Subject: Re: [dmarc-ietf] [Request] Presentation in IETF101

From: Shoko YONEZAWA <[email-masked]>
Date: Mon, 16 Apr 2018 13:19:33 +0900

Dear all,

In IETF 101, Genki gave a presentation about "virtual DMARC."

https://datatracker.ietf.org/meeting/101/materials/slides-101-dmarc-virtual-dmarc-dmarc-verification-without-record-definitions-00
https://datatracker.ietf.org/doc/draft-akagiri-dmarc-virtual-verification/

Here is an implementation of virtual DMARC,
based on a milter program YENMA.

https://github.com/lepidum/yenma/tree/vDMARC

Your trial use and feedback are appreciated.

Thank you for your comments on virtual DMARC.
We know there are a lot of things to be considered.
Further comments are welcome.

Best regards,
Shoko

On 2018/03/20 18:35, Kurt Andersen (b) wrote:
> On Mon, Mar 19, 2018 at 7:14 PM, Steven M Jones <[email-masked] 
> <mailto:[email-masked]>> wrote:
> 
>     I want to thank Yasutaka san for presenting the Virtual DMARC
>     proposal. I believe the situation he and his colleagues are
>     addressing would benefit from more attention.
> 
>     Aside from changes to the "dmarc=" allowed values in
>     Authentication-Results: - and I think this echos a point made during
>     the session - the underlying issue seems to be the use of
>     DMARC-style alignment checks in the absence of a DMARC policy record.
> 
> 
> In some hallway discussion after the session yesterday, we discussed the 
> assertion (made during the meeting) that all of the necessary 
> information to evaluate alignment is already present within the headers 
> on a message. While that is true for the initial receiver, there are 
> scenarios for intermediated mail where the 5322.From may be modified 
> (for instance, SRS processing) and as such, the alignment of the 
> original message may not be able to be deduced by downstream MTAs. It 
> may be worthwhile to consider earmarking the 5322.From domain into ARC's 
> AAR header to cover such a scenario. Whether that information should 
> also be recorded into the A-R header is less clear.
> 
> I think it is pretty clear that this is not and can not be "DMARC" 
> without sender participation, but alignment of identifiers can certainly 
> be recorded for downstream usage.
> 
> --Kurt
> 
> 
> 
> _______________________________________________
> dmarc mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/dmarc
>

---

From: Kazunori ANDO <[email-masked]>
Date: Tue, 17 Apr 2018 15:07:52 +0900

+1.

I think "virtual DMARC" is out of DMARC scope,
because it's a purely internal policy decision.

On 2018/03/20 6:17, Scott Kitterman wrote:
> Fundamentally, both SPF "Best Guess" and "Virtual DMARC" destroy the opt-in
> nature of SPF and DMARC and should be considered harmful. If an entity wants 
> to apply this kind of test, it's a purely internal policy decision.  No RFC 
> needed.-- 
Kazunori ANDO / [email-masked]

---

From: Steve Atkins <[email-masked]>
Date: Tue, 17 Apr 2018 08:41:52 -0700

> On Apr 16, 2018, at 11:07 PM, Kazunori ANDO <[email-masked]> wrote:
> 

+1 for the (not entirely unreasonable, but entirely internal) algorithm used, -1 for the terminology.

Where it's in scope is that it's using the term DMARC for something that is really not DMARC and as part of that it seems to suggest squatting on the dmarc= namespace in Authentication-Results. 

On 2018/03/20 6:17, Scott Kitterman wrote:
> nature of SPF and DMARC and should be considered harmful.

+1

Again, please don't do this.

Cheers,
  Steve

---

From: Dave Crocker <[email-masked]>
Date: Tue, 17 Apr 2018 08:59:29 -0700

+1, for all of the below.

d/

-- 
Dave Crocker
Brandenburg InternetWorking
bbiw.net

---

From: Shoko YONEZAWA <[email-masked]>
Date: Thu, 26 Apr 2018 16:38:29 +0900

My opinion is that there seems no trouble
in the case that the receiver issues dmarc=pass to the mail,
whose domain has no DMARC record,
and which is determined dmarc=pass even if DMARC record exists.

In such case, dmarc=pass will be issued for any DMARC record
where "strict" decision policy is set.

