Subject: [dmarc-ietf] dns failures in the draft

From: Brandon Long <[email-masked]>
Date: Mon, 31 Jul 2017 16:41:44 -0700

> 9.4.  Handling DNS Problems While Validating ARC
>    DNS failures to resolve or return data which is needed for ARC
>    validation SHOULD result in a 421 tempfail during the SMTP
>    conversation with the sending system.  Temporary or intermittent DNS
>    problems will generally not be sufficiently transitory to allow a
>    mediator to obtain a different result during the ordinary transit
>    duration so it is better to have the source system queue the
>    problematic message(s) than to generate (potential) backscatter.
>
>    Operators of systems which mediate mail should be aware that broken
>    DNS records (or malfunctioning name servers) will result in
>    undeliverable mail to any downstream ARC-verifying ADMDs.
>
>    DNS-based failures to verify a chain are treated no differently than
>    any other ARC violation.  They result in a "cv=fail" verdict.

I don't know if SHOULD is the right choice here.

For a large percentage of mail, ARC is unnecessary, even when
forwarded through an intermediary.  The mail will continue to DMARC
pass, or the mail will not be for a DMARC p=reject domain.

I think that issuing a temp fail instead of a perm fail on a DMARC
reject if the arc chain may have allowed a local policy override is
useful, but to temp fail all arc dns failures may be more harmful than
helpful.

I think I used the dns failure case as a place where cv=fail instead
of just not signing was actually more harmful, but that seemed more
complicated than others were willing to go.

Of course, passing the dns failure from a separate arc milter to a
dmarc milter to make that determination is complicated, though in
authres terms, we could use an arc=tempfail result to pass that info
on.

Brandon

---

From: "Kurt Andersen (b)" <[email-masked]>
Date: Mon, 31 Jul 2017 21:56:51 -0700

On Mon, Jul 31, 2017 at 4:41 PM, Brandon Long <[email-masked]> wrote:

> >    conversation with the sending system.
>

Good point - you highlighted that my implicit thought related to the "is
needed for ARC validation" does not adequately convey the consideration
that "ARC validation" is only needed when DMARC itself does not pass. I
will adjust the wording to be more explicit.

Does that additional piece change your concern about returning a 421? I
wanted to be a bit more forceful than just saying "MAY" in order to
encourage DMARC (and possibly ARC if needed for local policy) evaluation
during the SMTP session as operators implement ARC.

--Kurt

---

From: Scott Kitterman <[email-masked]>
Date: Tue, 01 Aug 2017 05:59:04 +0000

>during the SMTP session as operators implement ARC.

If I understand correctly, the desired behavior is don't reject (5xx) a message due to an ARC related DNS  failure.  Why not put it that way?  It seems like it would be clearer and simpler to specify it that way.

Scott K