Subject: [dmarc-ietf] Indirect email flows

From: Elizabeth Zwicky <[email-masked]>
Date: Mon, 10 Nov 2014 19:25:56 +0000 (UTC)

OK, so I've dived into Yahoo's incoming metadata to look at what fails DMARC and why. Conclusion 1: I cannot automatically tell the cases apart with any accuracy. Hand coding them is so time-consuming as to be beyond my ability to do at scale.
So, not many numbers, but I have developed some very educated opinions, which unfortunately take a small novel to explain.
First, transactional domains tend to have some mail that fails DMARC because of forwarding. The highest estimate of that I've seen is about 1.5% (that's not data I ran); on the domains I've looked at so far I saw rates well below 0.1%. Still, that's people not getting their mail. For transactional mail, this is a strong majority forwarding (as in I send mail to [email-masked] and it delivers to [email-masked]), and it's dominated by educational institutions forwarding to their students/alumni, followed by hosting services and ISPs. The reasons for the forwarding breaking the signatures clearly vary; there are popular mail systems that, for instance, re-mime-encode bodies, or add signature files of various sorts, ranging from notifications that the message has been virus scanned to ads for the ISP forwarding the mail. Re-encoding things can result in intermittent breakage, where some forwarding works (because the forwarder doesn't feel the need to fix it) and other messages don't. A minority is not straightforward, my old address routes to my new one, forwarding, but are services that are specialized to handling mail -- third party spam filtering or mail classification products that then redeliver mail. They don't make up a big percentage of the cases but they are notable as cases that presumably would be able to change their handling if we provided them with options.
Then we get to end-user domains. Although I've heard from corporate domains where DMARC breakage is actually lower for the humans than the transactional mail, for the big mailbox holders, as far as I can tell, the expected ratios hold; more mail fails for end-users than for transactional mail. How much more? That gets interesting.
For the domains at p=reject, the mail that arrives with an aligned DKIM signature still on it, but not working -- which is the common case for both forwarding and mailing lists -- is significantly under 1%. For the domains at p=none, that comes closer to 2%. That difference is partly in mailing lists, but, sadly, a noticeable amount of the difference between p=reject and p=none domains when it comes to the mailing list mail is spam from a few, mostly commercial, mailing list providers. It is clear that a number of valid, happy mailing lists you might like have chosen to move subscribers from p=reject to p=none providers, with mixed success; the high volume ones I've checked still have p=reject posters, at low rates. It is also clear that a lot of educational institutions *both* run popular, DKIM-breaking forwarders *and* run popular, DKIM-breaking mailing lists (and, unsurprisingly, have alumni who go through both at once), which is one way that these things rapidly become intractable for automated processing. 
For everybody, way more mail shows up with no aligned DKIM signature on it than with a broken aligned DKIM signature on it, and no noticeable amount of that mail had a DKIM signature stripped off. In fact, for every domain I looked at, the single largest cause of DMARC fail is purely forged mail, mostly spam. The rate of messages with no aligned DKIM signature ranged from 88% (for a mailbox domain with p=none) to 2% (for a transactional domain with p=reject). For transactional domains, that mail is not readily distinguishable from pure trash. There must be a DKIM-stripping forward out there somewhere, but I haven't found it. For end-user domains, once you ignore forged spam, the major volume contributors are hosting sites, but again, the use-cases are mixed. The highest volume from hosting sites is spam. The next highest is email to site owners "From:" themselves. There are a lot of people out there not getting mail from really frequent cron jobs. Then we get bulletin boards and blog software letting you know somebody has responded to your comment, and e-commerce solutions letting you know that somebody wants to order something -- all of that shows up in one big jumble from the hosting providers. 
Next we get "parental control" software and other monitoring uses that send From: and To: the same address and are verbose. And large service providers for small businesses.
After that, it's the land of a million different indirect uses. More e-commerce sites. The people who send you happy birthday messages from your dentist, who uses a third-party account. Or your tee-time from your golf course, ditto. Or your tanning bed schedule, because there's a service out there that does nothing but email handling for tanning salons. Printers. Security equipment. A surprising number of government agencies, including one national nuclear agency sending mail to: and from: the same person when replying to document requests or using a free email account to do government business. Services for multi-level marketing plans and other sell-to-your-friends plans. Oh, so many services for realtors. Lots of mail-to-friend features. Some of which (the ones with the most volume) are being abused for spam.
    Elizabeth
    [email-masked]

