Re: state of openarc.org

[Jered Floyd <jered@xxxxxxxxxxxxx>]

Have you found that it *does* anything?

The point, theoretically, is that GMail (or any of us) could use ARC sealing to trust the initial SPF/DKIM authentication data for a message that has been forwarded via a mailing list or simple reflector.  However there does not seem to be any sort of reputation platform established to do this.  It is possible that the big mailbox providers (Google, Microsoft, Yahoo, Apple, etc) are gathering statistics for internal decision-making and filtering, but if so this has not been visible.

The challenge lately is that Google has started enforcing extremely strict rate limits on inbound mail.  This is a big challenge to anyone who operates a discussion list of appreciable size, or provides mailbox forwarding for organizations.  (For example, I provide mailbox services for several non-profit organizations, but 90%+ of the users simply forward all mail to their personal gmail.com. Argh.)  Even with very aggressive ingress filtering for spam, SRS for SPF validation, and rate limits for local accounts in case they are compromised, I have increasing problems with delivery.

Instead of following through on the ARC approach, it seems that Google et al. are all-in on pay-to-play scams like BIMI, which solves none of these problems but extract large amounts of cash from the semi-legitimate spammers while leaving individual senders still in the shadows.  It's deeply frustrating, although not at all surprising.

--Jered 

----- On Jan 31, 2024, at 9:01 AM, Andrew Beverley andy@xxxxxxxxxxx wrote:

>> *crickets* Does this mean I'm the only person on the list trying to use OpenARC?
> 
> I've just implemented it. It took some time: I had to merge some PRs and
> fix some other issues, but it seems to be working okay now. More details
> to follow later.
> 
> Despite the project having no activity from the maintainers, I am
> actually encouraged by how much participation there is from others. It
> makes me think there is still a need for the project and enough people
> to contribute, if someone takes ownership of it.
> 
> Andy