Subject: Re: [dmarc-ietf] Just posted dmarc-arc-protocol-03 . . .

From: Brandon Long <[email-masked]>
Date: Tue, 2 May 2017 16:59:01 -0700

On Fri, Apr 28, 2017 at 4:04 PM, Kurt Andersen (b) <[email-masked]> wrote:

> Based on the dialog around the AAR header unclarity in section 5.1.3, I
> adjusted the first paragraph to read:
>
> ARC-Authentication-Results is a copy of the Authentication-Results header
>> field [RFC7601] value with the corresponding ARC-set instance (“i=”) tag
>> value prefixed to the Authentication-Results value string. Since
>> Authentication-Results headers are frequently deleted from a message’s
>> header list, the AAR is created for archival purposes by each
>> ARC-participating ADMD outside of the trust boundary of the originating
>> system.
>
>
"frequently deleted"... In fact, RFC 7601 section 5 "Removing Existing
Header Fields" recommends it:

"For security reasons, any MTA conforming to this specification MUST
delete any discovered instance of this header field that claims, by
virtue of its authentication service identifier, to have been added
within its trust boundary but that did not come directly from another
trusted MTA."

and has other advice as well... as well as a hint at doing what ARC now
codifies:
"It is entirely possible that a border
MTA for example.com will explicitly trust authentication results
asserted by upstream host example.net even though they exist in
completely disjoint administrative boundaries.  In that case, the
border MTA MAY elect not to delete those results; moreover, the
upstream host doing some authentication work could apply a signing
technology such as [DKIM] on its own results to assure downstream
hosts of their authenticity.  An example of this is provided in
Appendix B."

Should we reference this directly?

---

From: "Kurt Andersen (b)" <[email-masked]>
Date: Wed, 3 May 2017 09:21:35 -0700

On Tue, May 2, 2017 at 4:59 PM, Brandon Long <[email-masked]> wrote:

>>> field [RFC7601] value with the corresponding ARC-set instance (“i=”)
>>> tag value prefixed to the Authentication-Results value string. Since

Yes, I think that referring to this is reasonable (in the protocol doc).

> asserted by upstream host example.net . . .
>

Seems like a reasonable thing to put into the usage doc. I'm working on
some explanations about ARC vs. ADMDs for said document at this time and
will add this reference.

--Kurt