DMARC

[Scott Kitterman]

There's a new SPF related authentication protocol called DMARC that's just
been announced. It builds on SPF and DKIM to use their complementary failure
mechanisms and define feedback mechanisms so senders can QA their SPF and DKIM
deployments.

I've added some references to the SPF site:

http://www.openspf.net/News/2012-01-30

http://www.openspf.net/Best_Practices/Integration

Scott K

[HECTOR SANTOS]

Post by Scott Kitterman
There's a new SPF related authentication protocol called DMARC that's just
been announced. It builds on SPF and DKIM to use their complementary failure
mechanisms and define feedback mechanisms so senders can QA their SPF and DKIM
deployments.
http://www.openspf.net/News/2012-01-30
http://www.openspf.net/Best_Practices/Integration
Scott K

Just a quick pass review:

+ I like some of the basic ideas, touching base with some of the goals
found in DSAP (DKIM Signature Authorization Protocol), and also
concept using past frameworks where essentially Domain/Host
Information and Operational information is exposed under a single
namespace.

+ I like the anchor with RFC5322 Author Domain, always thought that
was important. Major plus.

- Complexity will be a factor for wide/quick adoption. A true widely
endorsed standard begins when even "mom & pop" to small businesses can
easily get on board, similar to what SPF offered.

- Payoff value needs to be better reviewed. Firm believer of Fault
Detection. Need better review, but if this is major part of it, could
help interest, certainly mine to further
explore.

- Got the basic idea that "Reporting" was an requirement. If so, may
be a negative, but that ties also to the payoff.

- The most immediate concern that jump into my head is has a payload
requirement to obtain the anchor. Scott, once again, another Payload
based Email Protocol that promotes the need to single source the
discovery process to satisfy multi-protocol payload "mouse trap" ideas
such the like HEAD proposal we worked on in 2006 specifically design
to address this:


http://www.winserver.com/public/ietf/drafts/draft-santos-smtphead-00.html

Like SENDER-ID, it perpetuated the need to offer the SMTP extension to
explore the PRA anchor at the SMTP level. Perhaps there may be a
DMARC SMTP extension to offer a similar optimizer.

Overall, good show Murray.