New policy: p=validate

[vesely@…]

Description

This new policy is weaker than p=quarantine, but stronger than p=none.

Receivers who routinely forward messages by loosely authenticated subscribers —that is, mailing list managers— are asked by this policy to reject if DMARC check fails. Other receivers, including final receivers, are asked to ignore any outcome of DMARC check, as if p=none.

Mentions on dmarc-ietf mailing list

I'd rather propose to add another p= level, in between p=none and p=quarantine. I'd want receivers to reject my mail if it fails authentication, but only on the first hop. In particular, I'd want mailing lists (whether or not doing From: munging) to reject unauthenticated messages claiming to come from me. (And, given that it's hard to specify "first hop", it would be fine to word such policy as "reject by MLMs only".)
​https://mailarchive.ietf.org/arch/msg/dmarc/-o7nB0-W9XMRiNsNLVXX7BeB9PM

I propose an intermediate value, p=validate. It is meant for first hops only, and mediators in particular. A mediator should reject posts failing DMARC check if p=validate. Normal receivers should ignore p=validate unless they know they're routinely going to resend the message to external users (i.e. unless they're mediators.)
​https://mailarchive.ietf.org/arch/msg/dmarc/QVj8RbWHZA6aJ9Q6dwPLusb_eIM

I wish there was an intermediate policy, call it p=mlm-validate, that directs a third party to reject if not authenticated, while final recipients can accept it as if p=none.
​https://mailarchive.ietf.org/arch/msg/dmarc/QL8fi1YHtFz0Z1qxcJyGmpR_Q-g

I'll post one further message on this topic today.