Subject: [dmarc-ietf] spec nit - which DKIM to report

From: Tomki <[email-masked]>
Date: Fri, 21 Jun 2019 11:15:03 -0700

As mentioned by Elizabeth recently:  (Elizabeth please chime in if this 
doesn't capture your meaning)

the spec does not define *which* DKIM signature should be reported in 
the DMARC RUA created by a receiver.  The proposed resolution to this is 
that if the receiver does not provide the complete set of DKIM 
signatures found, they should provide (in order of preference)
1. a signature which passed DKIM in strict alignment with the From: 
header domain
2. a signature which passed DKIM in relaxed alignment with the From: 
header domain
3. some other signature that passed DKIM
4. some other signature that didn't pass DKIM

--Tomki

---

From: "John Levine" <[email-masked]>
Date: 21 Jun 2019 14:46:26 -0400

>4. some other signature that didn't pass DKIM

This seeems overcomplex.  How about saying the reports SHOULD include
all valid DKIM reports.  If they can't, they can't, and I don't see
any benefit in offering advice on how not to comply.

---

From: Elizabeth Zwicky <[email-masked]>
Date: Fri, 21 Jun 2019 12:06:13 -0700

I believe they MUST contain any aligned DKIM signature regardless of validity and SHOULD  contain an entry for each domain, selector, result triple. 

Elizabeth 

> On Jun 21, 2019, at 11:46 AM, John Levine <[email-masked]> wrote:
> 
> _______________________________________________
> dmarc mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/dmarc

---

From: "John R Levine" <[email-masked]>
Date: 21 Jun 2019 15:11:43 -0400

> I believe they MUST contain any aligned DKIM signature regardless of validity and SHOULD  contain an entry for each domain, selector, result triple.

RFC 7489 says:

    The report SHOULD include the following data:

    o  The DMARC policy discovered and applied, if any

    o  The selected message disposition

    o  The identifier evaluated by SPF and the SPF result, if any

    o  The identifier evaluated by DKIM and the DKIM result, if any

    o  For both DKIM and SPF, an indication of whether the identifier was
       in alignment

(and a bunch of other stuff)

I don't see any basis to change this, since as long as the report's format 
and syntax are correct, it'll interoperate.  It may not have all the hints 
the report's recipient would like, but life is like that.

R's,
John

---

From: Elizabeth Zwicky <[email-masked]>
Date: Fri, 21 Jun 2019 12:15:19 -0700

The problem with that language is that
>  o  The identifier evaluated by DKIM and the DKIM result, if any

is genuinely unclear. Often there are multiple identifiers. Does this mean I can pick any one of them? (That does not actually provide sufficient interoperability.) If there’s a specific one I should pick, which is it?

Elizabeth 

On Jun 21, 2019, at 12:11 PM, John R Levine <[email-masked]> wrote:

> I don't see any basis to change this, since as long as the report's format and syntax are correct, it'll interoperate.  It may not have all the hints the report's recipient would like, but life is like that.
> 
> R's,
> John

---

From: "John R Levine" <[email-masked]>
Date: 21 Jun 2019 15:24:06 -0400

> is genuinely unclear. Often there are multiple identifiers. Does this mean I can pick any one of them? (That does not actually provide sufficient interoperability.) If there’s a specific one I shou…

How about we change identifier to identifiers?

R's,
John

>> I don't see any basis to change this, since as long as the report's format and syntax are correct, it'll interoperate.  It may not have all the hints the report's recipient would like, but life is…

Regards,
John Levine, [email-masked], Taughannock Networks, Trumansburg NY
Please consider the environment before reading this e-mail. https://jl.ly

---

From: Дилян Палаузов <[email-masked]>
Date: Fri, 21 Jun 2019 19:54:47 +0000

Hello,

what is the purpose of the aggregate reports (rua)?

Regards
  Дилян