Miles Fidelman wrote: > > Martin Rex wrote: >> In case you didn't know or realize, what DMARC specifies for p=reject >> is actually a real felony crime in Germany (no kidding!), and this may >> apply to all over Europe (since the basic idea was spread out all over >> europe with a EU directive), unless each individual receipient(!!) has >> explicitly opted-in for this to happen. It should be fairly easy >> to get a cease-and-desist order against European ISPs for blocking >> EMail on DMARC p=reject. > > Can you provide a legal citation? That would be really cool! 1. Blocking EMail based on DMARC policy is illegal per §206 Abs. 2 Nr. 2 StGB. 2. Actually, even looking at rfc5322.From (rather than MAIL FROM:) for the purpose of looking up DMARC policy records is illegal per §206 Abs. 2 Nr. 1 StGB. 3. Any DMARC-triggered reporting about forwarded emails is also illegal per §206 Abs. 1 StGB and §88 TKG. And while I'm currently not sure whether the first two are similar all over europe, the last one DEFINITELY is under the current EU data protection directive. Technically, EMail is an issue between a sender of a telecommunication, a receiver of a telecommunication and a telecommunication service provider. If an MTA is relaying (or delivering to a mailbox), then the sender is whoever talks at the other end of the TCP connection that is used to transfer the EMail to the MTA on port 25. The receiver is what is named by the sender in the RCPT TO: command (the mail contents is off limits), and the MTA is an agent of the telecommunications provider. What appears in the rfc5322.from of the message is legally, none of the MTAs business. And even if is be an attribution of authorship of some third party in rfc5322.from, this party has absolutely no say in what contents sender transfers to receiver. It is also illegal for the telecommunications service provider to reveal the fact of this communication to other parties. This even applies to failed communication attempts. The only party to which the telecommunications provider would be allowed to report a failed delivery is the address (if any) supplied by the sender (i.e. the MAIL FROM: envelope address). > > From where I sit, it also looks like a violation of the US Computer > Fraud and Abuse Act (effectively, knowingly causing damage to other > systems - which has been applied to DDoS attacks). But I haven't heard > any lawyers or prosecutors stand up and confirm that. The DMARC policy scheme is actually censoring of a telecommunication between a messge sender and a message receiver through a telecommunications provider by some _outside_ third party. So in the US a p=reject DMARC policy might potentially be freedom of speech (1st Amendment) violation. -Martin