Re: [dmarc-ietf] Idle Musings - Why Is It DMARC and not DMARD?

2023-08-05 Thread Jesse Thompson
On Sat, Aug 5, 2023, at 11:49 AM, Dave Crocker wrote:
> On 8/5/2023 9:30 AM, Jesse Thompson wrote:
> > Governance seems like the best word to me, since Governance is what 
> > Reporting has provided to ADs in Monitoring Mode, but I do not want to 
> > say DMARG out loud either :-)
> 
> Here, too, the domain owner does not govern the platform receiver.

I don't disagree with you. My point was that the reports, provided by the 
receivers, give to the security&compliance team the provisions they need to 
convince/coerce employees to adhere to their intended governance model, 
regardless of whether the receivers honor the governance model. i.e. Monitoring 
Mode is not an exercise done in a vacuum. The reason to monitor is to achieve 
local compliance; to govern your mail streams.

p=quarantine pct=0 (now in DMARCbis: t=y) is useful to determine the extent to 
which people are participating in mailing lists and to identify lists that are 
not compensating for the interoperability issues. Without t=y, the people in 
charge of governance may just assume [incorrectly] that one or the other 
situation is rare. Sadly, I think the t=y benefit will be overlooked, because 
S&C people don't really care if the organization's employees can't easily 
participate in mailing lists. They may hope/assume that receivers will honor 
the policy, so "testing" implies "governance objective not yet complete".

Jesse___
dmarc mailing list
dmarc@ietf.org
https://www.ietf.org/mailman/listinfo/dmarc


Re: [dmarc-ietf] Idle Musings - Why Is It DMARC and not DMARD?

2023-08-05 Thread Dave Crocker

On 8/5/2023 5:06 PM, Tim Wicinski wrote:
The former resonates with harried admins, while the later is useful 
to implementers. 


Providing a definition that is at odds with established meaning for a 
word is something that can work tech geeks but is counter-productive 
when applied for others.


d/

--
Dave Crocker
dcroc...@gmail.com
mast:@dcrocker@mastodon.social
408.329.0791

Volunteer, Silicon Valley Chapter
Information & Planning Coordinator
American Red Cross
dave.crock...@redcross.org

___
dmarc mailing list
dmarc@ietf.org
https://www.ietf.org/mailman/listinfo/dmarc


Re: [dmarc-ietf] Idle Musings - Why Is It DMARC and not DMARD?

2023-08-05 Thread Tim Wicinski
On Sat, Aug 5, 2023 at 7:38 PM Dave Crocker  wrote:

> On 8/5/2023 4:23 PM, Neil wrote:
>
>  Also, we understand who our audiences are in reality. Sometimes it’ll be
> a harried admin skimming the RFC, and others will take the time to do a
> deep dive. Even the harried admin scanning today might want to dive deep
> when he has more time. So out of respect for those who want to get things
> done and solve problems quickly and those who wish to grok the new DMARC
> spec, I think the optimal solution would be to follow E.B. White, making
> every word count, having empathy for the reader, and avoiding distractions
> that could bog the stressed reader down.
>
> When writing specifications, yes, it is good to consider the casual or
> harried reader.  To that end, vocabulary should not mislead.  'Policy'
> misleads about the effect of choosing a particular value.
>

The other thing I've found that has proven useful in DNS RFCs, and that
I've received positive feedback outside of IETF is when we can summarize
definitions or guidance with tables.  Two stand out - the table at the
bottom of page 25 in RFC8499 showing examples of zone delegation types:

https://datatracker.ietf.org/doc/html/rfc8499#page-25

and the table in RFC8624 listing implementation recommendations for DNSSEC
algorithms

https://datatracker.ietf.org/doc/html/rfc8624#section-3.1

The former resonates with harried admins, while the later is useful
to implementers.

I am not saying we must do this, or we can, but it's something to
consider.
___
dmarc mailing list
dmarc@ietf.org
https://www.ietf.org/mailman/listinfo/dmarc


Re: [dmarc-ietf] Idle Musings - Why Is It DMARC and not DMARD?

