Subject: [dmarc-ietf] DMARC implementation Question

From: George Moje <[email-masked]>
Date: Fri, 24 Jan 2014 13:18:10 +0000

Currently we are using SPF records but no DKIM.  Can we implement DMARC with just SPF records?

Thank you

George Moje

Computershare Technology Services
250 Royall Street, Canton, Massachusetts
T 1 781 575 4454 C 1 508 649 9039
www.computershare.com<http://www.computershare.com/>
|  CERTAINTY  |  INGENUITY  |  ADVANTAGE  |

******************************************************************************
Please visit the following website to read the Computershare legal notice: http://www.computershare.com/disclaimer/americas/en
Veuillez visiter le site Web suivant afin de prendre connaissance de l'avis juridique de Computershare: http://www.computershare.com/disclaimer/americas/fr

******************************************************************************

---

From: Franck Martin <[email-masked]>
Date: Sun, 26 Jan 2014 14:29:31 -0600 (CST)

----- Original Message -----

> From: "George Moje" <[email-masked]>
> To: "[email-masked]" <[email-masked]>
> Sent: Friday, January 24, 2014 5:18:10 AM
> Subject: [dmarc-ietf] DMARC implementation Question

> Currently we are using SPF records but no DKIM. Can we implement DMARC with

yes,It is SPF OR DKIM not SPF AND DKIM. You need both to max your chance to have a pass, but only one is needed. 

make sure you are p=none; and have a rua so you get some feedback to first fix your SPF and then later start to DKIM.

---

From: "Rolf E. Sonneveld" <[email-masked]>
Date: Tue, 28 Jan 2014 00:04:13 +0100

> DMARC with just SPF records?

according to par. 3.1.3 of the DMARC spec 
(https://datatracker.ietf.org/doc/draft-kucherawy-dmarc-base) DMARC 
assumes an author to setup and apply DKIM signing.

Apart from that: be very careful when using only SPF in combination with 
DMARC: please take into account that for DMARC there's no difference 
between an SPF -all, ~all and ?all situation. None of them provide a 
'pass' for DMARC, if I read the spec correctly.

/rolf

---

From: Franck Martin <[email-masked]>
Date: Mon, 27 Jan 2014 17:45:17 -0600 (CST)

----- Original Message -----

> From: "Rolf E. Sonneveld" <[email-masked]>
> To: "George Moje" <[email-masked]>, "[email-masked]"
> <[email-masked]>
> Sent: Monday, January 27, 2014 3:04:13 PM
> Subject: Re: [dmarc-ietf] DMARC implementation Question

> according to par. 3.1.3 of the DMARC spec (
> https://datatracker.ietf.org/doc/draft-kucherawy-dmarc-base ) DMARC assumes
> an author to setup and apply DKIM signing.

> DMARC: please take into account that for DMARC there's no difference between
> an SPF -all, ~all and ?all situation. None of them provide a 'pass' for
> DMARC, if I read the spec correctly.

No, 

If the policy is p=none, DMARC should not override the SPF policy (especially for -all), DMARC with p=none, does not change the way the email is treated in regards of SPF or ADSP. If p!=none then DMARC tells the receiver to not action on the SPF policy and tell the receiver to ignore ADSP, as DMARC will now tell how to handle the email. 

However, regardless of the DMARC p=, DMARC takes the result of the SPF test (pass, soffail, fail,...) and if there is a pass, compare the domain used by SPF for its pass with the domain in the From:. If there is alignment then you have a DMARC pass. You don't need DKIM to have a DMARC pass. 

you need to do SPF and DKIM on all your emails for p!=none, because in some cases SPF is more suitable than DKIM and vice versa, so you want the benefit of both.

---

From: Roland Turner <[email-masked]>
Date: Tue, 28 Jan 2014 13:54:26 +0800

> DMARC with just SPF records?

Absolutely, in fact publishing a DMARC p=none record is a worthwhile 
step ahead of implementing SPF or DKIM in that it allows you to discover 
quickly (and to monitor) whether you have serious issues with your 
deployment.

A more important question might be this: what are you aiming to achieve 
by implementing DMARC? If you've not implemented DKIM, you presumably 
don't have a spoofing problem at present.

- Roland

---

From: "Rolf E. Sonneveld" <[email-masked]>
Date: Tue, 28 Jan 2014 07:52:17 +0100

On 01/28/2014 12:45 AM, Franck Martin wrote:

> *From: *"Rolf E. Sonneveld" <[email-masked]>
>
>     *To: *"George Moje" <[email-masked]>,
>     "[email-masked]" <[email-masked]>
>     *Sent: *Monday, January 27, 2014 3:04:13 PM
>     *Subject: *Re: [dmarc-ietf] DMARC implementation Question
>
>     (https://datatracker.ietf.org/doc/draft-kucherawy-dmarc-base)
>     DMARC assumes an author to setup and apply DKIM signing.
>
>     Apart from that: be very careful when using only SPF in
>     combination with DMARC: please take into account that for DMARC
>     there's no difference between an SPF -all, ~all and ?all
>     situation. None of them provide a 'pass' for DMARC, if I read the
>     spec correctly.
>
> No,
>
> If the policy is p=none, DMARC should not override the SPF policy 
> (especially for -all), DMARC with p=none, does not change the way the 
> email is treated in regards of SPF or ADSP. If p!=none then DMARC 
> tells the receiver to not action on the SPF policy and tell the 
> receiver to ignore ADSP, as DMARC will now tell how to handle the email.

