Subject: Re: [dmarc-ietf] Change the mailing list protocol, not DMARC.

From: Elizabeth Zwicky <[email-masked]>
Date: Thu, 12 Jun 2014 19:33:03 +0000

On 6/12/14, 9:36 AM, "Terry Zink" <[email-masked]> wrote:

>> Franck Martin wrote:
>> 
>> I found that to build the override list for mailing list, I could log
>>DMARC rejected 
>> emails that contained a List-Id or List-Post header. Once reviewing the
>>logs 
>> (once a week, or once a month), you can make an easy decision if you
>>want to 
>> add the found IPs into your override list.
>
>That was my thinking, too.
>
>I like the idea of DKIM-Delegate but if I had to choose between doing
>Franck's whitelist [1] suggestion above, or DKIM-Delegate, I'd probably
>do the whitelist because it's less code to implement and maintain; as
>someone who fights spam we're already in the business of checking logs
>looking for patterns and doing overrides and so this would simply be one
>more pattern to look for.

Building your whitelist is a fine thing, but it doesn't replace a real
solution to allowing mail to be forwarded.

DKIM-Delegate gives you a hope of controlling whether your mail gets
accepted at other sites.
Figuring out who to whitelist at your site doesn't. And using List-Id or
List-Post only lets
you whitelist mailing lists, which are only part of the forwarder problem
-- there are also all the non-transparent forwarders (for instance,
enterprise systems which do malware filtering on mail).

	Elizabeth

>
>-- Terry
>
>[1] whitelist = override the DMARC p=reject/quarantine action, not skip
>all filtering
>
>_______________________________________________
>dmarc mailing list
>[email-masked]
>https://www.ietf.org/mailman/listinfo/dmarc

---

From: "Murray S. Kucherawy" <[email-masked]>
Date: Thu, 12 Jun 2014 12:53:44 -0700

> >> add the found IPs into your override list.

The problem there is that not all lists use the List-* fields.

You also have a period of time between which a user wants to start using a
list and the whitelisting of the list (once a week, or once a month); in
between, you get the problem we have now.

It also presumes the list sends at least weekly or monthly; many don't.
(For example, how many ietf.org lists exist but are largely dormant?)

-MSK

---

From: Matt Simerson <[email-masked]>
Date: Thu, 12 Jun 2014 13:05:00 -0700

> enterprise systems which do malware filtering on mail).

And those system are going to do malware filtering on the message *body* and then expect to pass along the message to the recipient?

/cough cough.

I'm not sure we need to be considerate of such behavior. If it's malware, reject it outright. If it contains forbidden content, reject the message outright and let the recipient know why. I know this is exactly how [at least portions of] the DoD handle it.

Matt

---

From: "Stephen J. Turnbull" <[email-masked]>
Date: Fri, 13 Jun 2014 09:04:25 +0900

Matt Simerson writes:

 > I'm not sure we need to be considerate of such behavior. If it's
 > malware, reject it outright.

Can't do that.  Many viruses attach themselves to legitimate messages.
If the author is the boss, rejecting it would be, uh, bad.

Steve

---

From: Matt Simerson <[email-masked]>
Date: Thu, 12 Jun 2014 17:22:55 -0700

> If the author is the boss, rejecting it would be, uh, bad.

Wow. We live in very different worlds.

Matt

---

From: Franck Martin <[email-masked]>
Date: Thu, 12 Jun 2014 20:31:47 -0500 (CDT)

Printed on recycled paper!

> On Jun 12, 2014, at 21:54, "Murray S. Kucherawy" <[email-masked]> wrote:
> 
>> On Thu, Jun 12, 2014 at 12:33 PM, Elizabeth Zwicky <[email-masked]> wrote:
>> 
>> 

Well, if they don't use these headers, I don't think they would make any other modification for any upcoming scheme.

> 
> You also have a period of time between which a user wants to start using a list and the whitelisting of the list (once a week, or once a month); in between, you get the problem we have now.
> 
> It also presumes the list sends at least weekly or monthly; many don't.  (For example, how many ietf.org lists exist but are largely dormant?)
> 
> -MSK
> 
Sure, this is a stop gap. A solution for today, useable today.

Better scalable solution seems to emerge...

---

From: "Stephen J. Turnbull" <[email-masked]>
Date: Fri, 13 Jun 2014 11:31:36 +0900

Franck Martin writes:

 > Well, if they don't use these headers, I don't think they would
 > make any other modification for any upcoming scheme.

I don't think that's a good heuristic.  Most of the schemes we're
talking about here are implemented in the MTA, and the MTA is often
administered by somebody different from the mailing list.

---

From: "John Levine" <[email-masked]>
Date: 14 Jun 2014 18:40:40 -0000

>If the author is the boss, rejecting it would be, uh, bad.

I don't think I've seen malware attached to a real message in the past
decade.  When's the last one you got?

On the other hand, there are certainly plenty of mailing lists that
strip out attachments, which poses the same problem.

R's,
John

---

From: "Stephen J. Turnbull" <[email-masked]>
Date: Sun, 15 Jun 2014 15:36:22 +0900

> decade.  When's the last one you got?

Mid-March or so, from a Chinese student returned home for the spring
holiday.  China's Internet is still pretty woolley, my students tell
me.

 > strip out attachments, which poses the same problem.

Sure, but that's easier for the hard-core "don't touch the message"
types to justify changing list practice (see subject).  I wanted to
cover several use cases for stripping MIME parts, not just traditional
list practice.