Subject: [dmarc-ietf] Is there any recommendation to send DMARC message-specific failure reports FROM:<> ?

From: Dilyan Palauzov <[email-masked]>
Date: Sat, 25 May 2019 18:35:56 +0000

Hello,

is there already any recommendation from IETF to send DMARC  
message-specific failure individual (non-aggregate) reports with  
FROM:<> (or NOTIFY=NEVER)?

Consider this scenario: an email from a domain, with DMARC policy  
“p=reject; ruf=postmaster@domain” fails validation.  A  
message-specific report is sent to postmaster@domain.  The report is  
bounced (or there is any reply on it) and the reply is again From:  
that domain and does not validate DMARC.  In turn a new  
message-specific report is sent and this loop ends, when some disk  
gets full.  With FROM:<> or NOTIFY=NEVER there would be no such loop.

Note, that DMARC aggregate reports do not have this problem.

Regards
   Дилян

---

From: "John Levine" <[email-masked]>
Date: 25 May 2019 17:53:17 -0400

>gets full.  With FROM:<> or NOTIFY=NEVER there would be no such loop.

The trickle of failure reports I get are from addresses like these:

[email-masked]
[email-masked]
[email-masked]
[email-masked]
prvs=1020be0dc4=[email-masked]

I would expect that any mail sent to those addresses is unlikely to
provoke a failure report, no matter how mangled it is when it arrives.

We've had failure reports for almost seven years and I don't ever
recall someone getting into a mail loop so it's not a problem in
practice.

---

From: Dilyan Palauzov <[email-masked]>
Date: Sun, 26 May 2019 05:09:58 +0000

Hello John,

in case of modernwebsite.pl:

DNS TXT _dmarc.modernwebsite.pl is "v=DMARC1; p=reject; pct=100;  
rua=mailto:[email-masked];  
ruf=mailto:[email-masked]; aspf=s;adkim=s;"

Emails to [email-masked] are answered with “Undelivered  
Mail Returned to Sender”.  The answers do not align to the DMARC  
policy reject, so a new message-specific failure repot is sent.

The loop happens, when you do send failure reports, not just receiving such.

Regards
   Дилян

----- Message from John Levine <[email-masked]> ---------
    Date: 25 May 2019 17:53:17 -0400
    From: John Levine <[email-masked]>
Subject: Re: [dmarc-ietf] Is there any recommendation to send DMARC  
message-specific failure reports FROM:<> ?
      To: [email-masked]
      Cc: [email-masked]

> In article  
> <[email-masked]> you  
> write:
> _______________________________________________
> dmarc mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/dmarc

----- End message from John Levine <[email-masked]> -----

---

From: Grant Taylor <[email-masked]>
Date: Sat, 25 May 2019 23:20:50 -0600

On 5/25/19 11:09 PM, Dilyan Palauzov wrote:
> Mail Returned to Sender”.  The answers do not align to the DMARC policy 
> reject, so a new message-specific failure repot is sent.

Are the reports that you are sending being accepted at SMTP time and 
then bounced after the fact?

That sounds like (what I think is) a misconfiguration on their end.

As such, I'm less inclined to think that modifying DMARC is the proper 
thing.  Especially if this is a rare occurrence (as in a very select 
candidate).

-- 
Grant. . . .
unix || die

---

From: Дилян Палаузов <[email-masked]>
Date: Sun, 26 May 2019 08:28:29 +0300

Hello Grant,

it is a misconfiguration, but it still creates a mail loop for the site, that is not misconfigured.

To what I can say the emails are accepted at SMTP time and then bounced.

I  not asking to modify DMARC, but to recommend sending message-specific, individual failure reports FROM: <>, in order to be protected from “misconfiguration attacks”.

Regards
  Дилян

On May 26, 2019 8:20:50 AM GMT+03:00, Grant Taylor <gtaylor=[email-masked]> wrote:
>policy

---

From: "John Levine" <[email-masked]>
Date: 26 May 2019 10:44:39 -0400

>policy reject, so a new message-specific failure repot is sent.

Just out of curiosity, where do the reports come from?  I see their
SPF record says "mx a".

---

From: "John Levine" <[email-masked]>
Date: 26 May 2019 10:46:09 -0400

In article <[email-masked]> you write:
>-=-=-=-=-=-
>I  not asking to modify DMARC, but to recommend sending message-specific, individual failure reports FROM: <>, in
>order to be protected from “misconfiguration attacks”.

Given that we've seen one report loop in seven years, my inclination
would be to suggest that you simply blackhole whatever IP their
bounces are coming from and leave it at that.

-- 
Regards,
John Levine, [email-masked], Primary Perpetrator of "The Internet for Dummies",
Please consider the environment before reading this e-mail. https://jl.ly

---

From: Dilyan Palauzov <[email-masked]>
Date: Sun, 26 May 2019 19:00:56 +0000

Hello John,

at SMTP level the server communicates EHLO mail.modernwebsite.pl and  
ENVFROM:<>.  There is no TXT record for mail.modernwebsite.pl so SPF  
fails and cannot align.

The email itself contains “From: [email-masked] (Mail  
Delivery System)” without DKIM signature. ⇒ DMARC validation fails.

You can give it a try and send yourself a message to  
“[email-masked]”, the answer will be
   <[email-masked]> (expanded from <[email-masked]>):
     unknown user: "template"

Unfortunately I had another loop back in September 2018.  I do not  
remember the details.  Given that this can happen again to somebody  
else, it is better to have recommendation sending the message-specific  
reports with FROM:<> or NOTIFY=NEVER, or at least some text  
elaborating on the attack.

Regards
   Дилян

----- Message from John Levine <[email-masked]> ---------
    Date: 26 May 2019 10:44:39 -0400
    From: John Levine <[email-masked]>
Subject: Re: [dmarc-ietf] Is there any recommendation to send DMARC  

> In article  
> <[email-masked]> you  
> write:
>> Hello John,
>>

----- End message from John Levine <[email-masked]> -----

---

From: Juri Haberland <[email-masked]>
Date: Sun, 26 May 2019 23:26:56 +0200

> recall someone getting into a mail loop so it's not a problem in

I had at least two or three mail loops caused by failure reports sent to
some small sites (as my is) and that was the reason for me to stop sending
failure reports.

Just my 2 cents,
  Juri

---

From: Scott Kitterman <[email-masked]>
Date: Mon, 27 May 2019 04:46:38 +0000

They should publish an SPF record for mail.modernwebsite.pl.  Publishing SPF to support HELO checks has been recommended since before RFC 4408.  I'm pretty sure that avoids the problem.  You'd get an SPF pass and it would align.

Scott K

On May 26, 2019 7:00:56 PM UTC, Dilyan Palauzov <[email-masked]> wrote:
>ENVFROM:<>.  There is no TXT record for  so SPF  
>fails and cannot align.
>

---

From: "John Levine" <[email-masked]>
Date: 27 May 2019 15:21:49 -0400

In article <[email-masked]> you write:
>that domain and does not validate DMARC. 

On further consideration, I was reminded about all the mail loops I
had to deal with back when I was running autoresponders.  What I
discovered is that there is nothing you can put in your messages which
will prevent mail loops, since there will always be someone at the
other end that will respond anyway.

What you have to do is rate limit.  For example, if you see that
you've sent more than five failure reports in an hour to a particular
address, don't send any more reports to that address during the next
hour, even if mail comes in that would get a report.

You can tune the time period and threshhold, but so long as the time
period is longer than a cycle of the mail loop, they don't matter
much.