On Tuesday, March 24, 2015 10:32 PM [GMT+1=CET], Steve Atkins wrote: > Mailing lists are only an issue if the domain owner of the > email addresses of the participants have published a > DMARC p=reject record, despite having actual users who > are legitimate source of email that fails authentication. > > That's a small enough set of domains at the moment (I can think > of about five) that there are several obvious solutions for mailing > lists - a blacklist of DMARC records to treat specially would be > the simplest, though something more nuanced might be better.
That "blacklist of DMARC records [with p=reject] to treat specially" I'm afraid is a solution which will not scale. You say there are now "about five" of such domains. Well, about five big enough for everyone to notice them, but surely there are many more which are small enough to fly under our radar. It would take just some more data breaches and we might get to a "blacklist for DMARC records with p=reject" in the form of: "*" ;-) Regards, J.Gomez _______________________________________________ dmarc mailing list [email protected] https://www.ietf.org/mailman/listinfo/dmarc
