Subject: [TOOLS-DEVELOPMENT] DRAFT: Message to IETF community about enabling DMARC workaround for all IETF/IRTF mailing lists

From: Alexey Melnikov <[email-masked]>
Date: Wed, 09 May 2018 17:40:41 +0100

Suggestions for improvements are welcome. Is it too much or too little of technical details?

---------------------
Hi,
Many of you have seen several long discussions thread about DMARC and how it affects use of mailing lists.

After testing DMARC workaround code written by Henrik Levkowetz on several high volume IETF mailing lists, tools team and IESG decided that Henrik's code should be deployed for all IETF and IRTF mailing lists. In particular the workaround allows people from DMARC p=reject domains to participate in IETF mailing lists and avoids mailing list unsubscriptions from recipients that enforce DMARC. These 2 issues were the main reasons for developing the DMARC workaround code.

The workaround will be deployed tomorrow, May 10th.

Below are technical details on how the email address rewriting workaround is going to work:

Emails from domains that don't have p=reject DMARC setting are not going to be affected in any way.

For emails from p=reject domains:

 - From header field of such emails will be rewritten to be under @dmarc.ietf.org domain (which will have p=none policy). For example, "[email-masked]" email address would become "[email-masked]". The original From header field will be preserved in the X-Original-From header field, which can be used for automatic message processing by Sieve and Mail User Agents.

Note that the mapping is reversible, so it is possible to send replies or new messages to an original sender by sending them to the corresponding mapped @dmarc.ietf.org email address.

Best Regards,
Alexey

---

From: Russ Housley <[email-masked]>
Date: Wed, 9 May 2018 13:15:16 -0400

Just trying to make it a bit more simple ...  See below.

Russ

> On May 9, 2018, at 12:40 PM, Alexey Melnikov <[email-masked]> wrote:
> 

... IETF mail lists.

> After testing DMARC workaround code written by Henrik Levkowetz on several high volume IETF mailing lists, tools team and IESG decided that Henrik's code should be deployed for all IETF and IRTF ma…

... from DMARC p=reject domains to participate normally in IETF and IRTF mail lists.  The workaround avoids removal of subscriptions for recipients from DMARC p=reject domains.

---

From: Spencer Dawkins at IETF <[email-masked]>
Date: Wed, 9 May 2018 13:38:24 -0500

Hi, Alexey,

> Suggestions for improvements are welcome. Is it too much or too little of

Any sendable note to the community will probably have both too many
technical details, and too few ... ;-)

A couple of comments below.

> After testing DMARC workaround code written by Henrik Levkowetz on several
> high volume IETF mailing lists, tools team and IESG decided that Henrik's
> code should be deployed for all IETF and IRTF mailing lists. In particular
> the workaround allows people from DMARC p=reject domains to participate in
> IETF mailing lists and avoids mailing list unsubscriptions from recipients
> that enforce DMARC. These 2 issues were the main reasons for developing the
> DMARC workaround code.
>

If it was reasonable to name the mailing lists that were used in testing,
that might be useful ("well, if it worked for THAT mailing list, it will
probably work for mine").

> The workaround will be deployed tomorrow, May 10th.

A quick scan of my mailboxes pops up about 150 threads that include "New
datatracker release" since I joined the IESG, so I'm sort of numb to
changes to the datatracker, but I don't know that the community is aware of
most changes to the datatracker. It might be useful to give the community
more heads-up when there's a change coming that will affect a large chunk
of the community.

To be clear, I don't object to rolling this new version with one day's
notice. That's just a suggestion for the future.

Spencer

>  - From header field of such emails will be rewritten to be under @
> dmarc.ietf.org domain (which will have p=none policy). For example, "
> [email-masked]" email address would become "
> [email-masked]". The original From header field will
> be preserved in the X-Original-From header field, which can be used for
> automatic message processing by Sieve and Mail User Agents.
>
> Note that the mapping is reversible, so it is possible to send replies or
> new messages to an original sender by sending them to the corresponding
> mapped @dmarc.ietf.org email address.
>
> Best Regards,
> Alexey
>
>

---

From: Benjamin Kaduk <[email-masked]>
Date: Wed, 9 May 2018 13:42:36 -0500

> more heads-up when there's a change coming that will affect a large chunk

FWIW, Datatracker release announcements now go to wgchairs as well
as iesg.  Still doesn't qualify for "the community", though.

-Benjamin

---

From: Alexey Melnikov <[email-masked]>
Date: Thu, 10 May 2018 11:01:43 +0100

Hi Russ,

> > Many of you have seen several long discussions thread about DMARC and how it affects use of mailing lists.

Ok.

> ... from DMARC p=reject domains to participate normally in IETF and IRTF 
> mail lists.  The workaround avoids removal of subscriptions for 
> recipients from DMARC p=reject domains.

Actually this is not the right change: there are 2 issues. One that email messages from p=reject might not get delivered (and thus might not be seen) by some recipients. The other one is that recipients (they don't have to be from DMARC p=reject domains, their email server just have to bounce messages that don't conform to sender's DMARC p=reject policy) can be unsubscribed from mailing lists, because such bounces get delivered to Mailman and Mailman doesn't know that they are caused by DMARC and not something else.

