Subject: [dmarc-ietf] Extending DMARC: managing failure cases: plus ultra

From: "J. Gomez" <[email-masked]>
Date: Fri, 31 Oct 2014 23:39:36 +0100

(First: yes, I know this is not in Milestone 1 Roadmap, but I just dump it here do that I myself don't forget about it. Please delete from your Inbox at first symptom of annoyance; thank you.)

Proposal: to extend DMARC to further handle failure cases when Sender's policy is p=reject and the Receiver is receiving a non-aligned email as per DMARC.

The proposal consists of two parts:

1) A new tag for the DMARC record in DNS. The tag could be named "ama" ("ask-me-anything"), and its possible values could be an int (N) from value 0 up to 65535, the default being "ama=0" when the "ama" tag is omitted (note: "ama=0" would equal to "do not ask the Sender anything").

2) A new protocol, bi-directional and XML-based and carried over HTTPS, by which Receiver would query Sender if the first N (or any number < N) lines of a DMARC-failed received email are to be considered "legit use" of the Sender's "domain email policy", and by which (the purported) Sender would answer the query with whether that particular email (of which the first N, or less than N, lines he has been made aware of) is legit, not legit, or doubtful. (Note: this XML transaction should happen in semi-realtime while the original SMTP transaction for the queried email is still pending closure.)

To further refine: How to avoid the (purported) Sender's XML "ama" service being DDoS-ed by evil actors? How to make it so that the Receiver does not accidentally disclose to a fake Sender the confidential content of received emails? Perhaps the ama-XML-query should only happen (and should only be accepted by the [purported] Sender) when the received email has a From-header signed by an (additional) valid DKIM signature?

So there, that.

Regards,
J.Gomez

---

From: Dave Crocker <[email-masked]>
Date: Fri, 31 Oct 2014 15:47:39 -0700

On 10/31/2014 3:39 PM, J. Gomez wrote:
> I just dump it here do that I myself don't forget about it.

I tend to like such aide-memoire postings to the list -- as long as we
don't get distracted -- but I think we also want to encourage placing
them into the wiki.  As I recall, it has separate sections for each
milestone.

d/

-- 
Dave Crocker
Brandenburg InternetWorking
bbiw.net

---

From: "J. Gomez" <[email-masked]>
Date: Sat, 1 Nov 2014 00:01:05 +0100

> them into the wiki.  As I recall, it has separate sections for each

I don't want to pollute the wiki with wild and inmature ideas of mine. This list is a much better place to get shitty ideas smacked down real fast. :)

Regards,
J.Gomez

---

From: Dave Crocker <[email-masked]>
Date: Fri, 31 Oct 2014 16:10:15 -0700

> I don't want to pollute the wiki with wild and inmature ideas of mine. This list is a much better place to get shitty ideas smacked down real fast. :)

I would indulge the in invitation to repartee, but the whole point is
not to distract the list.

Simple view:

     When a topic is being discussed, the list is the best place to
expose a new idea -- no matter which orifice it exudes from -- for
discussion.

     But when it is off-topic, the wiki is the best place to record it
for later reference.

Anyhow, just my opinion.

d/

---

From: "J. Gomez" <[email-masked]>
Date: Sat, 1 Nov 2014 00:22:59 +0100

On Saturday, November 01, 2014 12:10 AM [GMT+1=CET], Dave Crocker wrote:

> > I don't want to pollute the wiki with wild and inmature ideas of
> > mine. This list is a much better place to get shitty ideas smacked
> > down real fast. :)  
> 
> 

Well, this is just a thread in the list, it could be ignored/killed by those disliking it.

But I would love to hear your criticism of the ama-XML query service for DMARC failure cases...

I mean, if the idea deserves a rapid death, lets proceed and get done with it.

Regards,
J.Gomez