Subject: Re: [TOOLS-DEVELOPMENT] Fwd: Helping set up a DMARC record for the IETF to analyze the impact of ARC

From: Alexey Melnikov <[email-masked]>
Date: Mon, 11 Sep 2017 15:51:51 +0100

On Thu, Aug 3, 2017, at 05:54 PM, Henrik Levkowetz wrote:
> 
> On 2017-08-01 17:12, Alexey Melnikov wrote:
> > Hi,
> > In order to help with analyzing impact of DMARC on IETF email, Seth from
> > Valimail suggested that ietf.org domain should publish a p=none DMARC
> > record in DNS. He is also saying that Valimail is happy to process
> > reports for ietf.org.
> > 
> > My suggestion:
> > 
> > 1) I agree that ietf.org should publish DMARC p=none DNS record with
> > reporting email address ("rua" field).
> > 2) I agree that reports submitted to "rua" email address need to be
> > analyzed somehow. They don't contain personally identifiable
> > information, so using Valimail services is Ok. If we can keep a copy of
> > reports, I suggest we do that (e.g. maybe we can create an alias that
> > delivers to an archive mailbox and to a Valimail address.)
> > 
> > Comments?
> 
> Works for me.
> 
> Since the ARC milter package for OpenSUSE is available now, we should do
> this swiftly if we want to gather data before we deploy ARC.

Sorry, I dropped the ball on this. I will get with creating a mailing
list.

Does IAOC need to get involved in discussions with Valimail?

> Best regards,
> 
> 	Henrik
> 
> > 
> > Thank you,
> > Alexey
> > 
> > ----- Original message -----
> > From: Seth Blank <[email-masked]>
> > To: Alexey Melnikov <[email-masked]>
> > Subject: Helping set up a DMARC record for the IETF to analyze the
> > impact of ARC
> > Date: Wed, 26 Jul 2017 18:06:37 +0200
> > 
> > Hi Alexey,
> > 
> > Now that we're looking to upgrade the IETF's mailman instance to ARC
> > sign (https://tools.ietf.org/html/draft-ietf-dmarc-arc-protocol-08)
> > and Gmail is handling ARC signatures properly
> > (https://tools.ietf.org/html/draft-ietf-dmarc-arc-protocol-08#section-13.1),
> > we wanted to offer to provide free analysis for the IETF so that the
> > impact of ARC signing on IETF list delivery could be well understood.
> > 
> > As background, ValiMail provides a SaaS portal for organizations to
> > help them get to and maintain DMARC enforcement. We receive DMARC
> > aggregate reports (as defined in
> > https://tools.ietf.org/html/rfc7489#section-7.2 and
> > https://tools.ietf.org/html/rfc7489#appendix-C) and provide a
> > dashboard to visualize and comprehend those reports at scale.
> > 
> > We do this for customers of all sizes, from Time Warner and Uber to
> > the Online Trust Alliance (which is now a part of ISOC) and the
> > Anti-Phishing Working Group.
> > 
> > Adding a DMARC record at p=none does not impact mail flow, but allows
> > the collection of data in aggregate (which contains no PII) that make
> > it possible to see the impact of changes to one's mail sending
> > environment.
> > 
> > The more DMARC data we can collect before the IETF mailman instances
> > are upgraded, the more we can clearly detail the impact of the upgrade
> > (and even of the other list rewriting schemes under consideration for
> > September). If acceptable to the IESG, the sooner we can start
> > collecting DMARC data from the IETF, the better.
> > 
> > Since the IETF does not currently have a DMARC record, the simplest
> > approach is to NS delegate _dmarc.ietf.org to ValiMail. If the NS
> > delegation is too high a bar, then simply creating a DMARC record with
> > a rua that contains ValiMail will allow us to do the analysis.
> > 
> > Let us know if there's any other information you might need,
> > 
> > Seth
> > 
> 
> Email had 1 attachment:
> + signature.asc
>   1k (application/pgp-signature)

---

From: Henrik Levkowetz <[email-masked]>
Date: Mon, 11 Sep 2017 17:21:49 +0200

> Does IAOC need to get involved in discussions with Valimail?

I should not think so.  I suggest we take this up during the tools call
tomorrow.

Best regards,

	Henrik