2023-08-05 Thread Scott Kitterman
On Saturday, August 5, 2023 7:38:21 PM EDT Dave Crocker wrote:
> On 8/5/2023 4:23 PM, Neil wrote:
> > > The language used for DMARC has always been problematic. "Policy"
> > > 
> > > implies control, but the domain owner has no control over the receiving
> > > platform.  Quarantine and Reject declare control that also does not
> > 
> > exist.
> > 
> > Suppose you set a policy of p=reject that’s still your policy even if
> > receivers aren’t obligated to honor your policy. But it’s a policy
> > nonetheless. It’s not required that a policy be followed for it to be
> > policy. That aside, there’s unlikely to be another word that works
> > better than’s worth any confusion or disruption that could be caused
> > by changing the jargon.
> 
> www.dictionary.com
> 
> Policy Definition & Meaning | Dictionary.com <#>
> 
> Policy definition, a definite course of action adopted for the sake of
> expediency, facility, etc.: We have a new company policy. See more.
> 
> 🔗 https://www.dictionary.com/browse/policy
> 
> 
> >  Also, we understand who our audiences are in reality. Sometimes it’ll
> > be a harried admin skimming the RFC, and others will take the time to
> > do a deep dive. Even the harried admin scanning today might want to
> > dive deep when he has more time. So out of respect for those who want
> > to get things done and solve problems quickly and those who wish to
> > grok the new DMARC spec, I think the optimal solution would be to
> > follow E.B. White, making every word count, having empathy for the
> > reader, and avoiding distractions that could bog the stressed reader down.
> 
> When writing specifications, yes, it is good to consider the casual or
> harried reader.  To that end, vocabulary should not mislead.  'Policy'
> misleads about the effect of choosing a particular value.

And part of that relates to existing usage.  Policy has been used in this way 
for 20 years (SPF after it was renamed, ADSP, and now DMARC).  I think it's 
fine in any case.  A company's policy is what they want employees to do.  
There's no guarantee they will.

Scott K


___
dmarc mailing list
dmarc@ietf.org
https://www.ietf.org/mailman/listinfo/dmarc


Re: [dmarc-ietf] Idle Musings - Why Is It DMARC and not DMARD?

2023-08-05 Thread Dave Crocker

On 8/5/2023 4:23 PM, Neil wrote:

> The language used for DMARC has always been problematic. "Policy"

> implies control, but the domain owner has no control over the receiving
> platform.  Quarantine and Reject declare control that also does not 
exist.


Suppose you set a policy of p=reject that’s still your policy even if 
receivers aren’t obligated to honor your policy. But it’s a policy 
nonetheless. It’s not required that a policy be followed for it to be 
policy. That aside, there’s unlikely to be another word that works 
better than’s worth any confusion or disruption that could be caused 
by changing the jargon.



www.dictionary.com

Policy Definition & Meaning | Dictionary.com <#>

Policy definition, a definite course of action adopted for the sake of 
expediency, facility, etc.: We have a new company policy. See more.


🔗 https://www.dictionary.com/browse/policy 



 Also, we understand who our audiences are in reality. Sometimes it’ll 
be a harried admin skimming the RFC, and others will take the time to 
do a deep dive. Even the harried admin scanning today might want to 
dive deep when he has more time. So out of respect for those who want 
to get things done and solve problems quickly and those who wish to 
grok the new DMARC spec, I think the optimal solution would be to 
follow E.B. White, making every word count, having empathy for the 
reader, and avoiding distractions that could bog the stressed reader down.


When writing specifications, yes, it is good to consider the casual or 
harried reader.  To that end, vocabulary should not mislead.  'Policy' 
misleads about the effect of choosing a particular value.



d/

--
Dave Crocker
dcroc...@gmail.com
mast:@dcrocker@mastodon.social
408.329.0791

Volunteer, Silicon Valley Chapter
Information & Planning Coordinator
American Red Cross
dave.crock...@redcross.org
___
dmarc mailing list
dmarc@ietf.org
https://www.ietf.org/mailman/listinfo/dmarc


Re: [dmarc-ietf] Idle Musings - Why Is It DMARC and not DMARD?

2023-08-05 Thread Neil


From: Dave Crocker 
Date: Saturday, August 5, 2023 at 9:49 AM
To: Jesse Thompson , Neil 
Cc: Todd Herr , IETF DMARC WG 
Subject: Re: [dmarc-ietf] Idle Musings - Why Is It DMARC and not DMARD?

> The language used for DMARC has always been problematic. "Policy"
> implies control, but the domain owner has no control over the receiving
> platform.  Quarantine and Reject declare control that also does not exist.
Suppose you set a policy of p=reject that’s still your policy even if receivers 
aren’t obligated to honor your policy. But it’s a policy nonetheless. It’s not 
required that a policy be followed for it to be policy. That aside, there’s 
unlikely to be another word that works better than’s worth any confusion or 
disruption that could be caused by changing the jargon.

