Subject: Re: [dmarc-ietf] [dmarc-discuss] exegesis: pass and fail together

From: Steven M Jones <[email-masked]>
Date: Thu, 7 Jul 2016 11:38:58 -0700

I'm quoting the following response in a thread from the
[email-masked] mailing list, because I think it identifies work
items or at least questions this WG may want to address. If this is
already captured somewhere, my apologies.

Here's the original thread:

http://lists.dmarc.org/pipermail/dmarc-discuss/2016-July/003546.html

Summary: How should DMARC aggregate reports reflect messages with
multiple DKIM results? And should DKIM selectors be included in DMARC
aggregate reports?

On 07/07/2016 09:16, Elizabeth Zwicky via dmarc-discuss wrote:
> 
> And yes, it's entirely possible for a message to have 2 or more DKIM
> signatures, including signatures for the same domain with different
> results. As long as there exists a DKIM signature that is aligned and
> passes, the DMARC DKIM result is pass. (As I recall, the spec is unclear
> about what you do if there are multiple DKIM results. That should
> probably be fixed and it would be nice if we allowed the selector to be
> reported as well.)

AND:

On 07/07/2016 09:53, Elizabeth Zwicky via dmarc-discuss wrote:
> 
> I meant to say that the spec is unclear about what you do about
> **reporting** multiple DKIM results. It's perfectly clear on how to
> evaluate them.

---

From: Elizabeth Zwicky <[email-masked]>
Date: Thu, 7 Jul 2016 11:54:58 -0700

Tomki pointed out that I am completely wrong about selectors and lots of people report them. I should have checked. 

Elizabeth 

[email-masked]

> On Jul 7, 2016, at 11:38 AM, Steven M Jones <[email-masked]> wrote:
> 
> _______________________________________________
> dmarc mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/dmarc

---

From: Peter Goldstein <[email-masked]>
Date: Thu, 7 Jul 2016 12:08:50 -0700

Being able to identify the service that originated a piece of email is
extremely helpful in getting a domain to quarantine/reject.

Including all DKIM signatures found on a message (not just those that are
aligned or that pass) in the DMARC aggregate reports can be very helpful in
ascertaining that originating service.  DKIM signatures are footprints -
not always unambiguous, but they can be very helpful in figuring out
exactly what's going on.  From our perspective it's preferable that
receivers include all signatures in the aggregate reports.

Similarly, I'd strongly urge that receivers include selectors in the DMARC
aggregate reports for much the same reason.  The presence of a DKIM
signature with a selector is often enough to allow one to make that
identification.  While the spec marks the selector optional, it's an
extremely valuable piece of information that (as Tomki notes) is already
provided by some receivers.

Best,

Peter

On Thu, Jul 7, 2016 at 11:54 AM, Elizabeth Zwicky <[email-masked]> wrote:

> Tomki pointed out that I am completely wrong about selectors and lots of
> people report them. I should have checked.
>
> Elizabeth
>
> [email-masked]
>

-- 
Peter Goldstein
CTO & Co-Founder, ValiMail
[email-masked]
(415) 793-5783

---

From: Steven M Jones <[email-masked]>
Date: Thu, 7 Jul 2016 12:09:04 -0700

On 07/07/2016 11:54, Elizabeth Zwicky wrote:
> 
> Tomki [Camp] pointed out that I am completely wrong about selectors and
> lots of people report them. I should have checked.

And I didn't check - I do see provision for selectors in the aggregate
report XML in RFC7489.

Is the question of messages with multiple DKIM signatures in aggregate
reports is still open?

--S.

---

From: Tomki Camp <[email-masked]>
Date: Thu, 7 Jul 2016 13:59:20 -0700

Multiple DKIM signature reporting is reasonable.  However there have been
report instances which overdid it, inserting multiple instances of the same
domain+result[+selector].
It's certainly possible to re-sign a message with the same domain+selector
and obtain the same verification result, but I do not feel that reporting
this in DMARC XML is useful.

To be explicit, any instance which wants to show up as

      <dkim>
        <domain>agari.com</domain>
        <selector>sel1</selector>
        <result>fail</result>
      </dkim>
      <dkim>
        <domain>nexthop.agari.com</domain>
        <selector>sel2</selector>
        <result>pass</result>
      </dkim>
      <dkim>
        <domain>forwarderdomain.com</domain>
        <selector>sel3</selector>
        <result>pass</result>
      </dkim>

is great.

Any instance which shows this is not useful:

      <dkim>
        <domain>agari.com</domain>
        <selector>blah</selector>
        <result>pass</result>
      </dkim>
      <dkim>
        <domain>agari.com</domain>
        <selector>blah</selector>
        <result>pass</result>
      </dkim>

it should simply show up as
     <dkim>
        <domain>agari.com</domain>
        <selector>blah</selector>
        <result>pass</result>
      </dkim>

The current Comcast reporting raw data has a comment inline when this
occur, which is fine, XML parsers will ignore it:
      <dkim>
        <domain>agari.com</domain>
        <result>pass</result>
        <selector>blah</selector>
        <!-- This selector was repeated 2 times. -->
      </dkim>

--Tomki