Subject: [Emailcore] Should rfc5322bis register an Email Authentication Method to report overall format conformance?

From: Alessandro Vesely <[email-masked]>
Date: Sat, 5 Mar 2022 15:08:45 +0100

Hi all,

perhaps I should have questioned ietf-822 about this idea.  However, since the 
standard is now being revised, perhaps it makes more sense to ask here directly.

As is well known, RFC 8601 provides ways to describe the level of trust that a 
message is considered to deserve, according to a variety of methods, in an 
Authentication-Results: (A-R) header field.  Deep down, all methods rely on the 
mail format.  However, the format itself is not reported directly.

For example, a popular DKIM filter has an option to refuse processing of a 
message if the header field count does not conform to RFC5322 Section 3.6. 
That stems from inconsistencies among different software about how to treat 
anomalies such as multiple From: fields, which can result in authenticating a 
field which is not the one displayed.[*]

What to do in such cases?  The old message just exemplified[*] had a 
cryptographically correct A-R:

Authentication-Results: sbh17.songbird.com;
     dkim=pass (1024-bit key) header.i=@isdg.net

Since then, some mail sites adopted signatures where both From: fields are 
signed, the rightful one and the illicit, currently empty one.  That way, 
adding a non-empty From: breaks the signature.  A clever trick which works but 
is not informative.  Perhaps, an A-R for that case could be conceived like so:

Authentication-Results: server.example.com;
     mail=fail multiple.from;
     dkim=policy (invalid message) header.i=@whatever.example

That would indicate the failure point correctly.  At the same time, a mail= 
method would indicate that the mail format was checked.  IMHO, that would 
contribute to mail format compliance significantly, especially when MUAs 
display the result.  The standard could even provide for mail=obs.  Not banning 
but tagging.

jm2c
Ale
-- 

[*]
https://mailarchive.ietf.org/arch/msg/ietf-dkim/KEUcXBTzh_hvNrQns1nDJoqF2FY/

---

From: "Murray S. Kucherawy" <[email-masked]>
Date: Mon, 7 Mar 2022 19:47:33 -0800

On Sat, Mar 5, 2022 at 6:09 AM Alessandro Vesely <[email-masked]> wrote:

> [...]

Using an authentication reporting mechanism to indicate something about
compliance or format checking seems a lot like scope creep to me.

-MSK, with no particular hat on

---

From: "John Levine" <[email-masked]>
Date: 7 Mar 2022 23:23:34 -0500

>compliance or format checking seems a lot like scope creep to me.

I don't know how to define a compliance metric and I'm pretty sure nobody else does, either.

For that and other reasons this is a complete non-starter.

[ replies directed to a list where this is slightly less off-topic ]

R's,
John