Subject: [dmarc-ietf] Thoughts on the DMARC Specification

From: Robert Pickup <[email-masked]>
Date: Sun, 15 Sep 2013 13:34:01 -0700

*Thoughts on the DMARC specification*

I am the founder of Truedomain Inc, an authentication intermediary and a
founding member of the DMARC initiative. I have been active with email
authentication for over a decade and have created and brought to market
products and services that address email spoofing, spam and phishing.

The DMARC specification was created with cooperation of the largest
senders, receivers and intermediaries. It demonstrates the value of the
specification by having these organizations working together to find an
easy to implement solution the adequately addresses the needs of each
player within the email ecosystem.
*

Do you feel that the overall specification is useful for the intended
purpose?
*
Absolutely.  First, the specification provides a mechanism with which to
understand the many email streams being sent using an organization's
domain. Second, it provides a mechanism to publish a policy so receivers
can action email accordingly based on the authentication results. This has
the benefit of being able to protect senders, receivers and the intended
recipients from receiving spam and in particular, phishing attempts.

*Does support already exist for the specification?  For example, do you
know of existing deployments that rely on the current specification?*

DMARC is fully supported by the largest email receivers including Yahoo,
AOL, Gmail and Outlook. Many financial institutions utilize DMARC to gain a
better understanding of where their email is being sent from to ensure all
of their email is being authenticated. Without DMARC this would be almost
impossible to achieve.

*Are there critical aspects of the specification that need to be modified
prior to it being a published standard?*

No. The current specification addresses the key issues of being able to
identify and understand multiple email streams and protect against spoofed
emails being delivered.

*Are there aspects of the specification that can be modified (e.g. by
additional extensions) to improve it after it has been published as a
standard?*

Potentially, but as outlined above, the specification meets the
requirements it was intended to address.

*Does the specification as written provide a clear, precise, and accurate
description of the steps necessary to implement the specification?*

Yes. There is already significant adoption of the specification which
demonstrates its ease of implementation for both senders and receivers.

*Would you feel comfortable supporting it being published as a standard, or
are do you have any additional reservations you would like to see addressed
before you would support it?*

Absolutely. I do not have any reservations, as the specification is doing
the job it was intended to do.

Robert Pickup
Founder, Truedomain Inc
415 490 8146