Subject: Re: [dmarc-ietf] DMARC forensic reports (ruf=) and privacy

From: Дилян Палаузов <[email-masked]>
Date: Tue, 05 Feb 2019 08:06:46 +0000

Hello John,

On Sat, 2019-01-26 at 11:31 -0500, John Levine wrote:
> …  The failure reports are almost
> entirely useless.  Of the ones I get, the majority are random Chinese
> spam that happened to forge one of my domains on the From line, the
> rest are from mailing lists where I wouldn't expect DMARC to pass.

You have published DNS TXT _dmarc.taugh.com “v=DMARC1; p=none; rf=afrf; rua=
mailto:[email-masked]; ruf=mailto:[email-masked]”.

How do you define a useful report and for which purpose do you want to receive reports?  I mean, when does sending
reports to p=none make sense.

Regards
  Дилян

---

From: "John Levine" <[email-masked]>
Date: 5 Feb 2019 20:01:10 -0500

>How do you define a useful report and for which purpose do you want to receive reports? 

A useful report would be one that was a message that one of my users
had actually sent and was smashed in a way I didn't expect.

> I mean, when does sending reports to p=none make sense.

The feedback reporting doesn't depend on the policy.  Please review
section 7 of RFC 7489.

---

From: Дилян Палаузов <[email-masked]>
Date: Wed, 06 Feb 2019 22:11:55 +0000

Hello John,

DMARC reports for p=none are not supposed to be useful, as they do not depend on the policy.

If the question is about how to get reports on failing DKIM validation only on unexpectedly smashed messages, then I
recall the last discussion on [email-masked]:

- this is not DMARC, but DKIM domain
- when the DKIM-Signature does not validate, contains r=y and the remainign provisions from RFC6651 do apply, a
(usefull) report shall be sent
- when a message is intentionally modified, in way that the DKIM-Signature gets invalidated, the modified message shall
adapt somehow the fact that it was intentionally modified for particular DKIM-Signatures, so that no useless report is
sent
- Nobody wants to modify DKIM-Signature, so it is unclear where to add the information that the message was
intentionally smashed in regards the first and second DKIM-Signature, but not for the third one.

I proposed at the time to add a r=a tag, sending only report, when DKIM aligns to From:, so that after passing a MLM
rewriting From: no reports shall be sent (contrary to r=y).  Now I realize, that for p=none there is no added
usefulness, since
- DKIM-Signature gets usually intentionally broken, while passing over the MLM, and
- From: is not rewritten, therefore From: alignes to the signature,

so a useless report will be sent for the message.

Regards
  Дилян

On Tue, 2019-02-05 at 20:01 -0500, John Levine wrote:
> _______________________________________________
> dmarc mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/dmarc

---

From: Scott Kitterman <[email-masked]>
Date: Wed, 06 Feb 2019 22:28:00 +0000

I completely disagree.

I have p=none and I find the reports very useful.

The policy is about action taken, not DMARC results, which is what feedback is about.

Scott K

On February 6, 2019 10:11:55 PM UTC, "Дилян Палаузов" <[email-masked]> wrote:
>If the question is about how to get reports on failing DKIM validation
>only on unexpectedly smashed messages, then I
>- when the DKIM-Signature does not validate, contains r=y and the
>remainign provisions from RFC6651 do apply, a
>- when a message is intentionally modified, in way that the
>DKIM-Signature gets invalidated, the modified message shall
>adapt somehow the fact that it was intentionally modified for
>particular DKIM-Signatures, so that no useless report is
>sent
>I proposed at the time to add a r=a tag, sending only report, when DKIM
>aligns to From:, so that after passing a MLM
>rewriting From: no reports shall be sent (contrary to r=y).  Now I
>realize, that for p=none there is no added
>usefulness, since

---

From: "John Levine" <[email-masked]>
Date: 6 Feb 2019 18:25:52 -0500

>DMARC reports for p=none are not supposed to be useful, as they do not depend on the policy.

Sorry, but that assertion is completely wrong.  Please see RFC 7489.

>recall the last discussion on [email-masked]:

No, that is not the question.  Please review the previous messages.

R's,
John

---

From: Brandon Long <[email-masked]>
Date: Thu, 7 Feb 2019 17:33:34 -0800

The reason you want reports at p=NONE is so that you can fix the issues and
then move on to higher enforcement levels.

And mailing lists aren't the only way that messages can be modified.

Brandon