"Stephen J. Turnbull" <stephen@xemacs.org> wrote:
Honestly, they (one of the principal DMARC spec authors works for Yahoo) ignored their own advice, imagine how well that would go over in some other industries.
Let's not overlook Agari, which has a financial stake in offering a solution to the problem they helped create. Notice how many dmarc domains direct the reports to agari, from which, for a fee, they will get nice reports and metrics for their CIO to show around, reports that will show how many times their domain was "faked". Agari has an interest in making those numbers big, and mailing lists help them do it. The Agari web page boasts how many users they "protect", and it features the kind of slick writing that impresses people who don't know nuts and bolts.
One of the great failings on Yahoo's part was introducing a Change without notice to those affected, not even their own customers (to my knowledge). Even sloppy business owners should know not to do that.
Agari introduced "Agari PRO" April 1. Dmarc was pulled from standards track April 2. Yahoo implemented dmarc April 4. What was the rush?
Let's have some perspective: nobody died this time.
So true. In 100 years who will know the difference.
Joseph Brennan Manager, Email and Systems Applications Columbia University Information Technology