Subject: [dmarc-ietf] ARC-16 signature domains

From: "John Levine" <[email-masked]>
Date: 27 Jul 2018 13:24:58 -0400

The ARC draft clearly says that every ARC header can be signed by
whatever domain you want.

I understand what that means technically, but I don't understand the
semantics of an ARC set where the AMS and AS are signed by different
domains.

R's,
John

---

From: Seth Blank <[email-masked]>
Date: Fri, 27 Jul 2018 10:36:41 -0700

This was just discussed in a thread with Jim Fenton last week (although
from the DNS angle).

The tl;dr is that we don't believe they'll ever be different, but there's
no technical reason to require d=/s= alignment between AS/AMS for the same
i=.

We can foresee places where separate signing domains could make sense, such
as the AS being signed by an organization, and the AMS by the service
within that organization that performed the modification. For instance, AS
d=example.com, AMS d=examplelists.com.

This seems to be something that will become clear with data: does everyone
sign with the same domains? Are there clear use cases where people want to
use different domains?

Since there was no technical reason to go either way, and requiring
alignment gave no benefit but added additional normative language to the
text, we decided to hold off and instead call out a recommendation to keep
them the same ("a receiver might treat a different domain between AS/AMS as
suspicious") in the usage guide until real world observations changed said
guidance.

On Fri, Jul 27, 2018 at 10:24 AM, John Levine <[email-masked]> wrote:

> _______________________________________________
> dmarc mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/dmarc
>

---

From: "Murray S. Kucherawy" <[email-masked]>
Date: Fri, 27 Jul 2018 10:40:31 -0700

> semantics of an ARC set where the AMS and AS are signed by different

Are you saying we should proscribe it, because its semantics are unclear?

-MSK

---

From: "John R Levine" <[email-masked]>
Date: 27 Jul 2018 14:15:47 -0400

> Are you saying we should proscribe it, because its semantics are unclear?

I'd say that all signatures in a seal SHOULD have the same domain, to make 
them easier to evaluate.

Regards,
John Levine, [email-masked], Taughannock Networks, Trumansburg NY
Please consider the environment before reading this e-mail. https://jl.ly

---

From: Seth Blank <[email-masked]>
Date: Fri, 27 Jul 2018 11:23:36 -0700

> I'd say that all signatures in a seal SHOULD have the same domain, to make

So the Usage Guide will (does?) say that. Earlier consensus was to keep
that out of the normative document because a) it doesn't affect
interoperability, b) it would be yet another requirement in an already
complex standard, and c) there are reasons this flexibility could be
valuable.

---

From: "John Levine" <[email-masked]>
Date: 27 Jul 2018 17:40:22 -0400

In article <[email-masked]> you write:
>-=-=-=-=-=-

OK, that makes sense.  It is an experiment, after all.

R's,
John