On 5/12/15 6:58 PM, Stephen J. Turnbull wrote: > Douglas Otis writes: > > > DMARC being unable to assert the domain > > I'm not sure what you mean by "assert the domain". AFAICS no new > protocol is needed to validate Sender -- SPF and DKIM allow that > already, and it's not obvious to me where the big threat is from a > misaligned or spoofed Sender. (A BCP might say that Sender should be > aligned with the SPF domain if available, and otherwise with a valid > DKIM signer otherwise). I suppose some receivers already use this > information in their reputational models. > > > Many have not realized double signing is wide open to abuse > > Please present your threat analysis. As far as I can see, double > signing is no more vulnerable than the current practice for mailing > lists when relaying mail from p=none sites. It would increase the > attack surface for the kind of abuse that caused some major sites to > publish p=reject last April, but it's something that can be turned on > incrementally as a matter of local policy (just as DMARC itself was), > and it can be turned off as fast as you can propagate the config > change to your SMTP server farm (unlike p=reject itself, which suffers > from DNS caching lag). > > I wouldn't call that "wide open". > > Steve > >
_______________________________________________ dmarc mailing list [email protected] https://www.ietf.org/mailman/listinfo/dmarc
