

Ta. 

I. 

=97
Dr Ian Levy
Technical Director
National Cyber Security Centre
ian@ncsc.gov.uk

(I work stupid hours and weird times =96 tha= t doesn=92t mean you have to. If this arrives outside your normal working h= ours, don=92t feel compelled to respond immediately!)
From: dma= rc <dmarc-bounces@ietf.org> on behalf of Douglas E. Foster <foster= d@bayviewphysicians.com>
Sent: Sunday, March 31, 2019 7:31 pm
To: Scott Kitterman; IETF DMARC WG; Ian Levy
Subject: Re: [dmarc-ietf] Working group next steps
 
Certainly not.   
 
You cannot drop existing defenses until the new standard is 100% deplo= yed on the Internet, which means probably never.    Your experime= ntal implementation will need to prioritize the new test over the SPF test,= to prove that it is working and to show that it is good at intercepting any subdomains that have been newly imagin= ed by the attackers
 
To speed up the deployment process for existing or new standards, IETF= would meed to embrace the idea of defining required features of a spa= m filter.
 
Doug Fosterd
 
From: "Ian Levy" <ian.levy=3D40ncsc.gov.uk@dmarc.ietf.= org>
Sent: Sunday, March 31, 2019 6:18 AM
To: "Scott Kitterman" <sklist@kitterman.com>, "= IETF DMARC WG" <dmarc@ietf.org>
Subject: Re: [dmarc-ietf] Working group next steps
 
>> I=92ll also offer gov.uk as an experimental ground (within reason!= ).

> Excellent. I've listed it in the experimental registry at psddmarc.org= ..
> Since you already had a live DMARC record for that domain, people can = experiment with this now.

I guess at some point we'll have to stop generating SPF and DMARC records f= or the non-existent subdomains of gov.uk so we can test the new stuff prope= rly. When we're at that point, let me know.

Ta.

I.

--
Dr Ian Levy
Technical Director
National Cyber Security Centre
ian@ncsc.gov.uk

Staff Officer : Kate Atkins, kate.a@ncsc.gov.uk

(I work stupid hours and weird times =96 that doesn=92t mean you have to. I= f this arrives outside your normal working hours, don=92t feel compelled to= respond immediately!)


This information is exempt under the Freedom of Information Act 2000 (FOIA)= and may be exempt under other UK information legislation. Refer any FOIA q= ueries to ncscinfoleg@ncsc.gov.uk
_______________________________________________
dmarc mailing list
dmarc@ietf.org
https://www.ietf.org/mailman/listinfo/dmarc
 