---

From: Scott Kitterman <[email-masked]>
Date: Mon, 10 Nov 2014 16:57:05 -0500

On Monday, November 10, 2014 07:25:56 PM Elizabeth Zwicky wrote:
> OK, so I've dived into Yahoo's incoming metadata to look at what fails DMARC
> and why. Conclusion 1: I cannot automatically tell the cases apart with any
> accuracy. Hand coding them is so time-consuming as to be beyond my ability
> to do at scale. So, not many numbers, but I have developed some very
> educated opinions, which unfortunately take a small novel to explain.
> First, transactional domains tend to have some mail that fails DMARC
> because of forwarding. The highest estimate of that I've seen is about 1.5%
> (that's not data I ran); on the domains I've looked at so far I saw rates
> well below 0.1%. Still, that's people not getting their mail. For
> transactional mail, this is a strong majority forwarding (as in I send mail
> to [email-masked] and it delivers to [email-masked]), and it's dominated by educational
> institutions forwarding to their students/alumni, followed by hosting
> services and ISPs. The reasons for the forwarding breaking the signatures
> clearly vary; there are popular mail systems that, for instance,
> re-mime-encode bodies, or add signature files of various sorts, ranging
> from notifications that the message has been virus scanned to ads for the
> ISP forwarding the mail. Re-encoding things can result in intermittent
> breakage, where some forwarding works (because the forwarder doesn't feel
> the need to fix it) and other messages don't. A minority is not
> straightforward, my old address routes to my new one, forwarding, but are
> services that are specialized to handling mail -- third party spam
> filtering or mail classification products that then redeliver mail. They
> don't make up a big percentage of the cases but they are notable as cases
> that presumably would be able to change their handling if we provided them
> with options. Then we get to end-user domains. Although I've heard from
> corporate domains where DMARC breakage is actually lower for the humans
> than the transactional mail, for the big mailbox holders, as far as I can
> tell, the expected ratios hold; more mail fails for end-users than for
> transactional mail. How much more? That gets interesting. For the domains
> at p=reject, the mail that arrives with an aligned DKIM signature still on
> it, but not working -- which is the common case for both forwarding and
> mailing lists -- is significantly under 1%. For the domains at p=none, that
> comes closer to 2%. That difference is partly in mailing lists, but, sadly,
> a noticeable amount of the difference between p=reject and p=none domains
> when it comes to the mailing list mail is spam from a few, mostly
> commercial, mailing list providers. It is clear that a number of valid,
> happy mailing lists you might like have chosen to move subscribers from
> p=reject to p=none providers, with mixed success; the high volume ones I've
> checked still have p=reject posters, at low rates. It is also clear that a
> lot of educational institutions *both* run popular, DKIM-breaking
> forwarders *and* run popular, DKIM-breaking mailing lists (and,
> unsurprisingly, have alumni who go through both at once), which is one way
> that these things rapidly become intractable for automated processing. For
> everybody, way more mail shows up with no aligned DKIM signature on it than
> with a broken aligned DKIM signature on it, and no noticeable amount of
> that mail had a DKIM signature stripped off. In fact, for every domain I
> looked at, the single largest cause of DMARC fail is purely forged mail,
> mostly spam. The rate of messages with no aligned DKIM signature ranged
> from 88% (for a mailbox domain with p=none) to 2% (for a transactional
> domain with p=reject). For transactional domains, that mail is not readily
> distinguishable from pure trash. There must be a DKIM-stripping forward out
> there somewhere, but I haven't found it. For end-user domains, once you
> ignore forged spam, the major volume contributors are hosting sites, but
> again, the use-cases are mixed. The highest volume from hosting sites is
> spam. The next highest is email to site owners "From:" themselves. There
> are a lot of people out there not getting mail from really frequent cron
> jobs. Then we get bulletin boards and blog software letting you know
> somebody has responded to your comment, and e-commerce solutions letting
> you know that somebody wants to order something -- all of that shows up in
> one big jumble from the hosting providers. Next we get "parental control"
> software and other monitoring uses that send From: and To: the same address
> and are verbose. And large service providers for small businesses. After
> that, it's the land of a million different indirect uses. More e-commerce
> sites. The people who send you happy birthday messages from your dentist,
> who uses a third-party account. Or your tee-time from your golf course,
> ditto. Or your tanning bed schedule, because there's a service out there
> that does nothing but email handling for tanning salons. Printers. Security
> equipment. A surprising number of government agencies, including one
> national nuclear agency sending mail to: and from: the same person when
> replying to document requests or using a free email account to do
> government business. Services for multi-level marketing plans and other
> sell-to-your-friends plans. Oh, so many services for realtors. Lots of
> mail-to-friend features. Some of which (the ones with the most volume) are
> being abused for spam. Elizabeth
>     [email-masked]

Thanks for the insights.  

