Subject: [dmarc-ietf] Clarification question on handling multiple domains in RFC5322.from (section 6.6.1)

From: "Kurt Andersen (b)" <[email-masked]>
Date: Mon, 18 Jan 2016 09:49:45 -0800

While revising the interop document, I am adding a note about the situation
with multiple domains in a syntactically correct RFC5322.from header
(section 6.6.1). The last paragraph of that section reads:
>
> The case of a syntactically valid multi-valued RFC5322.From field presents
> a particular challenge. The process in this case is to apply the DMARC
> check using each of those domains found in the RFC5322.From field as the
> Author Domain and apply the most strict policy selected among the checks
> that fail.

I realize that an earlier statement in the section defines the actual
handling to be implementation dependent, but it's not clear to me how the
advice in the last paragraph would really be applied.

Say for example that a message is received with two domains in the
RFC5322.from: test1.example and test2.example. If test1.example fails to
have an aligned, authenticated identifier but specifies p=reject while
test2.example *does* have an aligned, authenticated identifier, then it
seems to me that the message receives a DMARC pass evaluation and the
policy for test1.example is irrelevant since p=reject doesn't apply to a
message that passes DMARC.

Am I misunderstanding the recommended algorithm?

--Kurt Andersen

---

From: Tim Draegen <[email-masked]>
Date: Mon, 18 Jan 2016 13:02:50 -0500

> On Jan 18, 2016, at 12:49 PM, Kurt Andersen (b) <[email-masked]> wrote:
> 

Maybe the example of @crime.net <http://crime.net/> and @bank.com <http://bank.com/> might add clarity.  If both have a p=reject policy, and only @crime.net <http://crime.net/> successfully passes the DMARC check, it would be wise to enforce @bank.com's reject policy, no?

=- Tim

---

From: Franck Martin <[email-masked]>
Date: Tue, 19 Jan 2016 16:06:59 -0600 (CST)

Yes, you look at all the DMARC policies you can find, select the ones with the most strict policy reject>quarantine>none and if any reject policy gets a dmarc fails you reject the email... You err in the side of caution rather than permission. 

----- Original Message -----

From: "Tim Draegen" <[email-masked]> 
To: "Kurt Andersen (b)" <[email-masked]> 
Cc: [email-masked] 
Sent: Monday, January 18, 2016 10:02:50 AM 
Subject: Re: [dmarc-ietf] Clarification question on handling multiple domains in RFC5322.from (section 6.6.1) 

On Jan 18, 2016, at 12:49 PM, Kurt Andersen (b) < [email-masked] > wrote: 

Maybe the example of @ crime.net and @ bank.com might add clarity. If both have a p=reject policy, and only @ crime.net successfully passes the DMARC check, it would be wise to enforce @ bank.com 's reject policy, no? 

=- Tim 

_______________________________________________ 
dmarc mailing list 
[email-masked] 
https://www.ietf.org/mailman/listinfo/dmarc