Shoko

On 2018/04/18 0:59, Dave Crocker wrote:
>> Where it's in scope is that it's using the term DMARC for something 
>> that is really not DMARC and as part of that it seems to suggest 
>> squatting on the dmarc= namespace in Authentication-Results.
>>

-- 
Shoko YONEZAWA
Lepidum Co. Ltd.
[email-masked]
TEL: +81-3-6276-5103

---

From: "Yasutaka, Genki | Dkim | OPS" <[email-masked]>
Date: Thu, 26 Apr 2018 09:49:46 +0000

My understanding is that we have received some comments so far against Virtual DMARC.

The main comments are as follows:
- DKIM has opt-in nature.
- DMARC is composed by policy and reporting, but Virtual DMARC does not have reporting.
- Receivers can work this kind of operations using logs as they like.

Regards,
Genki

---
Genki YASUTAKA
Rakuten, Inc.
Mail: [email-masked]

-----Original Message-----
From: dmarc [mailto:[email-masked]] On Behalf Of Shoko YONEZAWA
Sent: Thursday, April 26, 2018 4:38 PM
To: [email-masked]
Subject: Re: [dmarc-ietf] [Request] Presentation in IETF101

My opinion is that there seems no trouble in the case that the receiver issues dmarc=pass to the mail, whose domain has no DMARC record, and which is determined dmarc=pass even if DMARC record exists.

In such case, dmarc=pass will be issued for any DMARC record where "strict" decision policy is set.

Shoko

On 2018/04/18 0:59, Dave Crocker wrote:
>>> I think "virtual DMARC" is out of DMARC scope, because it's a purely 
>>> internal policy decision.
>>
>>> Fundamentally, both SPF "Best Guess" and "Virtual DMARC" destroy the 
>>> opt-in nature of SPF and DMARC and should be considered harmful.
>>
>> +1
>>

--
Shoko YONEZAWA
Lepidum Co. Ltd.
[email-masked]
TEL: +81-3-6276-5103

---

From: Takehito Akagiri <[email-masked]>
Date: Thu, 26 Apr 2018 21:19:48 +0900 (JST)

Hi, 

> DKIM has opt-in nature.

If opt-in means that DMARC record exists, our proposal is to change this opt-in nature because, as Shoko mentioned, virtual DMARC only focuses on the case which is obviously determined PASS.

No one will not be in troubled, so I think we can modify about that.
If not, I would like to know the specific situation. 

> Receivers can work this kind of operations using logs as they like.

Yes, receivers can do by themselves if they do not care about the compliance with RFC7489.
It specifies that the receiver adds dmarc=none in case there is no DMARC record,
while dmarc=pass will be added if DMARC record exists.
So I think we should discuss this contradiction.

---From RFC7489--
11.2.  Authentication-Results Result Registry Update
   IANA has added the following in the "Email Authentication Result
   Names" registry:
   Code:  none
   Existing/New Code:  existing
   Defined:  [AUTH-RESULTS]
   Auth Method:  dmarc (added)

   Meaning:  No DMARC policy record was published for the aligned
      identifier, or no aligned identifier could be extracted.
----

> DMARC is composed by policy and reporting, but Virtual DMARC does not have reporting.

Is it acceptable to introduce the new AR code, such as dmarc=SoftPass,
and add it if no reporting policy is published ?
With this new code, one can distinguish DMARC with reporting from DMARC without reporting.
# In the current I-D, it specifies as PASS.

To summarize, 
1. Whether DMARC always requires opt-in
2. Whether dmarc=none is appropriate for the case where there is no DMARC record
3. Whether reporting is mandatory for DMARC

Best regards,
--Takehito Akagiri

----- 元のメッセージ -----
差出人: "Yasutaka, Genki | Dkim | OPS" <[email-masked]>
宛先: "Shoko YONEZAWA" <[email-masked]>, [email-masked]
Cc: "Yasutaka, Genki | Dkim | OPS" <[email-masked]>
送信済み: 2018年4月26日, 木曜日 午後 6:49:46
件名: Re: [dmarc-ietf] [Request] Presentation in IETF101

Regards,
Genki

---
Genki YASUTAKA
Rakuten, Inc.

-----Original Message-----
From: dmarc [mailto:[email-masked]] On Behalf Of Shoko YONEZAWA
Sent: Thursday, April 26, 2018 4:38 PM
To: [email-masked]
Subject: Re: [dmarc-ietf] [Request] Presentation in IETF101

Shoko

--
Shoko YONEZAWA
Lepidum Co. Ltd.
[email-masked]
TEL: +81-3-6276-5103