Subject: [dmarc-ietf] Google and ARC status

From: Brandon Long <[email-masked]>
Date: Tue, 19 Sep 2017 14:56:44 -0700

Google is now using ARC results for local policy DMARC passes.  This should
be visible in your DMARC rua reports as "arc=pass" in the local policy
comment field.

This should replace most instances in your reports of xoar=pass.  There are
still some cases where xoar passes and arc does not, mostly because xoar is
always the last hop and replaces any existing one, so it works in cases
where the arc chain breaks.

Ie, arc would need the ability to restart broken chains to be equivalent,
though it's not clear that the extra covered cases would be that useful,
definitely edge cases.

If/when some other major sites like ietf.org enable arc signing, we can add
them to the whitelist.

Automated trust is going to require a larger rollout to be effective, and
we haven't started working on that yet.

Brandon

---

From: Brandon Long <[email-masked]>
Date: Tue, 19 Sep 2017 16:57:33 -0700

And again from my non-Google account, hoping I didn't get people kicked off
the list again....

On Tue, Sep 19, 2017 at 2:56 PM, Brandon Long <[email-masked]> wrote:

> Google is now using ARC results for local policy DMARC passes.  This
> should be visible in your DMARC rua reports as "arc=pass" in the local
> policy comment field.
>
> This should replace most instances in your reports of xoar=pass.  There
> are still some cases where xoar passes and arc does not, mostly because
> xoar is always the last hop and replaces any existing one, so it works in
> cases where the arc chain breaks.
>
> If/when some other major sites like ietf.org enable arc signing, we can
> add them to the whitelist.
>