Also, we understand who our audiences are in reality. Sometimes it’ll be a 
harried admin skimming the RFC, and others will take the time to do a deep 
dive. Even the harried admin scanning today might want to dive deep when he has 
more time. So out of respect for those who want to get things done and solve 
problems quickly and those who wish to grok the new DMARC spec, I think the 
optimal solution would be to follow E.B. White, making every word count, having 
empathy for the reader, and avoiding distractions that could bog the stressed 
reader down.

Then there would be well-organized appendixes that satisfy the reader in a 
lower stress state who wants to spend some time to grok.
So I get straight to the point, postpone in-depth exploration a few pages, 
putting enough material in well-organized appendices to satisfy the desire of 
many technical people who don’t feel comfortable until they grok something. 
That can be me on the same day easily.
Thanks.
Neil


> Governance seems like the best word to me, since Governance is what
> Reporting has provided to ADs in Monitoring Mode, but I do not want to
> say DMARG out loud either :-)

Here, too, the domain owner does not govern the platform receiver.

d/

--
Dave Crocker
dcroc...@gmail.com
mast:@dcrocker@mastodon.social
408.329.0791

Volunteer, Silicon Valley Chapter
Information & Planning Coordinator
American Red Cross
dave.crock...@redcross.org
___
dmarc mailing list
dmarc@ietf.org
https://www.ietf.org/mailman/listinfo/dmarc


Re: [dmarc-ietf] Idle Musings - Why Is It DMARC and not DMARD?

2023-08-05 Thread Hector Santos
On Aug 5, 2023, at 12:57 PM, Benny Pedersen  wrote:
> 
> Dave Crocker skrev den 2023-08-05 18:49:
> 
>>> Governance seems like the best word to me, since Governance is what 
>>> Reporting has provided to ADs in Monitoring Mode, but I do not want to say 
>>> DMARG out loud either :-)
>> Here, too, the domain owner does not govern the platform receiver.
> 
> good news for paypal phishers, sadly
> 
> the recipient should newer recieve mail that is with credit card info by 
> dmarc is unaligned to the dmarc policy, when policy is basicly ignored we 
> have the underlaying problem dmarc should solve, but as is does not
> 

As a receiver,  I don’t wish to be inundated with spam or spoofs. I will honor 
incoming mail domain policies with deterministic rules.  As a sender, I want 
other receivers to also honor and protect my domains as well.  It’s a win-win. 

SPF -ALL has proved to help with an average of ~5% rejects since its 
introduction.  The growth was slow and it has come with its irritating small 
amount of well-known forwarding problems.  With DMARC, we just have not enabled 
p=reject failures yet.  We need more persistent deterministic DMARC “rules” 
before flipping this switch.

SPF and DKIM Policy models since SSP has been about informing receivers about 
Domain Mail Operational expectations.  This has been good. Receiver Local 
Policy always prevails but a “hint” can help decide things especially when it 
comes to failures.   

—
HLS



___
dmarc mailing list
dmarc@ietf.org
https://www.ietf.org/mailman/listinfo/dmarc


Re: [dmarc-ietf] Idle Musings - Why Is It DMARC and not DMARD?

2023-08-05 Thread Benny Pedersen

Dave Crocker skrev den 2023-08-05 18:49:

Governance seems like the best word to me, since Governance is what 
Reporting has provided to ADs in Monitoring Mode, but I do not want to 
say DMARG out loud either :-)

Here, too, the domain owner does not govern the platform receiver.


good news for paypal phishers, sadly

the recipient should newer recieve mail that is with credit card info by 
dmarc is unaligned to the dmarc policy, when policy is basicly ignored 
we have the underlaying problem dmarc should solve, but as is does not


___
dmarc mailing list
dmarc@ietf.org
https://www.ietf.org/mailman/listinfo/dmarc


Re: [dmarc-ietf] Idle Musings - Why Is It DMARC and not DMARD?

2023-08-05 Thread Dave Crocker

On 8/5/2023 9:30 AM, Jesse Thompson wrote:


Conformance has a synonym Compliance, which may be a reason why people 
in the ranks of Security and Compliance in "general purpose" Author 
Domains fixate on p=quarantine|reject as a rubric to assess their 
perceived security posture without any serious knowledge/consideration 
of the email interoperability issues, and then inevitably there's some 
kind of unsolvable security incident that convinces the CISO to say 
"damn the torpedoes".


