Subject: [dmarc-ietf] Fwd: DMARC report format syntax error in ARC draft-10 section 9.3

From: "Peter M. Goldstein" <[email-masked]>
Date: Sun, 18 Mar 2018 10:54:17 -0700

Kurt,

Re: -12, it doesn't appear to capture the feedback in the email Mark
Eissler sent to the list on 2/27.  There was also no on-list reply to his
email that I saw, so I wanted to re-raise the issue.  His email is included
below.

Mark's analysis appears to be on-point, and I think the XML fragment he
references (now in ARC draft-12 section 7.3) should be revised to:

<policy_evaluated>
    <disposition>delivered</disposition>
    <dkim>fail</dkim>
    <spf>fail</spf>
    <reason>
        <type>local_policy</type>
        <comment>arc=pass ams[2].d=d2.example ams[2].s=s1 as[2].d=d2.example
        as[2].s=s2 as[1].d=d1.example as[1].s=s3</comment>
    </reason>
</policy_evaluated>

As he notes, this is consistent with the existing DMARC aggregate report
schema and the source_ip is already captured in an XML element that is a
sibling to <policy_evaluated> per Appendix C of RFC 7489, in the definition
of the complex type RowType.

If you believe this is a correct update, can we get it incorporated into
the draft?  If not, where's the mistake in the above?

Thanks.

Best,

Peter

---------- Forwarded message ----------
From: Mark Eissler <[email-masked]>
Date: Tue, Feb 27, 2018 at 11:55 AM
Subject: [dmarc-ietf] DMARC report format syntax error in ARC draft-10
section 9.3
To: "[email-masked]" <[email-masked]>

Hi. I met some of the members of this WG at M3AAWG #42 last week.

I've been working on implementing several patches to the OpenDKIM, OpenARC,
OpenDMARC milters over the past few weeks as part of my work at Valimail.
I'm currently updating OpenDMARC's reporting to include ARC findings as per
draft-ietf-dmarc-arc-protocol-10 but I've found what looks like a typo in
the example XML report format as provided in section 9.3 of the draft:

<policy_evaluated>
    <disposition>delivered</disposition>
    <dkim>fail</dkim>
    <spf>fail <comment>source.ip=10.0.0.1</comment></spf>
    <reason>
        <type>local_policy</type>
        <comment>arc=pass ams[2].d=d2.example ams[2].s=s1 as[2].d=d2.example
        as[2].s=s2 as[1].d=d1.example as[1].s=s3</comment>
    </reason>
</policy_evaluated>

Specifically, the <spf> element appears to be incorrect as it contains an
embedded <comment> element which not only results in invalid XML syntax but
also implies a schema that isn't defined: the value definition
(DMARCResultType) doesn't provide for the provision of such an element.
Furthermore, the source IP is already captured in the <source_ip>
element--a sibling of <policy_evaluated>.

I think a corrected example would be this:

<policy_evaluated>
    <disposition>delivered</disposition>
    <dkim>fail</dkim>
    <spf>fail</spf>
    <reason>
        <type>local_policy</type>
        <comment>arc=pass ams[2].d=d2.example ams[2].s=s1 as[2].d=d2.example
        as[2].s=s2 as[1].d=d1.example as[1].s=s3</comment>
    </reason>
</policy_evaluated>

-mark

 --
 Mark Eissler | [email-masked] | http://about.me/markeissler

_______________________________________________
dmarc mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/dmarc

---

From: "Kurt Andersen (b)" <[email-masked]>
Date: Sun, 18 Mar 2018 19:00:22 +0100

> email that I saw, so I wanted to re-raise the issue.  His email is included

I've captured this point in https://trac.ietf.org/trac/dmarc/ticket/18. I
have no objections per se, but would like to know whether the group thinks
that the entire section should be removed into its own document (see
https://trac.ietf.org/trac/dmarc/ticket/16#ticket).

--Kurt

---

From: "Peter M. Goldstein" <[email-masked]>
Date: Sun, 18 Mar 2018 11:02:54 -0700

Thanks for capturing.  I agree it makes sense to figure out ticket #16 (
https://trac.ietf.org/trac/dmarc/ticket/16#ticket) first.

Best,

Peter

---

From: Mark Eissler <[email-masked]>
Date: Sun, 18 Mar 2018 19:12:15 +0000

The only thing I'd add is that in discussion with Seth Blank, I've implemented the following format (for now) in an open PR for OpenDMARC that implements this:

<policy_evaluated>
    <disposition>delivered</disposition>
    <dkim>fail</dkim>
    <spf>fail <comment>source.ip=10.0.0.1</comment></spf>
    <reason>
    <type>local_policy</type>
    <comment>
        arc=[status] as[N].d=dN.example.com as[N].s=sN .. as[1].d=d1.example.com as[1].s=s1
     </comment>
    </reason>
 </policy_evaluated>

-mark

From: dmarc <[email-masked]> on behalf of Peter M. Goldstein <[email-masked]>
Sent: Sunday, March 18, 2018 11:02:54 AM
To: Kurt Andersen (b)
Cc: [email-masked]
Subject: Re: [dmarc-ietf] Fwd: DMARC report format syntax error in ARC draft-10 section 9.3

Thanks for capturing.  I agree it makes sense to figure out ticket #16 (https://trac.ietf.org/trac/dmarc/ticket/16#ticket)  first.

Best,

Peter 

On Sun, Mar 18, 2018 at 11:00 AM, Kurt Andersen (b)  <[email-masked]> wrote:

On Sun, Mar 18, 2018 at 6:54 PM, Peter M. Goldstein <[email-masked]> wrote:

Kurt,

Re: -12, it doesn't appear to capture the feedback in the email Mark Eissler sent to the list on 2/27.  There was also no on-list reply to his email that I saw, so I wanted to re-raise the issue.  His email is included below.  

I've  captured this point in https://trac.ietf.org/trac/dmarc/ticket/18. I have no objections per se, but would like to know whether the group thinks that the entire section should be  removed into its own document (see https://trac.ietf.org/trac/dmarc/ticket/16#ticket).

--Kurt