Subject: [dmarc-ietf] Open DMARC discussion meeting: Monday 2013-10-20 0830-0930 UTC-0400

From: Kurt Andersen <[email-masked]>
Date: Sat, 19 Oct 2013 07:52:08 -0500

There will be an open discussion meeting hosted at the impending M^3AAWG
training day with a teleconference dial-in option for any interested
parties. The bridge line is:

 U.S. Toll Free Dial-In:   1-800-820-4690
 Direct (Toll): +1 702-696-5291
International Toll Free: France #: 0800911910, Germany #: 08001824395 ,
Spain #: 900941732, UK #: 08082348428

 Conference Code: 250-041-2259

 Here is the session description:

 Spend 60 minutes with some of the authors of the DMARC specification and
discuss how their experience deploying DMARC can help you implement it in
your organization.  They’ve learned a lot over the nearly two years of
public operation and now is your chance to tap their expertise in answering
your questions. This isn't a formal training session but rather an
opportunity for you to interact directly with DMARC experts, discuss the
issues you're facing and ask for suggested guidance.

 Session will be moderated by Franck Martin (LinkedIn) and Mike Jones
(Agari).

 This open discussion session is sponsored by the M^3AAWG Training
Committee.

 Cheers,
  Kurt Andersen
  M^3AAWG Training Committee Co-Chair

---

From: Kurt Andersen <[email-masked]>
Date: Mon, 21 Oct 2013 07:38:59 -0500

The conference bridge is open now for anyone to attend - though I'm not
sure how well the audio pickup will work because of the configuration of
the room.

The correct date is indeed 10-21 @ 1230 UTC/0830 EDT/0530 PDT.

Cheers,
  Kurt Andersen

---

From: "Murray S. Kucherawy" <[email-masked]>
Date: Sun, 27 Oct 2013 20:08:17 -0700

Kurt,

Was there any output from this meeting that would be of interest to this
audience?

I didn't get a chance to finish my draft updates before the posting embargo
went into effect, but I hope to have something ready when it lifts on the
4th.  Now would be a good time to have any relevant feedback.

-MSK

On Mon, Oct 21, 2013 at 5:38 AM, Kurt Andersen <[email-masked]> wrote:

> _______________________________________________
> dmarc mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/dmarc
>
>

---

From: Kurt Andersen <[email-masked]>
Date: Tue, 29 Oct 2013 21:14:37 +0000

It would be good to get Mike Hammer, Franck Martin and Mike Jone's take on the discussion too. I did not take notes per se but the room was pretty packed with attendees. The general take-away is that people are interested, but feel like the steps to get started (beyond publishing the DNS record – more along the lines of what do I do with the reports I get back) are still unclear.

I would say that the attendees in the room probably represent the next "segment" in the adoption curve beyond the early adopters group. They are looking for a bit more of a turn-key approach or are looking for the value equation to implement for either smaller receivers and senders or enterprise deployments (which are frequently both senders and receivers).

One topic that received some discussion was around the best way to deal with third-parties and DMARC – how to do it, etc.

Mike, Mike, Franck – care to chime in with any other thoughts?

--Kurt

On 2013-10-27 20:08 , "Murray S. Kucherawy" <[email-masked]<mailto:[email-masked]>> wrote:

Kurt,

Was there any output from this meeting that would be of interest to this audience?

I didn't get a chance to finish my draft updates before the posting embargo went into effect, but I hope to have something ready when it lifts on the 4th.  Now would be a good time to have any relevant feedback.

-MSK

On Mon, Oct 21, 2013 at 5:38 AM, Kurt Andersen <[email-masked]<mailto:[email-masked]>> wrote:
The conference bridge is open now for anyone to attend - though I'm not sure how well the audio pickup will work because of the configuration of the room.

