Subject: [dmarc-ietf] draft-levine-dkim-conditional-02

From: "John Levine" <[email-masked]>
Date: 29 Sep 2015 17:08:49 -0000

I refreshed this draft so it wouldn't expire.  Not very different,
mostly changed the @fs= to !fs= per Murray's suggestion.

I still think this is the least broken way I've seen to let
mailing lists coexist with DMARC.

R's,
John

---

From: Hector Santos <[email-masked]>
Date: Wed, 30 Sep 2015 08:52:29 -0400

> mailing lists coexist with DMARC.

I am going to look at adding support for this in our Wildcat! List 
Server package. Seems simple enough via a template system. Lets see 
how it works.

Thanks for keeping it alive.

-- 
HLS

---

From: "A. Schulze" <[email-masked]>
Date: Wed, 30 Sep 2015 17:36:04 +0200

> mailing lists coexist with DMARC.

reads like a good idea.

The local signer here must know this message goes to [email-masked]
an add a signature including "!fs=ietg.org"
So opendkim in my case has to be extended to lookup "rcpt domain" ->  
"!fs value"
Did I understand that correct?

Andreas

---

From: Dave Crocker <[email-masked]>
Date: Wed, 30 Sep 2015 08:45:24 -0700

> an add a signature including "!fs=ietg.org"

An average email author cannot be relied on to cause this setting to be
made.

There are multiple levels of knowledge and action this this setting
requires and average end-users cannot be relied to know or perform any
of them.

d/

-- 
Dave Crocker
Brandenburg InternetWorking
bbiw.net

---

From: [email-masked]
Date: Wed, 30 Sep 2015 11:11:23 -0700 (PDT)

> Thanks for keeping it alive.

FWIW, I agree that this is technology we should pursue.

				Ned

---

From: "John Levine" <[email-masked]>
Date: 1 Oct 2015 00:39:06 -0000

>An average email author cannot be relied on to cause this setting to be

Quite correct.  I would expect conditional signatures to be applied by
large mail systems, using their private list of domains that look like
mailing lists to decide who gets them.

>From the past couple of years of discussion, it is clear that all of
the large mail systems already have such a list of domains, so the
implementation should be straightforward.

Small domains may not, in which case there's a variety of ways they
could approximate it, e.g., sniff incoming mail for stuff that looks
like list mail to create a list, cooperate on a shared database of
mailing list domains, or most likely admit that they are too small to
be phish targets so publishing a DMARC policy is counterproductive.

R's,
John

---

From: Dave Crocker <[email-masked]>
Date: Wed, 30 Sep 2015 17:43:57 -0700

On 9/30/2015 5:39 PM, John Levine wrote:
> I would expect conditional signatures to be applied by

Some degree of documenting this requirement and its plausible
solution(s) is called for, in order to establish that the model being
pursued here has a reasonable chance of being viable.

d/

---

From: "John R Levine" <[email-masked]>
Date: 30 Sep 2015 20:49:36 -0400

> pursued here has a reasonable chance of being viable.

I'll try and collect some data at MAAWG next month and rev the draft.

Regards,
John Levine, [email-masked], Taughannock Networks, Trumansburg NY
Please consider the environment before reading this e-mail.

---

From: Steve Atkins <[email-masked]>
Date: Wed, 30 Sep 2015 19:08:03 -0700

> On Sep 30, 2015, at 5:39 PM, John Levine <[email-masked]> wrote:
> 

How much of a barrier to entry to new or small mailing list providers
(or new domains being used there) does this cause?

> be phish targets so publishing a DMARC policy is counterproductive.

Cheers,
  Steve

---

From: "Stephen J. Turnbull" <[email-masked]>
Date: Thu, 1 Oct 2015 13:15:16 +0900

> (or new domains being used there) does this cause?

That depends on how badly a missing conditional signature "deprecates"
a list.

There are three ways deprecation can happen:

1.  By reducing the risk of false positives, recipients may be
    encouraged to lower the threshold at which a message is considered
    spam.

    I think that is unlikely to be a strong effect.

2.  Some recipient domains may be tempted to *add* "spamminess" to
    indirect messages without conditional signature, rather than
    *subtract* (or in addition to subtracting) spamminess in the
    presence of a valid conditional signature.

    I don't know how likely that is to be a significant effect, but it
    seems unlikely to me at the current p=reject domains.

3.  Some recipient domains may be encourage to specify p=reject DMARC
    policies.

    I think this unlikely.

So yes, there is obviously a competitive advantage to lists that are
already on the "conditional signature" list of providers that specify
p=reject.  But I don't think it raises a new barrier to entry for
small/new lists.

Steve