[dmarc-discuss] How does *this* mailing list interact with dmarc?

John Levine johnl at taugh.com
Sat Jun 23 10:24:07 PDT 2012


>Or else a phisher who imitates a listserver, must sign the fake
>"forwarded" mail with a DKIM signature that ties it to a domain under
>their control, which makes it more easily blacklisted.

This is nuts.  It would lead to an endless game of whack-a-mole, as
spammers use and discard throwaway domains they already have.  Do you
have any idea how many domains registrars already turn off every day?
It's at least in the tens of thousands.  This cannot work.  Forget it.

DMARC is a nice concrete design to whitelist certain classes of mail.
Adding a giant security hole and telling people to patch it using
external blacklists is not a sensible suggestion.

And for about the three hundredth time, we already know how to handle
mailing list mail, recognize it and whitelist it.  DMARC is completely
irrelevant.

Since there appears to be no realistic chance that DMARC will adopt
any of the bad ideas about list mail, and even less chance that mail
systems will be so foolish as to break their existing mailing list
filters if they add DMARC, I won't further waste anyone's time
arguing about this.

R's,
John




More information about the dmarc-discuss mailing list