It appears that Gren Elliot <[email protected]> said: >For better or worse, there is long established practice in the Calendaring >community when implementing iMIP (rfc6047) when an >assistant is working on behalf of a manager for the manager’s email address to >populate the “From:” header and the >assistant’s email address to populate the “Sender:” header. Mailing software >seems to go to lengths to follow this >convention even when it doesn’t do so for other email messages “sent on behalf >of”. I assume this means that things will >break somewhere if this convention isn’t followed for at least some peoples >calendaring software. > >So, it looks like at the moment people will need to make a choice between >enforcing DMARC and having calendaring software continue >to function.
DMARC only looks at the domain part of the From header. How often do the manager and assistant have e-mail addresses that are not in the same domain? >Surely it is possible to offer different levels of DMARC enforcement where >there is a level that forces using the “From:” >header and a newer level which follows the existing email standards for >validating who the author is – i.e. use “Sender:” if >present, else use “From:”? I talk to people at large mail providers a lot, and I do not recall this partiticular situation coming up as a problem, ever. Do you have concrete experience to the contrary? The problem with keying DMARC to the sender is that if you believe that people look at the From header, it turns DMARC into filtering based on the reputation of the DKIM or SPF identity. Mail providers already knew how to do that before DMARC existed. Noting what Dave said, I'm not sure how closely people look at the From header, but I do know that other than desktop Outlook, MUAs do not show the sender at all. Gmail and web Outlook don't. R's, John _______________________________________________ dmarc mailing list [email protected] https://www.ietf.org/mailman/listinfo/dmarc
