On Thu, Dec 14, 2017 at 7:16 PM Grant Taylor via mailop <mailop@mailop.org> wrote:
> On 12/14/2017 06:23 PM, Steve Atkins wrote: > > If you want to argue more loudly that you *do* understand what it means > > you could publish a matching DMARC record with p=discard. Doing that > would > > tell recipient ISPs that either you've actually done appropriate analysis > > of your mail stream, you understand that rejecting mail with SPF -all > > failures will cause legitimate mail to be lost and have made an informed > > decision. Or, at least, that you're saying that's the case. They're more > > likely to trust your assertion in that case - though it's still just > > a signal that they will combine with others before deciding whether or > > not to deliver an email. > > So why do people believe me more now when I publish p=reject for DMARC > than they did when I published -all for SPF? > Depending on how you count, DMARC is the third or fourth attempt at policy publishing for email. As these things go, it incorporates a lot of things that were learned in real world usage of the previous attempts, including SPF. It's much wider adoption seems at least partially to validate the improvements. That said, it may not be the last attempt, it's certainly not perfect. What happens when a lot of people shoot themselves in the foot and > receivers start giving DMARC less and less credence. Will we then need > something new to convince them that I really do mean what I publish? > DMARC gives senders the ability to actually judge whether they have control of their mail sending, and also gives senders the ability to judge whether and how folks are honoring it. I view that as a self perpetuating problem. I'd rather stop that cycle > and take a stand now. > > IMHO there is too much coddling in the world. > It's not coddling, SPF policy is flawed and it's been superseded by something better. The community could have tried to fix SPF directly, things like SRS were working in that direction, but the community decided that wasn't the right direction. Also, at some point, this is about users, and they want their mail. Our goal should be making sure they get the mail they should and not the bad stuff. There is no black & white algorithm to apply to do that. Users use forwarding services, many fairly prominently (alumni.mit.edu, ieee.org, acm.org are the most obvious examples that come to mind, but there are plenty more). Mail routing is complicated in the real world. You can be hostile to your users, and I'm sure there are users who either don't know better or like the BOFH attitude. It's a nice niche. Brandon
_______________________________________________ mailop mailing list mailop@mailop.org https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop
