Subject: Re: [dmarc-ietf] alignment and parsing logic as optionals

From: Vlatko Salaj <[email-masked]>
Date: Mon, 21 Apr 2014 12:37:56 -0700 (PDT)

On Monday, April 21, 2014 9:01 PM, "[email-masked]" <[email-masked]> wrote:

>> That doesn't seem to me like a shocking level of trust.
> Yes indeed, but then, the recent breaches shows too much trust
> has been sprinkled all around. Many ESP will provide you with
> dedicated IPs for your sends, this allows you to control your
> deliverability, the email security, etc... They come at a price,
> but you have what you pay for.

should i read this as: if u want DMARC 3rd party support, please
pay?

maybe we should then just forget about making DMARC an
open standard, instead just paying for proprietary solutions
in the same area. that's about much better security overall.

faulty thinking, if u ask me.

i have no problem with making a standard as flexible as possible
and let the domain owners' decide what and how much security they
like. introducing authorised alignment doesn't essentially break
DMARC. it just makes it more natural to email today and also
adds support for things we, obviously, need and use.

-- 
Vlatko Salaj aka goodone
http://goodone.tk

---

From: Steven M Jones <[email-masked]>
Date: Mon, 21 Apr 2014 14:19:08 -0700

On 04/21/2014 12:37 PM, Vlatko Salaj wrote:
> I think Franck wrote:

No, this was a concern and for many a best practice well before DMARC
arrived.

Using a large pool of vendor/ESP IP addresses leaves the sending
organization (ABC) exposed to:

- IP reputation impacted by all other customers
- Another ESP customer's account being used to send email as ABC
(depends on ESP controls)
- Security of entire ESP infrastructure versus a small subset (dev
systems, disaster recovery, etc)

In other cases it's part of a more general policy that the vendor/ESP
not use shared infrastructure when handling any of the contracting
company's (customers') data.

--S.