For my one tiny domain (that gets used in email), I'm doing p=none because the 
legitimate mail is 1% DMARC pass and 99% DMARC fail[1] because of mailing 
lists and various web based systems I use (mostly bug trackers for free 
software projects).

Scott K

[1] This is, of course, not the ratio of messages I send.  Mailing list fails 
get counted once per subscriber and at the big mailbox provider that can be a 
lot.

---

From: Brett McDowell <[email-masked]>
Date: Wed, 12 Nov 2014 14:47:58 -0500

> > being abused for spam. Elizabeth

+1

Thank you for this analysis.

And, of course, I would have never seen this text if Scott hadn't
replied-to-all.

---

From: Franck Martin <[email-masked]>
Date: Wed, 12 Nov 2014 14:59:13 -0600 (CST)

----- Original Message -----

> From: "Brett McDowell" <[email-masked]>
> To: "Scott Kitterman" <[email-masked]>
> Cc: "dmarc" <[email-masked]>
> Sent: Wednesday, November 12, 2014 9:47:58 AM
> Subject: Re: [dmarc-ietf] Indirect email flows

> On Mon, Nov 10, 2014 at 4:57 PM, Scott Kitterman < [email-masked] >
> wrote:

> And, of course, I would have never seen this text if Scott hadn't

Could I request the list admins, to drop the subject tagging and the footer on this list? And if possible remove the removal of the HTML? 

Thanks.

---

From: Steve Atkins <[email-masked]>
Date: Wed, 12 Nov 2014 13:32:12 -0800

On Nov 12, 2014, at 12:59 PM, Franck Martin <[email-masked]> wrote:

> On Mon, Nov 10, 2014 at 4:57 PM, Scott Kitterman <[email-masked]> wrote:
> And, of course, I would have never seen this text if Scott hadn't replied-to-all.
> 

-1

Let's not damage the functionality of the mailing list to work around a few subscribers who are violating their employers email usage policies.

Cheers,
  Steve

---

From: Matt Simerson <[email-masked]>
Date: Wed, 12 Nov 2014 13:36:39 -0800

+1

Matt

---

From: Brett McDowell <[email-masked]>
Date: Wed, 12 Nov 2014 17:48:46 -0500

On Wed, Nov 12, 2014 at 4:36 PM, Matt Simerson <[email-masked]> wrote:

> >> Could I request the list admins, to drop the subject tagging and the
> footer on this list? And if possible remove the removal of the HTML?
>
> +1

The mailing list is here as a tool to facilitate communication between the
participants.  We have a few (very valuable) participants who are employed
by early adopters of DMARC protection, like Yahoo and Google.  We all know
that MLM's configured in traditional ways and subscribers using domains
protected by DMARC, don't mix.  That's why we are here, to try and "fix"
this problem (among others).  In the meantime we have to pick between the
lesser of two evils.  We either (a) ask subscribers to not use email
addresses protected by DMARC policies or (b) change the default
configurations of this mailing list.

Personally, I don't know which of those two is the least painful
compromise.  It is easy for me to use my @gmail.com account instead of my
DMARC-protected @brettmcdowell.com account.  Maybe that's not so easy for
others, I don't know.  But if we choose option (a) and that results in less
effective participation from Yahoo! or Google, then (a) would be the wrong
choice IMHO.

---

From: "John Levine" <[email-masked]>
Date: 13 Nov 2014 00:13:14 -0000

>>> Could I request the list admins, to drop the subject tagging and the footer on
>this list? And if possible remove the removal of the HTML?

Every IETF list I subscribe to, which is a lot of them, is set up the
same way with subject tags, message footers, and flattened text.
There is no more reason to screw up this list due to DMARC breakage
than any of the other lists, and I can assure you that the chance that
all of the IETF's lists will change rounds to zero, out to perhaps six
places past the decimal point.

