Subject: [TOOLS-DEVELOPMENT] Fwd: Helping set up a DMARC record for the IETF to analyze the impact of ARC

From: Alexey Melnikov <[email-masked]>
Date: Tue, 01 Aug 2017 16:12:02 +0100

Hi,
In order to help with analyzing impact of DMARC on IETF email, Seth from
Valimail suggested that ietf.org domain should publish a p=none DMARC
record in DNS. He is also saying that Valimail is happy to process
reports for ietf.org.

My suggestion:

1) I agree that ietf.org should publish DMARC p=none DNS record with
reporting email address ("rua" field).
2) I agree that reports submitted to "rua" email address need to be
analyzed somehow. They don't contain personally identifiable
information, so using Valimail services is Ok. If we can keep a copy of
reports, I suggest we do that (e.g. maybe we can create an alias that
delivers to an archive mailbox and to a Valimail address.)

Comments?

Thank you,
Alexey

----- Original message -----
From: Seth Blank <[email-masked]>
To: Alexey Melnikov <[email-masked]>
Subject: Helping set up a DMARC record for the IETF to analyze the
impact of ARC
Date: Wed, 26 Jul 2017 18:06:37 +0200

Hi Alexey,

Now that we're looking to upgrade the IETF's mailman instance to ARC
sign (https://tools.ietf.org/html/draft-ietf-dmarc-arc-protocol-08)
and Gmail is handling ARC signatures properly
(https://tools.ietf.org/html/draft-ietf-dmarc-arc-protocol-08#section-13.1),
we wanted to offer to provide free analysis for the IETF so that the
impact of ARC signing on IETF list delivery could be well understood.

As background, ValiMail provides a SaaS portal for organizations to
help them get to and maintain DMARC enforcement. We receive DMARC
aggregate reports (as defined in
https://tools.ietf.org/html/rfc7489#section-7.2 and
https://tools.ietf.org/html/rfc7489#appendix-C) and provide a
dashboard to visualize and comprehend those reports at scale.

We do this for customers of all sizes, from Time Warner and Uber to
the Online Trust Alliance (which is now a part of ISOC) and the
Anti-Phishing Working Group.

Adding a DMARC record at p=none does not impact mail flow, but allows
the collection of data in aggregate (which contains no PII) that make
it possible to see the impact of changes to one's mail sending
environment.

The more DMARC data we can collect before the IETF mailman instances
are upgraded, the more we can clearly detail the impact of the upgrade
(and even of the other list rewriting schemes under consideration for
September). If acceptable to the IESG, the sooner we can start
collecting DMARC data from the IETF, the better.

Since the IETF does not currently have a DMARC record, the simplest
approach is to NS delegate _dmarc.ietf.org to ValiMail. If the NS
delegation is too high a bar, then simply creating a DMARC record with
a rua that contains ValiMail will allow us to do the analysis.

Let us know if there's any other information you might need,

Seth
-- 

Bringing Trust to Email

Seth Blank | Head of Product for Open Source and Protocols
[email-masked]
+1-415-894-2724 <415-894-2724>

---

From: Henrik Levkowetz <[email-masked]>
Date: Thu, 3 Aug 2017 18:54:32 +0200

> delivers to an archive mailbox and to a Valimail address.)

Works for me.

Since the ARC milter package for OpenSUSE is available now, we should do
this swiftly if we want to gather data before we deploy ARC.

Best regards,

	Henrik