Subject: Re: [dmarc-ietf] Section 12.2.2

From: "Murray S. Kucherawy" <[email-masked]>
Date: Sat, 30 Nov 2013 22:33:36 -0800

-02 of the base draft in progress.  Regarding outstanding issues, I have
some things to bring to the list, starting here:

On Fri, Aug 9, 2013 at 2:46 PM, Andreas Schulze <[email-masked]>wrote:

> If nobody implemented http reporting yet
> we should consider removing it from the spec...
>

Any other opinions on this point?

-MSK

---

From: John R Levine <[email-masked]>
Date: Sun, 1 Dec 2013 02:08:54 -0500 (EST)

> Any other opinions on this point?

The current spec is too messed up to allow interoperable implementations. 
(PUT and POST are not the same thing at all.)

For large reports, http PUT is a much better way to deliver them than 
mail, since it's basically just a file upload to the target's web server, 
no base64 encoding or decoding needed, and no extra copies filling up mail 
spools.  It's easily made snoop and spoof resistant by using https, and 
it's easy to program because all of the usual http libraries support it.

If any of the usual suspects are interested, I can tell you how to fix the 
spec.  It's not very hard, change it to be only PUT, and specify how to 
construct the PUT filename for each report.

R's,
John