This information is exempt under the Freedom of Information Act 2000 (FOIA)= and may be exempt under other UK information legislation. Refer any FOIA q= ueries to ncscinfoleg@ncsc.gov.uk --_000_LO2P123MB22851ED31D070E83A9CE2762C9540LO2P123MB2285GBRP_-- From nobody Sun Mar 31 14:07:24 2019 Return-Path: X-Original-To: dmarc@ietfa.amsl.com Delivered-To: dmarc@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 382D11200D8 for ; Sun, 31 Mar 2019 14:07:22 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2 X-Spam-Level: X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=bayviewphysicians.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id SV8pHl-bam5e for ; Sun, 31 Mar 2019 14:07:19 -0700 (PDT) Received: from mail.bayviewphysicians.com (mail.bayviewphysicians.com [216.54.111.133]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 862F9120003 for ; Sun, 31 Mar 2019 14:07:19 -0700 (PDT) X-ASG-Debug-ID: 1554066437-0990574bec20f300001-K2EkT1 Received: from webmail.bayviewphysicians.com (smartermail4.bayviewphysicians.com [192.168.1.49]) by mail.bayviewphysicians.com with ESMTP id XsIatxEJeH9i2HN0 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-SHA384 bits=256 verify=NO) for ; Sun, 31 Mar 2019 17:07:17 -0400 (EDT) X-Barracuda-Envelope-From: fosterd@bayviewphysicians.com X-Barracuda-RBL-Trusted-Forwarder: 192.168.1.49 X-ASG-Whitelist: Client X-SmarterMail-Authenticated-As: fosterd@bayviewphysicians.com DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=bayviewphysicians.com; s=s1025; h= content-type:mime-version:message-id:reply-to:date:subject:to:from; bh=HWU11aHZlgdBHckv+l1SEMgIx1w04ZVdXvwl1JT3VHI=; b=BCBmfOui1q7cTARm8E+LWxM6Z0cGCtRUy+6aMgGI9j1cx+gyMq3J3OayX8YpyM6/E iE4lMNCR2IYT8aHz6VzvQhzq3TL7D1e1l+0Ai7xytQhCenGc9mf6QaTekrKfbnMWx G3UEL3U7nh/84mNcTzaXcs3KSxVQE3pW7vLICsBxs= Received: by webmail.bayviewphysicians.com via HTTP; Sun, 31 Mar 2019 17:07:09 -0400 From: "Douglas E. Foster" To: Date: Sun, 31 Mar 2019 17:07:09 -0400 X-ASG-Orig-Subj: [dmarc-ietf] Rolling out the experiment Reply-To: fosterd@bayviewphysicians.com Message-ID: MIME-Version: 1.0 Content-Type: multipart/alternative; boundary=16d054cb8f684ecfb20d8c769c579647 X-Originating-IP: [192.168.1.239] X-Exim-Id: e1098e14b0b54c79b9f6191eb4afa2fd X-Barracuda-Connect: smartermail4.bayviewphysicians.com[192.168.1.49] X-Barracuda-Start-Time: 1554066437 X-Barracuda-Encrypted: ECDHE-RSA-AES256-SHA384 X-Barracuda-URL: https://mail.bayviewphysicians.com:443/cgi-mod/mark.cgi X-Virus-Scanned: by bsmtpd at bayviewphysicians.com X-Barracuda-Scan-Msg-Size: 19057 X-Barracuda-BRTS-Status: 1 Archived-At: Subject: [dmarc-ietf] Rolling out the experiment X-BeenThere: dmarc@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Domain-based Message Authentication, Reporting, and Compliance \(DMARC\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 31 Mar 2019 21:07:22 -0000 This is a multipart message in MIME format. --16d054cb8f684ecfb20d8c769c579647 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Based on my reading of your draft, the testing process for non-existent dom= ains is as follows: Any DMARC policies for non-existent domains must be removed, so that the= recipient system can look upward to the PSD DMARC. SPF and ASDP polices c= an still be published for non-existent domains, because a domain is non-exi= stent only when it lacks A, AAAA, and MX records. SPF and ADSP are TXT rec= ords, so they do not affect the evaluation. What I do not understand is ho= w a device determines that a particular domain has no A, AAAA, or MX record= s. Assuming that #2 iis valid, the test can proceed with no loss of curren= t protections. SPF and ADSP policies can be used to block a fraudulent mes= sage from a non-existent domain. The behavior varies by device capability= . A non-DMARC device would stop after blocking the message because o= f SPF or ADSP policy violation. An organization-DMARC device would look= for a DMARC policy and fail, so no feedback would be sent. It would still= block the message based on SPF and DMARC policy violations. A PSD-DMA= RC device could block the message by either of two methods: It detect= s the domain as non-existent, and looks immediately for a PSD-DMARC policy.