Subject: [dmarc-ietf] XML empty sp tag

From: Tomki Camp <[email-masked]>
Date: Sun, 23 Feb 2014 12:07:14 -0800

I am seeing some RUA reports come in where an sp tag is present in the XML,
but with no value.

Such as:
  <policy_published>
    <domain>yahoo.com</domain>
    <adkim>r</adkim>
    <aspf>r</aspf>
    <p>none</p>
    <sp></sp>
    <pct>100</pct>
  </policy_published>

It’s unclear to me, from the spec, whether this is allowed.

The schema definition
http://www.blackops.org/~msk/dmarc/draft-dmarc-base.html#xml_schema shows
that PolicyPublishedType has both the p and sp elements as DispositionType,
neither of them with a minOccurs.  At the very least, the former probably
should have that, right?

What would be an appropriate way to indicate in the spec whether the empty
sp tagset is allowed, and what it indicates?

Regards,
—Tomki

---

From: Roland Turner <[email-masked]>
Date: Mon, 24 Feb 2014 15:27:28 +0800

Give or take what the spec says about the XML generated (I've not dug 
into this part), presumably it is desirable for the policy_published 
section to contain what the receiver saw, rather than shoe-horning it 
into something valid. E.g. if the Domain Owner published:

    v=DMARC1; p=none; sp= ;

then the fragment below would be the sensible thing to send.

As _dmarc.yahoo.com doesn't look like this it is likely that there is a 
problem in the report generator that created this report (so a bug 
should be filed with the implementer), but more broadly I'd suggest that 
DMARC shouldn't be over-specifying here.

- Roland

On 02/24/2014 04:07 AM, Tomki Camp wrote:
> I am seeing some RUA reports come in where an sp tag is present in the 
> XML, but with no value.
>
> Such as:
> <policy_published>
> http://www.blackops.org/~msk/dmarc/draft-dmarc-base.html#xml_schema 
> shows that PolicyPublishedType has both the p and sp elements as 
> DispositionType, neither of them with a minOccurs.  At the very least, 
> the former probably should have that, right?
>
> What would be an appropriate way to indicate in the spec whether the 
> empty sp tagset is allowed, and what it indicates?
>
>
> Regards,
> —Tomki
>
> *
> *
>
>
> _______________________________________________
> dmarc mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/dmarc

---

From: Elizabeth Zwicky <[email-masked]>
Date: Mon, 24 Feb 2014 17:10:34 +0000

Somebody determined along the way that the default minOccurs in this XML is 1.
On the other hand, <sp></sp> does occur -- the question is whether it is syntactically valid for it to be null, which, as far as I can tell, it is not (it's an enumeration of strings).

As Roland points out, that leaves the question of what you're supposed to do if the sender's domain has a syntactically invalid DMARC record, and producing a matching, harmlessly incorrect report looks like the least bad option, at least unless we want to change dispositionType to have INVALID as a possible value.

Elizabeth

From: Tomki Camp <[email-masked]<mailto:[email-masked]>>
Date: Sunday, February 23, 2014 12:07 PM
To: "[email-masked]<mailto:[email-masked]>" <[email-masked]<mailto:[email-masked]>>
Subject: [dmarc-ietf] XML empty sp tag

I am seeing some RUA reports come in where an sp tag is present in the XML, but with no value.

Such as:
  <policy_published>

The schema definition http://www.blackops.org/~msk/dmarc/draft-dmarc-base.html#xml_schema shows that PolicyPublishedType has both the p and sp elements as DispositionType, neither of them with a minOccurs.  At the very least, the former probably should have that, right?

What would be an appropriate way to indicate in the spec whether the empty sp tagset is allowed, and what it indicates?

Regards,
—Tomki