Subject: Re: [dmarc-ietf] Jim Fenton's review of -04

From: Kurt Andersen <[email-masked]>
Date: Wed, 24 Dec 2014 16:43:48 +0000

On 2014-12-24, 08:21 , "Franck Martin" <[email-masked]> wrote:

>
> From: "Murray S. Kucherawy" <[email-masked]>
> To: "Scott Kitterman" <[email-masked]>
> Cc: [email-masked]
> Sent: Wednesday, December 24, 2014 7:46:42 AM
> Subject: Re: [dmarc-ietf] Jim Fenton's review of -04
>
> > On Wed, Dec 24, 2014 at 4:04 AM, Scott Kitterman
><[email-masked]> wrote:
> >
> > > The draft strongly encourages DMARC implementers to ignore SPF
>policy, 
> > > so I don't think assuming messages will be deferred due only due to
>SPF 
> > > or DKIM results indicating a temporary DNS error is appropriate.
> >
> >
> > If there's a transient DNS error getting the SPF policy, then there's
>no 
> > SPF policy to be ignored.  That's quite a different situation.
> >
> >
> > > I think that in the case of a temporary DNS error in one of the
>lower 
> > > level protocols, insufficient inputs are available to conclude a
>message 
> > > has failed DMARC tests.
> >
> >
> > I agree.
> >
> >
> > Receivers can either ignore DMARC for this message due to incomplete
>evaluation 
> > or they can defer the message in the hope that the temporary error
>will be 
> > resolved when the message is retried.  Receivers MUST NOT apply DMARC
>policy 
> > and reject or quarantine because the DMARC evaluation is incomplete.
>
> I would prefer this phrasing
>
> Receivers can either ignore DMARC for this message due to incomplete
>evaluation 
> or they can defer the message in the hope that the temporary error will
>be 
> resolved when the message is retried. Defer seems preferable for
>security reasons. 
> Receivers MUST NOT apply DMARC policy and reject or quarantine because
>the DMARC 
> evaluation is incomplete.

I think that it might be worth suggesting that such transient errors could
be 
reasonably reported since this does constitute an avenue for some sort of
flooding 
attack or flaw in their DNS infrastructure (consider, for example a
partially broken
DNSSEC implementation). By reporting incidents, it can alert the operators
to the problem.

--Kurt Andersen