Subject: [Tools-discuss] DMARC

From: "Eggert, Lars" <[email-masked]>
Date: Tue, 3 Feb 2015 11:04:28 +0000

Begin forwarded message:
> PS. Sending via Gmail because the CFRG mailing list software attempts to forge @yahoo-inc.com <http://yahoo-inc.com/> FROM addresses. And Yahoo sets a DMARC p=reject. Could a list admin please configure the IRTF listserv to not blatantly violate the IETF DMARC standard?

Forwarding from CFRG. IIRC there is nothing that can be done, but forwarded just in case.

Lars

---

From: Daniel Kahn Gillmor <[email-masked]>
Date: Tue, 03 Feb 2015 10:07:29 -0500

On Tue 2015-02-03 06:04:28 -0500, Eggert, Lars wrote:
> Begin forwarded message:
>> PS. Sending via Gmail because the CFRG mailing list software attempts
>> to forge @yahoo-inc.com <http://yahoo-inc.com/> FROM addresses. And
>> Yahoo sets a DMARC p=reject. Could a list admin please configure the
>> IRTF listserv to not blatantly violate the IETF DMARC standard?
>

http://yahoomail.tumblr.com/post/82426900353/yahoo-dmarc-policy-change-what-should-senders

suggests:

>> If you are a mailing list owner, what should you do?
>> 
>> Mailing lists are a special case of sending mail on behalf of
>> individuals. The most common option is to use the mailing list’s
>> address instead of the sender’s on the From: line. This will change
>> the reply behavior. Some mailing lists also choose to act as pure
>> forwarders and resend the mail without breaking DKIM signatures. As
>> of this publication, no common mailing list packages provide
>> straightforward configuration options that produce DMARC
>> compatibility, although Mailman has relevant features starting in
>> 2.1.16. If you are a developer of mailing list software and would
>> like help adding features to allow participants from domains with
>> DMARC p=reject, please contact us at [email-masked].

mailman's "relevant features" don't appear to provide many good
alternatives, even if we're running a newer version:

http://wiki.list.org/DOC/What%20can%20I%20do%20about%20members%20being%20unsubscribed%20by%20bounces%20of%20Yahoo%20user%27s%20posts%20for%20DMARC%20policy%20reasons%3F

But in 2.1.18, there is a dmarc_moderaction_action configuration value:

  http://wiki.list.org/DEV/DMARC

If we're running that version or later, i recommend setting
dmarc_moderaction_action to "Munge From".

         --dkg

---

From: Dave Crocker <[email-masked]>
Date: Tue, 03 Feb 2015 07:33:44 -0800

> Forwarding from CFRG. IIRC there is nothing that can be done, but

What lists like CFRG do is not 'forging', since the mail is indeed from
the purported author.

And DMARC is not (yet) and IETF standard.

The collateral damage that is cited, however, is of course real and
problematic.

Whether IETF lists should hack around the problem is a continuing source
of debate and is controversial enough to warrant IETF-wide rough
consensus, IMO.

d/

ps. Lars, your posting did not indicate who authored the message you
relayed.

-- 
Dave Crocker
Brandenburg InternetWorking
bbiw.net

---

From: "Eggert, Lars" <[email-masked]>
Date: Tue, 3 Feb 2015 15:37:10 +0000

The original mail was from David Leon Gil ([email-masked]; CC'ed).

> On 2015-2-3, at 16:33, Dave Crocker <[email-masked]> wrote:
>

---

From: Dave Crocker <[email-masked]>
Date: Thu, 05 Feb 2015 12:30:39 -0800

On 2/5/2015 12:12 PM, David Leon Gil wrote:
> Perhaps you don't want to call it forgery. But it's still bad.

I'm a bit confused by that claim.

When a mediator changes the From field, so that DMARC succeeds, the
recipient is given /less/ useful information for the MUA to process.

Arguably, at that point, it /is/ spoofing.  The user sees that it is
from the original author, but the associated address is /not/ the author's.

In the broadest terms, the From field hack that folk claim to like is
merely telling spammers how to bypass DMARC...

d/