= It blocks the message based on SPF or DMARC, then looks for feedback in= structions, following the tree upward until it finds a PSD DMARC policy wit= h feedback instructions. SPF is widely deployed, so dropping SPF policies will affect recipients no= t participating in the test. That is why I am alarmed. I do not understand why that should be necessary, but I suppose that the a= nswer hangs on the mechanism for detecting non-existent domains in a manner= compliant with section 2.6 Doug Foster ---------------------------------------- From: "Ian Levy" Sent: Sunday, March 31, 2019 3:07 PM To: "fosterd@bayviewphysicians.com" , "Scott= Kitterman" , "IETF DMARC WG" , "Ian L= evy" Subject: Re: [dmarc-ietf] Working group next steps The existing defences aren't 100% even before the evil kludge we've put = up for non existent subdomains, which certainly is not working everywhere. = The PSD draft, when implemented, will help scale existing defences to make = evolution of criminal behaviour harder and do it in a standardised way so t= hat it's more likely to be consistently implemented. That's worth us colle= ctively doing some work and me taking some risk to help early testing. Nothing is 100% in security. Except possibly the existence of a prepondera= nce of marketing hype :-). Ta. I. - Dr Ian Levy Technical Director National Cyber Security Centre ian@ncsc.gov.uk (I work stupid hours and weird times - that doesn't mean you have to. If t= his arrives outside your normal working hours, don't feel compelled to resp= ond immediately!) ---------------------------------------- From: dmarc on behalf of Douglas E. Foster Sent: Sunday, March 31, 2019 7:31 pm To: Scott Kitterman; IETF DMARC WG; Ian Levy Subject: Re: [dmarc-ietf] Working group next steps Certainly not. You cannot drop existing defenses until the new standard is 100% deployed = on the Internet, which means probably never. Your experimental implement= ation will need to prioritize the new test over the SPF test, to prove that= it is working and to show that it is good at intercepting any subdomains t= hat have been newly imagined by the attackers To speed up the deployment process for existing or new standards, IETF wou= ld meed to embrace the idea of defining required features of a spam filter. Doug Fosterd ---------------------------------------- From: "Ian Levy" Sent: Sunday, March 31, 2019 6:18 AM To: "Scott Kitterman" , "IETF DMARC WG" Subject: Re: [dmarc-ietf] Working group next steps >> I'll also offer gov.uk as an experimental ground (within reason!). > Excellent. I've listed it in the experimental registry at psddmarc.org.. > Since you already had a live DMARC record for that domain, people can exp= eriment with this now. I guess at some point we'll have to stop generating SPF and DMARC records f= or the non-existent subdomains of gov.uk so we can test the new stuff prope= rly. When we're at that point, let me know. Ta. I. -- Dr Ian Levy Technical Director National Cyber Security Centre ian@ncsc.gov.uk Staff Officer : Kate Atkins, kate.a@ncsc.gov.uk (I work stupid hours and weird times - that doesn't mean you have to. If th= is arrives outside your normal working hours, don't feel compelled to respo= nd immediately!) This information is exempt under the Freedom of Information Act 2000 (FOIA)= and may be exempt under other UK information legislation. Refer any FOIA q= ueries to ncscinfoleg@ncsc.gov.uk _______________________________________________ dmarc mailing list dmarc@ietf.org https://www.ietf.org/mailman/listinfo/dmarc This information is exempt under the Freedom of Information Act 2000 (FOIA)= and may be exempt under other UK information legislation. Refer any FOIA q= ueries to ncscinfoleg@ncsc.gov.uk --16d054cb8f684ecfb20d8c769c579647 Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable =
Based on my reading of your draft, the testing process for non-existen= t domains is as follows:
  1. Any DMARC policies for non-existent domains must be removed, so that t= he recipient system can look upward to the PSD DMARC.
  2. SPF and ASDP polices can still be published for non-existent domains, = because a domain is non-existent only when it lacks A, AAAA, and MX re= cords.  SPF and ADSP are TXT records, so they do not affect the evalua= tion.  What I do not understand is how a device determines that a part= icular domain has no A, AAAA, or MX records.
  3. Assuming that #2 iis valid, the test can proceed with no loss of curre= nt protections.  SPF and ADSP policies can be used to block a fra= udulent message from a non-existent domain.   The behavior varies= by device capability.   
    • A non-DMARC device would stop after blocking the message because= of SPF or ADSP policy violation.  
    • An organization-DMARC device would look for a DMARC policy and fail, = so no feedback would be sent.  It would still block the message based = on SPF and DMARC policy violations.   
    • A PSD-DMARC device could block the message by either of two methods:
      • It detects the domain as non-existent, and looks immediately for a P= SD-DMARC policy.
      • It blocks the message based on SPF or DMARC, then looks for feedback= instructions, following the tree upward until it finds a PSD DMARC policy = with feedback instructions.
SPF is widely deployed, so dropping SPF policies will affect reci= pients not participating in the test.    That is why I am alarmed= .
 