The language used for DMARC has always been problematic. "Policy" 
implies control, but the domain owner has no control over the receiving 
platform.  Quarantine and Reject declare control that also does not exist.



Governance seems like the best word to me, since Governance is what 
Reporting has provided to ADs in Monitoring Mode, but I do not want to 
say DMARG out loud either :-)


Here, too, the domain owner does not govern the platform receiver.

d/

--
Dave Crocker
dcroc...@gmail.com
mast:@dcrocker@mastodon.social
408.329.0791

Volunteer, Silicon Valley Chapter
Information & Planning Coordinator
American Red Cross
dave.crock...@redcross.org

___
dmarc mailing list
dmarc@ietf.org
https://www.ietf.org/mailman/listinfo/dmarc


Re: [dmarc-ietf] Idle Musings - Why Is It DMARC and not DMARD?

2023-08-05 Thread Jesse Thompson
On Sun, Jul 23, 2023, at 4:38 PM, Neil Anuskiewicz wrote:
> > On Jun 30, 2023, at 11:33 AM, Dave Crocker  wrote:
> > > On 6/30/2023 11:22 AM, Todd Herr wrote:
> >> Why is the mechanism called "Domain-based Message Authentication, 
> >> Reporting, and Conformance" and not "Domain-based Message Authentication, 
> >> Reporting, and Disposition"?
> > 
> > Say DMARC out loud.  Now say DMARD out loud.
> 
> I like the way you think, Mr. Crocker. What a difference a letter makes. 
> Dmarc sounds important, serious. DMARD sounds like something a high college 
> friend might have made up to describe something stupid. 

It also phonetically sounds like an abbreviation of Demarcation, which make it, 
what, a double entendre?

Conformance has a synonym Compliance, which may be a reason why people in the 
ranks of Security and Compliance in "general purpose" Author Domains fixate on 
p=quarantine|reject as a rubric to assess their perceived security posture 
without any serious knowledge/consideration of the email interoperability 
issues, and then inevitably there's some kind of unsolvable security incident 
that convinces the CISO to say "damn the torpedoes".

Governance seems like the best word to me, since Governance is what Reporting 
has provided to ADs in Monitoring Mode, but I do not want to say DMARG out loud 
either :-)

Jesse___
dmarc mailing list
dmarc@ietf.org
https://www.ietf.org/mailman/listinfo/dmarc


Re: [dmarc-ietf] Idle Musings - Why Is It DMARC and not DMARD?

2023-07-23 Thread Neil Anuskiewicz


> On Jun 30, 2023, at 11:33 AM, Dave Crocker  wrote:
> 
> On 6/30/2023 11:22 AM, Todd Herr wrote:
>> Why is the mechanism called "Domain-based Message Authentication, Reporting, 
>> and Conformance" and not "Domain-based Message Authentication, Reporting, 
>> and Disposition"?
> 
> Say DMARC out loud.  Now say DMARD out loud.

I like the way you think, Mr. Crocker. What a difference a letter makes. Dmarc 
sounds important, serious. DMARD sounds like something a high college friend 
might have made up to describe something stupid. 
___
dmarc mailing list
dmarc@ietf.org
https://www.ietf.org/mailman/listinfo/dmarc


Re: [dmarc-ietf] Idle Musings - Why Is It DMARC and not DMARD?

2023-06-30 Thread Hector Santos
Great question.

I’ve been around since the beginning as a very strong DKIM Policy advocate, 
watching everything, my dumb attempt to summarize:

1) The idea of “reporting” was considered a testing thing.  Redundant,. 
DomainKeys and DKIM had -t test keys.  I believed and others as well, felt 
reporting was an attack vector. I included reporting ideas in DSAP but the 
format was not defined. The section was left TBD.

2) Murray was working on reporting methods with a format.  He was obviously 
filling a need out there.

3) I did not hear of anyone honoring ADSP rejects because of the known indirect 
mail problems.

4) ADSP was abandoned and replaced with Super ADSP aka DMARC which introduced a 
reporting and compliance concept.  It had a strong policy idea.

5) I totally under estimated the administrator direct for reports.  But I still 
didn’t believe it in.  It’s for testing only, right? 

6) I did not hear of anyone rejecting on DMARC p=reject. So it was just about 
Reporting & Conformance.

7) Then YAHOO.COM , the patented inventor of this all this 
starting with DomainKeys, the first with a built-in `o=` tag policy concept, 
was the first big system to honor published DMARC strict policies.