There will be an open discussion meeting hosted at the impending M^3AAWG training day with a teleconference dial-in option for any interested parties. The bridge line is:

U.S. Toll Free Dial-In:   1-800-820-4690<tel:1-800-820-4690>
Direct (Toll): +1 702-696-5291<tel:%2B1%20702-696-5291>
International Toll Free: France #: 0800911910, Germany #: 08001824395 , Spain #: 900941732, UK #: 08082348428

Cheers,
  Kurt Andersen

_______________________________________________
dmarc mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/dmarc

---

From: "Rolf E. Sonneveld" <[email-masked]>
Date: Tue, 29 Oct 2013 22:20:33 +0100

Kurt,

On 10/29/2013 10:14 PM, Kurt Andersen wrote:
> It would be good to get Mike Hammer, Franck Martin and Mike Jone's 
> take on the discussion too. I did not take notes per se but the room 
> was pretty packed with attendees. The general take-away is that people 
> are interested, but feel like the steps to get started (beyond 
> publishing the DNS record -- more along the lines of what do I do with 
> the reports I get back) are still unclear.
>
> I would say that the attendees in the room probably represent the next 
> "segment" in the adoption curve beyond the early adopters group. They 
> are looking for a bit more of a turn-key approach or are looking for 
> the value equation to implement for either smaller receivers and 
> senders or enterprise deployments (which are frequently both senders 
> and receivers).
>
> One topic that received some discussion was around the best way to 
> deal with third-parties and DMARC -- how to do it, etc.
>
> Mike, Mike, Franck -- care to chime in with any other thoughts?

is there an audio/video/jabber/meetecho/whatever recording of the 
meeting available?

/rolf

---

From: Kurt Andersen <[email-masked]>
Date: Tue, 29 Oct 2013 21:40:59 +0000

On 2013-10-29 14:20 , "Rolf E. Sonneveld" <[email-masked]<mailto:[email-masked]>> wrote:
>
> is there an audio/video/jabber/meetecho/whatever recording of the meeting available?

No.

---

From: Franck Martin <[email-masked]>
Date: Tue, 29 Oct 2013 22:03:42 +0000

We put on one slide a quick FAQ to remove the common questions (and corrected them), I hope to have it published on dmarc.org site

I found out that people like the idea of controlling your email streams when you are in p=reject as much as fighting exact domain spoofing.

The dream of an IT administrator, no one in your organization can send an email with your domain, without talking to you :P

On Oct 29, 2013, at 2:40 PM, Kurt Andersen <[email-masked]> wrote:

> On 2013-10-29 14:20 , "Rolf E. Sonneveld" <[email-masked]> wrote:
> >

---

From: "MH Michael Hammer (5304)" <[email-masked]>
Date: Thu, 31 Oct 2013 13:34:59 +0000

Apologies for my delayed response.

I was impressed with the number of people in the room but only a small number appeared to be truly engaged in the conversation. Perhaps it was too early in the morning.

Based on a question someone asked me afterwards - "Why weren't we shown how to create a record?" - it appears that some people don't even understand how to publish a DMARC record.

Other than that, the questions/comments were what I call the "usual suspects":

1)      How to deal with the mailing list issue for organizations with end users on the domain desired to be protected.

2)      How can we implement validation when our vendor doesn't support it? (A number of major vendors will be announcing support over the next few quarters - speak with your vendor)

3)      How to handle 3rd parties mailing on our behalf.

4)      The <> bounce issue.

So no particular suprises. I do think it was useful to have the meeting and I think we should try to organize meetings/sessions in conjunction with other events.

From: Kurt Andersen [mailto:[email-masked]]
Sent: Tuesday, October 29, 2013 5:15 PM
To: Murray S. Kucherawy; Kurt Andersen; MH Michael Hammer (5304); Franck Martin; Mike Jones
Cc: [email-masked]
Subject: Re: [dmarc-ietf] Open DMARC discussion meeting: Monday 2013-10-20 0830-0930 UTC-0400

It would be good to get Mike Hammer, Franck Martin and Mike Jone's take on the discussion too. I did not take notes per se but the room was pretty packed with attendees. The general take-away is that people are interested, but feel like the steps to get started (beyond publishing the DNS record - more along the lines of what do I do with the reports I get back) are still unclear.

One topic that received some discussion was around the best way to deal with third-parties and DMARC - how to do it, etc.

Mike, Mike, Franck - care to chime in with any other thoughts?

