Subject: [dmarc-ietf] Mandatory Sender Authentication

From: "Douglas E. Foster" <[email-masked]>
Date: Mon, 3 Jun 2019 09:57:02 -0400

Our real goal needs to be mandatory sender authentication.    Any secure 
email gateway must go through these steps:
  	Source Analysis:  Filter message from unwanted sources 	Sender 
Authentication:  Filter messages that are attempting impersonation 	Content 
Analysis:  Filter messages with unwanted content 
 Content filtering always requires exceptions, and those exceptions are 
granted based on the sender.   Such exceptions are only safe and 
appropriate if the sender is verifiable.    If the exception is applied to 
an unverified sender, it is possible for a spamming impersonator to gain 
the elevated trust and reduced filtering which was only intended for the 
trusted sender.
  
 So Sender Authentication needs to become mandatory:
  	Senders MUST implement SPF or DKIM,  and SHOULD implement both.  
Although the MX list becomes a default SPF list for those who do not 
publiish a policy. 	MTAs MUST ensure that DKIM signatures remain 
verifiable.  If they are unwilling or uinable to do so, they should reject 
the message with a PermError. 	Forwarders MUST either forward with breaking 
DKIM signatures, rewrite messages under their own identity, refuse the 
message, or discard the message as spam. 	IETF MUST provide a way for 
intermediate systems (both spam filters and list fowarders) to insert 
content under their own signature, without breaking original signatures.    
This will have implications for MUAs. 
 Sure it will be hard, but has this not been what you have been trying to 
achieve for 15 years?  SPF and DKIM provided the enabling technology, but 
they were deployed as sender options.
  
 Doug Foster

---

From: Seth Blank <[email-masked]>
Date: Mon, 3 Jun 2019 16:12:10 +0200

> email gateway must go through these steps:

Our goal is defined in our charter:
https://datatracker.ietf.org/doc/charter-ietf-dmarc/

>
>    1. Source Analysis:  Filter message from unwanted sources
>    2. Sender Authentication:  Filter messages that are attempting
>    impersonation
>    3. Content Analysis:  Filter messages with unwanted content
>
>
1 and 3 are out of scope for this group's work. For 2, DMARC, and tweaks to
SPF and DKIM to support DMARC, and this group's focus. Right now, we're
working on a standards track version of DMARC.

To your notes about sender authentication needing to become mandatory, do
you have any recommendations on items that make this difficult for senders
that should be addressed as part of the DMARCbis process? We had a call for
these items that closed on 5/24, but welcome other feedback.

Seth