8) Now DMARC become about Handling and proper SMTP integration with SPF.

The end!

Happy July 4th Weekend. Be safe!!

—
HLS




> On Jun 30, 2023, at 2:22 PM, Todd Herr 
>  wrote:
> 
> Genuine curiosity question here for those who were around at the beginning...
> 
> Why is the mechanism called "Domain-based Message Authentication, Reporting, 
> and Conformance" and not "Domain-based Message Authentication, Reporting, and 
> Disposition"? Perhaps a better question, why is "conformance" in the name of 
> the mechanism?
> 
> I ask because I'm writing up some stuff for internal use, and I got curious 
> as to how conformance is defined or explained in RFC 7489, and well, it's 
> not. The word appears five times in RFC 7489, and each occurrence is in the 
> context of spelling out the full name of the mechanism.
> 
> I am not looking to change the name of the mechanism; I'm just genuinely 
> curious how the name was arrived at.
> 
> -- 
> Todd Herr  | Technical Director, Standards & Ecosystem
> e: todd.h...@valimail.com 
> p: 703-220-4153
> m: 703.220.4153
> 
> This email and all data transmitted with it contains confidential and/or 
> proprietary information intended solely for the use of individual(s) 
> authorized to receive it. If you are not an intended and authorized recipient 
> you are hereby notified of any use, disclosure, copying or distribution of 
> the information included in this transmission is prohibited and may be 
> unlawful. Please immediately notify the sender by replying to this email and 
> then delete it from your system.
> ___
> dmarc mailing list
> dmarc@ietf.org
> https://www.ietf.org/mailman/listinfo/dmarc

___
dmarc mailing list
dmarc@ietf.org
https://www.ietf.org/mailman/listinfo/dmarc


Re: [dmarc-ietf] Idle Musings - Why Is It DMARC and not DMARD?

2023-06-30 Thread Seth Blank
Given Todd's comment that "DMAR" is well defined, but "C" is not-- is it
worth explanatory text in the document? I don't think there's any real
confusion about what Conformance means. Is it a weird gap to leave while
we're updating the document, or does no one think it matters?

On Fri, Jun 30, 2023 at 12:06 PM Dotzero  wrote:

>
>
> On Fri, Jun 30, 2023 at 2:31 PM Murray S. Kucherawy 
> wrote:
>
>> On Fri, Jun 30, 2023 at 11:22 AM Todd Herr > 40valimail@dmarc.ietf.org> wrote:
>>
>>> Why is the mechanism called "Domain-based Message Authentication,
>>> Reporting, and Conformance" and not "Domain-based Message Authentication,
>>> Reporting, and Disposition"? Perhaps a better question, why is
>>> "conformance" in the name of the mechanism?
>>>
>>
>> Two reasons I can think of:
>>
>> 1) "Conformance" describes the test as to whether a message meets the
>> required authentication test(s).  And one can reasonably infer from
>> "Conformance" that a message which doesn't conform to the published
>> authentication policy will be dealt with accordingly.
>>
>> 2) DMARC's antecedents (e.g., ADSP) were still part of what we considered
>> email authentication, which is covered by the "A".
>>
>> -MSK
>>
>
> "Conformance"  was about conformance to the requested policy disposition.
> We (dmarc.org participants) tossed around various acronyms as we
> discussed the name. I'll also point out that the immediate antecedent to
> DMARC was MOOCOW. ADSP was not a consideration other than problems to
> avoid. "Authentication" referenced authenticating the domain associated
> with the RFC822 From email address.
>
> Michael Hammer
> ___
> dmarc mailing list
> dmarc@ietf.org
> https://www.ietf.org/mailman/listinfo/dmarc
>


-- 

*Seth Blank * | Chief Technology Officer
*e:* s...@valimail.com
*p:*

This email and all data transmitted with it contains confidential and/or
proprietary information intended solely for the use of individual(s)
authorized to receive it. If you are not an intended and authorized
recipient you are hereby notified of any use, disclosure, copying or
distribution of the information included in this transmission is prohibited
and may be unlawful. Please immediately notify the sender by replying to
this email and then delete it from your system.
___
dmarc mailing list
dmarc@ietf.org
https://www.ietf.org/mailman/listinfo/dmarc


Re: [dmarc-ietf] Idle Musings - Why Is It DMARC and not DMARD?

