Subject: Re: [dmarc-ietf] What if... Sender:

From: "Douglas E. Foster" <[email-masked]>
Date: Wed, 24 Jun 2020 19:12:00 -0400

If DMARC settles on Sender, what tool will validate the relationship between Sende and From?

On Jun 24, 2020 2:53 PM, Dave Crocker <[email-masked]> wrote:On 6/24/2020 11:35 AM, Jim Fenton wrote:
> On 6/23/20 9:19 PM, Dave Crocker wrote:
>> On 6/23/2020 4:14 PM, Jim Fenton wrote:
>>> I do have a concern about Sender:. It has existing semantics defined in
>>> RFC 5322 Section 3.6.2, and this proposal might conflict with that
>>
>> I don't think it conflicts at all. So it will help for you to explain 
>> your concern in detail.
>
> Quoting RFC 5322 Section 3.6.2:
>
>> For example, if a secretary were to send a message for
>>     another person, the mailbox of the secretary would appear in the
>>     "Sender:" field and the mailbox of the actual author would appear in
>>     the "From:" field.
> and
>
>> If the from
>>     field contains more than one mailbox specification in the mailbox-
>>     list, then the sender field, containing the field name "Sender" and a
>>     single mailbox specification, MUST appear in the message.

> In the latter example, the From: header field could contain addresses 
> from different domains, and the Sender: header field would indicate 
> which of them actually sent the message.

Not 'which of them', but 'who'.  The point of the second quoted text is 
to mandate a separate Sender:, when the From: contains more than one 
address.  But it does not specify a different semantic for Sender:

> If either message in question goes to a mediator, the Sender address 
> in the original message would be lost and replaced by the email 
> address of the mediator, and the original information would be lost. 
> I'm not sure if that's a significant problem in practice, but pointing 
> out the possible conflict with currently specified usage.
>
One can indeed imagine a scenario where it matters, but no, it's not 
likely. In any event, the mediator is posting a new message and has a 
'right' to retain or modify whatever it wishes.

So if this is the 'conflict' you see, I'll disgree.  Rather:

      Replacing Sender: is vastly better than modifying From:.

      That's the entire motivation for my suggesting DMARC switch to 
Sender:.

> Please explain why it is important that specifically the Sender: 
> header field be used for this.
>
From: is demonstrably problematic.  Sender: isn't.

Sender: is a long-standing field, similar to From:, but without it's 
history of interesting MUA-level use that DMARC is well-established as 
creating problems for.

d/

-- 
Dave Crocker
Brandenburg InternetWorking
bbiw.net

_______________________________________________
dmarc mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/dmarc

---

From: Dave Crocker <[email-masked]>
Date: Wed, 24 Jun 2020 16:13:03 -0700

> If DMARC settles on Sender, what tool will validate the relationship 

None.

Please explain why you think it has to.  Not in terms of theory but in 
terms of observable practice.

d/