Subject: DMARC address mangling

From: Joe Clarke <[email-masked]>
Date: Tue, 25 Sep 2018 10:27:07 -0400

Hello, fellow chairs.  Recently (maybe in the last three months) a few
of us at Cisco (at least) have started noticing that when we send email
to IETF mailing lists, the email is forwarded to list members with an
address of:

user=[email-masked]

I didn't see anything about this in 7489, and we're trying to narrow
down if it's our mail processors doing this, or if the IETF list server
has started doing this.  Any hints?

Thanks.

Joe

---

From: Adam Roach <[email-masked]>
Date: Tue, 25 Sep 2018 09:35:18 -0500

There's been a *lot* of discussion of this on [email-masked]. See 
<https://mailarchive.ietf.org/arch/msg/ietf/fZzt1mhBPqxG93y05ruGmMey9x4> 
for a good summary of what's currently happening.

/a

---

From: Alexey Melnikov <[email-masked]>
Date: Tue, 25 Sep 2018 15:44:16 +0100

Hi Joe,

> has started doing this.  Any hints?

This is done by IETF mail system, there was an announcement on the 
[email-masked] and and several threads on this in the past. IETF mail 
system rewrites email addresses for all domains that advertise 
"p=reject" and "p=quarantine" DMARC policy.

I will investigate with Henrik (who wrote the code), whether there is a 
small glitch in handling of "pct=0", as Cisco's DMARC record is:

         "v=DMARC1; p=quarantine; pct=0; fo=1; ri=3600; 
rua=mailto:[email-masked]; ruf=mailto:[email-masked]"

without pct=0 this would mean that all posts from Cisco email addresses 
going through IETF mailing lists has to be automatically quarantined by 
recipients, as IETF mailing lists frequently change subject of email 
messages, which will cause DMARC policy failure. However pct=0 
effectively turns this into p=none, which should not be rewritten.

Best Regards,

Alexey

---

From: Joe Clarke <[email-masked]>
Date: Tue, 25 Sep 2018 10:44:43 -0400

> for a good summary of what's currently happening.

Thanks, Adam.

Joe

---

From: Joe Clarke <[email-masked]>
Date: Tue, 25 Sep 2018 10:51:10 -0400

> effectively turns this into p=none, which should not be rewritten.

Indeed, I was just going to follow up.  The email thread only speaks to
p=reject and we are p=quarantine with pct=0.  And like you said, that is
effectively p=none.

Thanks for the investigation.

Joe