2023-06-30 Thread Dotzero
On Fri, Jun 30, 2023 at 2:31 PM Murray S. Kucherawy 
wrote:

> On Fri, Jun 30, 2023 at 11:22 AM Todd Herr  40valimail@dmarc.ietf.org> wrote:
>
>> Why is the mechanism called "Domain-based Message Authentication,
>> Reporting, and Conformance" and not "Domain-based Message Authentication,
>> Reporting, and Disposition"? Perhaps a better question, why is
>> "conformance" in the name of the mechanism?
>>
>
> Two reasons I can think of:
>
> 1) "Conformance" describes the test as to whether a message meets the
> required authentication test(s).  And one can reasonably infer from
> "Conformance" that a message which doesn't conform to the published
> authentication policy will be dealt with accordingly.
>
> 2) DMARC's antecedents (e.g., ADSP) were still part of what we considered
> email authentication, which is covered by the "A".
>
> -MSK
>

"Conformance"  was about conformance to the requested policy disposition.
We (dmarc.org participants) tossed around various acronyms as we discussed
the name. I'll also point out that the immediate antecedent to DMARC was
MOOCOW. ADSP was not a consideration other than problems to avoid.
"Authentication" referenced authenticating the domain associated with the
RFC822 From email address.

Michael Hammer
___
dmarc mailing list
dmarc@ietf.org
https://www.ietf.org/mailman/listinfo/dmarc


Re: [dmarc-ietf] Idle Musings - Why Is It DMARC and not DMARD?

2023-06-30 Thread Dave Crocker

On 6/30/2023 11:22 AM, Todd Herr wrote:
Why is the mechanism called "Domain-based Message Authentication, 
Reporting, and Conformance" and not "Domain-based Message 
Authentication, Reporting, and Disposition"?


Say DMARC out loud.  Now say DMARD out loud.

d/

--
Dave Crocker
dcroc...@gmail.com
mast:@dcrocker@mastodon.social
408.329.0791

Volunteer, Silicon Valley Chapter
Information & Planning Coordinator
American Red Cross
dave.crock...@redcross.org

___
dmarc mailing list
dmarc@ietf.org
https://www.ietf.org/mailman/listinfo/dmarc


Re: [dmarc-ietf] Idle Musings - Why Is It DMARC and not DMARD?

2023-06-30 Thread Murray S. Kucherawy
On Fri, Jun 30, 2023 at 11:22 AM Todd Herr  wrote:

> Why is the mechanism called "Domain-based Message Authentication,
> Reporting, and Conformance" and not "Domain-based Message Authentication,
> Reporting, and Disposition"? Perhaps a better question, why is
> "conformance" in the name of the mechanism?
>

Two reasons I can think of:

1) "Conformance" describes the test as to whether a message meets the
required authentication test(s).  And one can reasonably infer from
"Conformance" that a message which doesn't conform to the published
authentication policy will be dealt with accordingly.

2) DMARC's antecedents (e.g., ADSP) were still part of what we considered
email authentication, which is covered by the "A".

-MSK
___
dmarc mailing list
dmarc@ietf.org
https://www.ietf.org/mailman/listinfo/dmarc


[dmarc-ietf] Idle Musings - Why Is It DMARC and not DMARD?

2023-06-30 Thread Todd Herr
Genuine curiosity question here for those who were around at the
beginning...

Why is the mechanism called "Domain-based Message Authentication,
Reporting, and Conformance" and not "Domain-based Message Authentication,
Reporting, and Disposition"? Perhaps a better question, why is
"conformance" in the name of the mechanism?

I ask because I'm writing up some stuff for internal use, and I got curious
as to how conformance is defined or explained in RFC 7489, and well, it's
not. The word appears five times in RFC 7489, and each occurrence is in the
context of spelling out the full name of the mechanism.

I am not looking to change the name of the mechanism; I'm just genuinely
curious how the name was arrived at.

-- 

*Todd Herr * | Technical Director, Standards & Ecosystem
*e:* todd.h...@valimail.com
*p:* 703-220-4153
*m:* 703.220.4153

This email and all data transmitted with it contains confidential and/or
proprietary information intended solely for the use of individual(s)
authorized to receive it. If you are not an intended and authorized
recipient you are hereby notified of any use, disclosure, copying or
distribution of the information included in this transmission is prohibited
and may be unlawful. Please immediately notify the sender by replying to
this email and then delete it from your system.
___
dmarc mailing list
dmarc@ietf.org
https://www.ietf.org/mailman/listinfo/dmarc