Please re-read my message. I didn't mentioned a 'DMARC pass', I 
mentioned the result of SPF as input to the DMARC decision process. In 
that regard, neither SPF -all, nor ~all nor ?all give an 'SPF pass' 
input to DMARC. In addition to that, if the DNS lookup for the SPF 
record fails, it's up to the receiver to decide to give a tmpfail or a 
permanent fail. That was the reason I said: be careful when applying the 
combination SPF + DMARC without DKIM, as it may result in rejection of 
valid mail (in case p!=none).

>
> However, regardless of the DMARC p=, DMARC takes the result of the SPF 
> test (pass, soffail, fail,...) and if there is a pass, compare the 
> domain used by SPF for its pass with the domain in the From:. If there 
> is alignment then you have a DMARC pass. You don't need DKIM to have a 
> DMARC pass.
>
> you need to do SPF and DKIM on all your emails for p!=none, because in 
> some cases SPF is more suitable than DKIM and vice versa, so you want 
> the benefit of both.

Right.

/rolf

---

From: Roland Turner <[email-masked]>
Date: Tue, 28 Jan 2014 15:09:59 +0800

On 01/28/2014 02:52 PM, Rolf E. Sonneveld wrote:

> input to DMARC. 

While it is literally true that -all/~all/?all don't yield passes, this 
is not how most people would interpret your message: it comes across as 
though you are trying to claim that an SPF record with -all/~all/?all at 
the end of it can't yield a pass despite that clearly not being true 
(any SPF pass being a result of an earlier part of the record).

In either case, this does not affect DMARC operation. When SPF 
evaluation passes, DMARC interprets that as a pass (for the 
5321.MailFrom domain), regardless of which of -all/~all/?all is used, or 
even if none of them are used. It would be rather unusual to implement 
DMARC without DKIM, but is not impossible.

I'd suggest that the more important question is what the OP is trying to 
achieve with DMARC in the first place. Given that they don't have DKIM 
implemented they presumably don't have a spoofing problem, in which case 
DMARC is of limited value other than for monitoring (in which case the 
absence of DKIM isn't a problem).

- Roland

---

From: "Rolf E. Sonneveld" <[email-masked]>
Date: Wed, 29 Jan 2014 00:33:53 +0100

On 01/28/2014 08:09 AM, Roland Turner wrote:
>> mentioned the result of SPF as input to the DMARC decision process. 
>> In that regard, neither SPF -all, nor ~all nor ?all give an 'SPF 
>> pass' input to DMARC. 
>
> While it is literally true that -all/~all/?all don't yield passes, 
> this is not how most people would interpret your message: it comes 
> across as though you are trying to claim that an SPF record with 
> -all/~all/?all at the end of it can't yield a pass despite that 
> clearly not being true (any SPF pass being a result of an earlier part 
> of the record).
>
> In either case, this does not affect DMARC operation. 

My point is, that SPF is far from perfect and that, when only applying 
SPF (see OP question) DMARC will cause collateral damage for a small 
percentage of all mail (typical mail that has been auto-forwarded etc.). 
For those messages, an SPF -all/~all/?all in itself won't hurt (in 
general), but DMARC will (due to the SPF result). And while some of you 
may find 0.5% - 1% lost mail negligible, I don't. If anyone has more 
accurate figures, please let us all know.

> When SPF evaluation passes, DMARC interprets that as a pass (for the 
> 5321.MailFrom domain), regardless of which of -all/~all/?all is used, 
> or even if none of them are used. It would be rather unusual to 
> implement DMARC without DKIM, but is not impossible.

Of course it's not impossible, it depends on what percentage of lost 
mail is acceptable to the sender...

>
> I'd suggest that the more important question is what the OP is trying 
> to achieve with DMARC in the first place. Given that they don't have 
> DKIM implemented they presumably don't have a spoofing problem, in 
> which case DMARC is of limited value other than for monitoring (in 
> which case the absence of DKIM isn't a problem).

Agreed.

/rolf

---

From: Roland Turner <[email-masked]>
Date: Wed, 29 Jan 2014 10:36:19 +0800

Fascinating.

It's been apparent for a while that several larger receivers require 
neighbourly behaviour as a condition for being given the benefit of any 
doubt; in particular it's taken for granted that you're taking abuse 
feedback loops and acting on them. This is the first time that I've 
heard about a comparable insistence relating to DMARC feedback.

Are you being asked merely to publish a DMARC record with p=none and 
rua=somewhere so that feedback can be seen to be sent, or is there an 
expectation that you'll also improve your authentication coverage? If 
the latter, you'll almost certainly need to implement DKIM too.

- Roland

On 01/28/2014 08:32 PM, George Moje wrote:
>
> Thanks Roland. The major reason is we send bulk mailings to customers 
> and one hosted email provider in particular blacklists us. They are 
> basically demanding we do this…or something like it.
>
> *From:*Roland Turner [mailto:[email-masked]]
> *Sent:* Tuesday, January 28, 2014 12:54 AM
> *To:* George Moje; [email-masked]'
> *Subject:* Re: [dmarc-ietf] DMARC implementation Question
>
> step ahead of implementing SPF or DKIM in that it allows you to 
> discover quickly (and to monitor) whether you have serious issues with 
> your deployment.
>
> A more important question might be this: what are you aiming to 
> achieve by implementing DMARC? If you've not implemented DKIM, you 
> presumably don't have a spoofing problem at present.
>
> - Roland
>
> Please visit the following website to read the Computershare legal 
> notice: http://www.computershare.com/disclaimer/americas/en
>
> Veuillez visiter le site Web suivant afin de prendre connaissance de 
> l'avis juridique de Computershare: 
> http://www.computershare.com/disclaimer/americas/fr
>