---

From: Alexey Melnikov <[email-masked]>
Date: Thu, 10 May 2018 11:03:11 +0100

On Wed, May 9, 2018, at 7:38 PM, Spencer Dawkins at IETF wrote:
> Hi, Alexey,
> 
> On Wed, May 9, 2018 at 11:40 AM, Alexey Melnikov
> <[email-masked]> wrote:
>> Suggestions for improvements are welcome. Is it too much or too
>> little of technical details?> 
> technical details, and too few ... ;-)> 
>>  Many of you have seen several long discussions thread about DMARC
>>  and how it affects use of mailing lists.>> 
>>  After testing DMARC workaround code written by Henrik Levkowetz on
>>  several high volume IETF mailing lists, tools team and IESG decided
>>  that Henrik's code should be deployed for all IETF and IRTF mailing
>>  lists. In particular the workaround allows people from DMARC
>>  p=reject domains to participate in IETF mailing lists and avoids
>>  mailing list unsubscriptions from recipients that enforce DMARC.
>>  These 2 issues were the main reasons for developing the DMARC
>>  workaround code.> 
> If it was reasonable to name the mailing lists that were used in
> testing, that might be useful ("well, if it worked for THAT mailing
> list, it will probably work for mine").Yes, sure. Good idea.

> A quick scan of my mailboxes pops up about 150 threads that include
> "New datatracker release" since I joined the IESG, so I'm sort of numb
> to changes to the datatracker, but I don't know that the community is
> aware of most changes to the datatracker. It might be useful to give
> the community more heads-up when there's a change coming that will
> affect a large chunk of the community.Yeah, 1 day might be a bit short for anybody who is not on IESG or not
a WG Chair.
> notice. That's just a suggestion for the future.> 
> Spencer
>  
>> Below are technical details on how the email address rewriting
>> workaround is going to work:>> 
>>  Emails from domains that don't have p=reject DMARC setting are not
>>  going to be affected in any way.>> 
>>   - From header field of such emails will be rewritten to be under
>>     @dmarc.ietf.org domain (which will have p=none policy). For
>>     example, "[email-masked]" email address would become
>>     "[email-masked][1]". The original From
>>     header field will be preserved in the X-Original-From header
>>     field, which can be used for automatic message processing by
>>     Sieve and Mail User Agents.>> 
>>  Note that the mapping is reversible, so it is possible to send
>>  replies or new messages to an original sender by sending them to the
>>  corresponding mapped @dmarc.ietf.org email address.>> 
>>  Best Regards,
>>  Alexey
>> 

Links:

  1. mailto:[email-masked]

---

From: Russ Housley <[email-masked]>
Date: Thu, 10 May 2018 12:30:13 -0400

> On May 10, 2018, at 6:01 AM, Alexey Melnikov <[email-masked]> wrote:
> 
> Hi Russ,
> 

Right.  I think the message should be clear about both issues.

---

From: Benjamin Kaduk <[email-masked]>
Date: Thu, 10 May 2018 16:36:49 -0500

> Suggestions for improvements are welcome. Is it too much or too little of technical details?

I'm happy with the way the "technical details" discussion is
unfolding, but will sprinkle some definite articles through the
text:

> several high volume IETF mailing lists, tools team and IESG

"the tools team"; "the IESG"

> decided that Henrik's code should be deployed for all IETF and
> IRTF mailing lists. In particular the workaround allows people
> from DMARC p=reject domains to participate in IETF mailing lists
> and avoids mailing list unsubscriptions from recipients that
> enforce DMARC. These 2 issues were the main reasons for developing
> the DMARC workaround code.
> 

"some technical details", maybe?

> workaround is going to work:
> 

"a p=reject"

> going to be affected in any way.
> 

"The From header"

>  @dmarc.ietf.org domain (which will have p=none policy). For

"a p=none"?

>  example, "[email-masked]" email address would become

the "[email-masked]"

-Benjamin

>  "[email-masked]". The original From header
>  field will be preserved in the X-Original-From header field,
>  which can be used for automatic message processing by Sieve and
>  Mail User Agents.
> 
> replies or new messages to an original sender by sending them to
> the corresponding mapped @dmarc.ietf.org email address.
> 
> Best Regards, Alexey
>

---

From: Henrik Levkowetz <[email-masked]>
Date: Thu, 10 May 2018 23:57:54 +0200

One correction:

> On 10 May 2018, at 23:36, Benjamin Kaduk <[email-masked]> wrote:
> 
>> "[email-masked]".

That should be "alexey=[email-masked]".

   Henrik

>> The original From header
> _______________________________________________
> TOOLS-DEVELOPMENT mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/tools-development
>

---

From: Alexey Melnikov <[email-masked]>
Date: Fri, 11 May 2018 12:49:47 +0100

> On 10 May 2018, at 22:57, Henrik Levkowetz <[email-masked]> wrote:
> 
> One correction:
> 

Well spotted. I’ve corrected that in the email I’ve just sent to [email-masked]