If the IETF's e-mail is important to you, you all know at least six
ways to arrange to receive it.

R's,
John

---

From: Miles Fidelman <[email-masked]>
Date: Wed, 12 Nov 2014 19:22:24 -0500

Brett McDowell wrote:
>
> On Wed, Nov 12, 2014 at 4:36 PM, Matt Simerson <[email-masked] 
> <mailto:[email-masked]>> wrote:
>
>     > On Nov 12, 2014, at 12:59 PM, Franck Martin <[email-masked] <mailto:[email-masked]>>
>     wrote:
>     >
>     >> Could I request the list admins, to drop the subject tagging and the footer on this list?
>     And if possible remove the removal of the HTML?
>
>     +1
>
>
> The mailing list is here as a tool to facilitate communication between 
> the participants.  We have a few (very valuable) participants who are 
> employed by early adopters of DMARC protection, like Yahoo and 
> Google.  We all know that MLM's configured in traditional ways and 
> subscribers using domains protected by DMARC, don't mix.  That's why 
> we are here, to try and "fix" this problem (among others).  In the 
> meantime we have to pick between the lesser of two evils. We either 
> (a) ask subscribers to not use email addresses protected by DMARC 
> policies or (b) change the default configurations of this mailing list.
>
> compromise.  It is easy for me to use my @gmail.com <http://gmail.com> 
> account instead of my DMARC-protected @brettmcdowell.com 
> <http://brettmcdowell.com> account.  Maybe that's not so easy for 
> others, I don't know. But if we choose option (a) and that results in 
> less effective participation from Yahoo! or Google, then (a) would be 
> the wrong choice IMHO.
>

One might consider that option (a) provides a continual reminder to 
those at Yahoo and Google of the reason we really need to address the 
issue. :-)

Miles Fidelman

---

From: Franck Martin <[email-masked]>
Date: Wed, 12 Nov 2014 18:22:14 -0600 (CST)

----- Original Message -----
> From: "Steve Atkins" <[email-masked]>
> To: "dmarc" <[email-masked]>
> Sent: Wednesday, November 12, 2014 11:32:12 AM
> > Could I request the list admins, to drop the subject tagging and the footer
> > on this list? And if possible remove the removal of the HTML?
> 
> -1
> 
> Let's not damage the functionality of the mailing list to work around a few
> subscribers who are violating their employers email usage policies.
> 

I'm just asking for this list to be set up exactly like the [email-masked] list. If Elizabeth ensures she emails in txt only, everything will be fine.

---

From: Tim Draegen <[email-masked]>
Date: Wed, 12 Nov 2014 14:33:54 -1000

> On Nov 12, 2014, at 10:59 AM, Franck Martin <[email-masked]> wrote:
> 

No.

---

From: "Murray S. Kucherawy" <[email-masked]>
Date: Wed, 12 Nov 2014 15:33:35 -1000

On Wed, Nov 12, 2014 at 2:22 PM, Franck Martin <[email-masked]>
wrote:

>
> I'm just asking for this list to be set up exactly like the [email-masked]
> list. If Elizabeth ensures she emails in txt only, everything will be fine.
>
>
[email-masked] is the outlier, actually.  Every other IETF list that I'm on
appears to do subject tagging.

-MSK

---

From: Franck Martin <[email-masked]>
Date: Wed, 12 Nov 2014 19:42:02 -0600 (CST)

----- Original Message -----

> From: "Murray S. Kucherawy" <[email-masked]>
> To: "Franck Martin" <[email-masked]>
> Cc: "dmarc" <[email-masked]>, "Steve Atkins" <[email-masked]>
> Sent: Wednesday, November 12, 2014 3:33:35 PM

> On Wed, Nov 12, 2014 at 2:22 PM, Franck Martin < [email-masked] >
> wrote:

> appears to do subject tagging.

Ah! times have changed...

---

From: "Stephen J. Turnbull" <[email-masked]>
Date: Thu, 13 Nov 2014 12:02:15 +0900

Brett McDowell writes:

 > But if we choose option (a) and that results in less effective
 > participation from Yahoo! or Google, then (a) would be the wrong
 > choice IMHO.

I'm all in favor of participation from Yahoo! and Google, but catering
to the destructive side of DMARC *in advance of IETF standardization*
sends exactly the wrong signal.