I do not understand why that should be necessary, but I suppose that t= he answer hangs on the mechanism for detecting non-existent domains in= a manner compliant with section 2.6 
 
Doug Foster
 
 
 
 
From: "Ian Levy" <ian.levy@ncsc.gov.uk>
Sent: Sunday, March 31, 2019 3:07 PM
To: "fosterd@bayviewphysicians.com" <fosterd@bayviewphy= sicians.com>, "ScottKitterman" <sklist@kitterman.com>, &= quot;IETF DMARC WG" <dmarc@ietf.org>, "Ian Levy" <i= an.levy=3D40ncsc.gov.uk@dmarc.ietf.org>
Subject: Re: [dmarc-ietf] Working group next steps
 
The existing defences aren’t 100% even= before the evil kludge we’ve put up for non existent subdomains, whi= ch certainly is not working everywhere. The PSD draft, when implemented, wi= ll help scale existing defences to make evolution of criminal behaviour har= der and do it in a standardised way so that it’s more likely to be co= nsistently implemented.  That’s worth us collectively doing some= work and me taking some risk to help early testing. 
 
Nothing is 100% in security. Except possibly= the existence of a preponderance of marketing hype :-). 
 
Ta. 
 
I. 
 
—
Dr Ian Levy
Technical Director
National Cyber Security Centre
ian@ncsc.gov.uk
 
(I work stupid hours and weird times –= that doesn’t mean you have to. If this arrives outside your normal w= orking hours, don’t feel compelled to respond immediately!)
From: dma= rc <dmarc-bounces@ietf.org> on behalf of Douglas E. Foster <foster= d@bayviewphysicians.com>
Sent: Sunday, March 31, 2019 7:31 pm
To: Scott Kitterman; IETF DMARC WG; Ian Levy
Subject: Re: [dmarc-ietf] Working group next steps
 
Certainly not.   
 
You cannot drop existing defenses until the new standard is 100% deplo= yed on the Internet, which means probably never.    Your experime= ntal implementation will need to prioritize the new test over the SPF test,= to prove that it is working and to show that it is good at intercepting an= y subdomains that have been newly imagined by the attackers
 
To speed up the deployment process for existing or new standards, IETF= would meed to embrace the idea of defining required features of a spa= m filter.
 
Doug Fosterd
 
From: "Ian Levy" <ian.levy=3D40ncsc.gov.uk@dmarc.ietf.= org>
Sent: Sunday, March 31, 2019 6:18 AM
To: "Scott Kitterman" <sklist@kitterman.com>, "= IETF DMARC WG" <dmarc@ietf.org>
Subject: Re: [dmarc-ietf] Working group next steps
 
= >> I’ll also offer gov.uk as an experimental ground (within re= ason!).

> Excellent. I've listed it in the experimental registry at psddmarc.org= ..
> Since you already had a live DMARC record for that domain, people can = experiment with this now.

I guess at some point we'll have to stop generating SPF and DMARC records f= or the non-existent subdomains of gov.uk so we can test the new stuff prope= rly. When we're at that point, let me know.

Ta.

I.

--
Dr Ian Levy
Technical Director
National Cyber Security Centre
ian@ncsc.gov.uk

Staff Officer : Kate Atkins, kate.a@ncsc.gov.uk

(I work stupid hours and weird times – that doesn’t mean you ha= ve to. If this arrives outside your normal working hours, don’t feel = compelled to respond immediately!)


This information is exempt under the Freedom of Information Act 2000 (FOIA)= and may be exempt under other UK information legislation. Refer any FOIA q= ueries to ncscinfoleg@ncsc.gov.uk
_______________________________________________
dmarc mailing list
dmarc@ietf.org
https://www.ietf.org/mailman/listinfo/dmarc
 
This information is exempt under the Freedom of Information Act 2000 (FOIA)= and may be exempt under other UK information legislation. Refer any FOIA q= ueries to ncscinfoleg@ncsc.gov.uk
--16d054cb8f684ecfb20d8c769c579647--