--Kurt

---

From: Mike Jones <[email-masked]>
Date: Thu, 31 Oct 2013 08:40:51 -0700

I agree with all of Mike's summary. I would add that in addition to the question Mike received about creating a DMARC record, there were a couple of other very basic questions about DMARC.  To me it indicated that even in a crowd like MAWWG where DMARC has been discussed for some time, training has occurred, and the general level of email expertise is high, there is still a need for a BCP document and continued education.  

Mike J.

On Oct 31, 2013, at 6:34 AM, MH Michael Hammer (5304) <[email-masked]> wrote:

> Based on a question someone asked me afterwards – “Why weren’t we shown how to create a record?” - it appears that some people don’t even understand how to publish a DMARC record.
>  
> Other than that, the questions/comments were what I call the “usual suspects”:
>  
> 2)      How can we implement validation when our vendor doesn’t support it? (A number of major vendors will be announcing support over the next few quarters – speak with your vendor)

---

From: John Sweet <[email-masked]>
Date: Thu, 31 Oct 2013 09:23:23 -0700

MAAWG newcomers tend to gravitate to these discussions, so that's part
of the reason why it feels like the same questions are asked over and
over.

FWIW, I knew the answer to the question I asked; I didn't see it in
Franck's slides and wanted to hear it answered. I thought some of the
people in the room probably didn't even know what to ask, it was
pretty quiet.

It was helpful to hear both Franck's and Mike's answers to the same
question, which are pretty much opposite ends of the spectrum ("we
hold individual users to the same constraints as our automated
messages," vs. "we know our users will never adhere to this, so we put
them in a different domain entirely.")

On Thu, Oct 31, 2013 at 8:40 AM, Mike Jones <[email-masked]> wrote:
> I agree with all of Mike's summary. I would add that in addition to the
> question Mike received about creating a DMARC record, there were a couple of
> other very basic questions about DMARC.  To me it indicated that even in a
> crowd like MAWWG where DMARC has been discussed for some time, training has
> occurred, and the general level of email expertise is high, there is still a
> need for a BCP document and continued education.
>
> Mike J.
>
>
>
> I was impressed with the number of people in the room but only a small
> number appeared to be truly engaged in the conversation. Perhaps it was too
> early in the morning.
>
> Based on a question someone asked me afterwards – “Why weren’t we shown how
> to create a record?” - it appears that some people don’t even understand how
> to publish a DMARC record.
>
> 1)      How to deal with the mailing list issue for organizations with end
> users on the domain desired to be protected.
> 2)      How can we implement validation when our vendor doesn’t support it?
> (A number of major vendors will be announcing support over the next few
> quarters – speak with your vendor)
> So no particular suprises. I do think it was useful to have the meeting and
> I think we should try to organize meetings/sessions in conjunction with
> other events.
>
> It would be good to get Mike Hammer, Franck Martin and Mike Jone's take on
> the discussion too. I did not take notes per se but the room was pretty
> packed with attendees. The general take-away is that people are interested,
> but feel like the steps to get started (beyond publishing the DNS record –
> more along the lines of what do I do with the reports I get back) are still
> unclear.
>
> "segment" in the adoption curve beyond the early adopters group. They are
> looking for a bit more of a turn-key approach or are looking for the value
> equation to implement for either smaller receivers and senders or enterprise
> deployments (which are frequently both senders and receivers).
>
> One topic that received some discussion was around the best way to deal with
> third-parties and DMARC – how to do it, etc.
>

---

From: Kurt Andersen <[email-masked]>
Date: Thu, 31 Oct 2013 16:49:36 +0000

One more note, it was a bit disconcerting to see that ~80% of the 50 or so attendees were unaware of the existence of the DMARC training videos that M3AAWG has made freely available on its public site.

Another point of public awareness that could use a boost.

--Kurt

---

From: Franck Martin <[email-masked]>
Date: Thu, 31 Oct 2013 16:51:05 +0000

Oh, and there is a middle ground

https://dmarcian.com/dmarc-inspector/google.com

with p=quarantine you have the benefit of DMARC without annoying mailing list administrators, but it is known that people go in their spam folder to act on fake messages...

For the how to create a DMARC record, there was on point 2 of the slide, what initial record to publish....