Re: [dmarc-ietf] DMARCbis WGLC - Issue 135 - What To Say About Too-Permissive/Third-Party SPF and Where To Say It?

2024-03-18 Thread Scott Kitterman
On March 18, 2024 6:53:29 PM UTC, John R Levine wrote: >On Mon, 18 Mar 2024, Alessandro Vesely wrote: >> The text should be terser and clearer, possibly with an example. > >I would be happy to remove the whole thing, since it's only distantly related >to defining or implementing DMARC. I

Re: [dmarc-ietf] DMARCbis WGLC - Issue 135 - What To Say About Too-Permissive/Third-Party SPF and Where To Say It?

2024-03-18 Thread Scott Kitterman
On March 18, 2024 6:40:54 PM UTC, Alessandro Vesely wrote: >On Mon 18/Mar/2024 09:14:26 +0100 Dotzero wrote: >> On Mon, Mar 18, 2024 at 2:38 AM John R Levine wrote: >>> On Sun, 17 Mar 2024, Dotzero wrote: > Whenever mail is sent, there is a risk that an overly permissive source > may

Re: [dmarc-ietf] DMARCbis WGLC - Issue 135 - What To Say About Too-Permissive/Third-Party SPF and Where To Say It?

2024-03-18 Thread John R Levine
Now with Mike's tweak: Add this to 11.1 Authentication Methods Both of the email authentication methods that underlie DMARC provide some assurance that an email was transmitted by an MTA which is authorized to do so. SPF policies map domain names to sets of authorized MTAs [ref to RFC 7208,

Re: [dmarc-ietf] DMARCbis WGLC - Issue 135 - What To Say About Too-Permissive/Third-Party SPF and Where To Say It?

2024-03-18 Thread John R Levine
On Mon, 18 Mar 2024, Alessandro Vesely wrote: The text should be terser and clearer, possibly with an example. I would be happy to remove the whole thing, since it's only distantly related to defining or implementing DMARC. Regards, John Levine, jo...@taugh.com, Taughannock Networks,

Re: [dmarc-ietf] DMARCbis WGLC - Issue 135 - What To Say About Too-Permissive/Third-Party SPF and Where To Say It?

2024-03-18 Thread Alessandro Vesely
On Mon 18/Mar/2024 09:14:26 +0100 Dotzero wrote: On Mon, Mar 18, 2024 at 2:38 AM John R Levine wrote: On Sun, 17 Mar 2024, Dotzero wrote: Whenever mail is sent, there is a risk that an overly permissive source may send mail which will receive a DMARC pass result that was not, in fact,

Re: [dmarc-ietf] General Purpose Domain

2024-03-18 Thread Alessandro Vesely
On Mon 18/Mar/2024 15:24:34 +0100 Todd Herr wrote: Issue 137 has been opened for this. On Mon, Mar 18, 2024 at 9:50 AM Todd Herr wrote: On Sun, Mar 17, 2024 at 7:17 AM Alessandro Vesely wrote: On Sat 16/Mar/2024 21:07:53 +0100 Neil Anuskiewicz wrote: Unless I’m misunderstanding, a General

Re: [dmarc-ietf] General Purpose Domain

2024-03-18 Thread Todd Herr
Issue 137 has been opened for this. On Mon, Mar 18, 2024 at 9:50 AM Todd Herr wrote: > On Sun, Mar 17, 2024 at 7:17 AM Alessandro Vesely wrote: > >> On Sat 16/Mar/2024 21:07:53 +0100 Neil Anuskiewicz wrote: >> > Unless I’m misunderstanding, a General Purpose Domain is a separate >> domain or

Re: [dmarc-ietf] DMARCbis WGLC Issue - Section 11.5

2024-03-18 Thread Todd Herr
Issue 138 has been opened for this. On Sat, Mar 16, 2024 at 5:35 PM Scott Kitterman wrote: > Not sure if this is "significant" or not. > > I don't particularly like the title, but that's been that way for quite > some > time, so for WGLC, meh. > > The particular concern I have is with the text

Re: [dmarc-ietf] General Purpose Domain

2024-03-18 Thread Todd Herr
On Sun, Mar 17, 2024 at 7:17 AM Alessandro Vesely wrote: > On Sat 16/Mar/2024 21:07:53 +0100 Neil Anuskiewicz wrote: > > Unless I’m misunderstanding, a General Purpose Domain is a separate > domain or at least subdomain: > > > Doesn't have to be a subdomain. It is a domain which has human mail

Re: [dmarc-ietf] DMARCbis WGLC - Issue 135 - What To Say About Too-Permissive/Third-Party SPF and Where To Say It?

2024-03-18 Thread Dotzero
On Mon, Mar 18, 2024 at 2:38 AM John R Levine wrote: > On Sun, 17 Mar 2024, Dotzero wrote: > >> Whenever mail is sent, there is a risk that an overly permissive source > >> may send mail which will receive a DMARC pass result that was not, in > >> fact, authorized by the Domain Owner. These

Re: [dmarc-ietf] DMARCbis WGLC - Issue 135 - What To Say About Too-Permissive/Third-Party SPF and Where To Say It?

2024-03-18 Thread Benny Pedersen
Murray S. Kucherawy skrev den 2024-03-18 04:15: It is not a false positive in that the technology did exactly what it was supposed to do; i.e., this is not a bug. We should just be clear about this. how to make dmarc fully aligned when spf +all is allowed :( it renders no go rfc is already

Re: [dmarc-ietf] DMARCbis WGLC - Issue 135 - What To Say About Too-Permissive/Third-Party SPF and Where To Say It?

2024-03-18 Thread John R Levine
On Sun, 17 Mar 2024, Dotzero wrote: Whenever mail is sent, there is a risk that an overly permissive source may send mail which will receive a DMARC pass result that was not, in fact, authorized by the Domain Owner. These false positives may lead to issues when systems interpret DMARC pass