Subject: Re: [dmarc-ietf] Abolishing DMARC policy quarantine

From: "Murray S. Kucherawy" <[email-masked]>
Date: Wed, 24 Jul 2019 11:27:13 -0400

On Fri, Jun 14, 2019 at 12:25 PM Vladimir Dubrovin <dubrovin=
[email-masked]> wrote:

> Nope, I mean 2 different things.
>
> 1. Why quarantine is useful (with pct=0).
>
> For example this mailing list ([email-masked]) performs From rewrite (aka
> From munging), e.g. [email-masked] is replaced with
> dubrovin=[email-masked]. It's because corp.mail.ru has a
> strict DMARC policy (reject). [email-masked] is not overwritten,
> because gmail.com has p=none and ietf.org only overwrites From only for
> domains with "quarantine" and "reject" policies. It's quite common behavior.
>
> If you are implementing DMARC for a new domain (let's say example.org),
> you usually start with "p=none". With p=none you receive reports for failed
> DMARC for different lists, like ietf.org. Before switching to stronger
> policy (p=reject), you may want to know which mailing list will still fail
> DMARC, and which lists perform From munging and, as a result, do not fail
> DMARC. For this purpose, before switching to "p=reject" it's useful to
> switch to "p=quarantine;pct=0". After this, you will only see mailing lists
> without From munging in DMARC reports.
>

I'm confused; is this claiming that those rewrites happen by virtue of the
fact that "p=quarantine" is the published policy?  Seems to me that
rewriting will happen irrespective of what the published policy is for the
>From domain.

Or is it the case that this changes the content of the aggregate reports in
a way you find meaningful?

-MSK

---

From: Vladimir Dubrovin <[email-masked]>
Date: Wed, 24 Jul 2019 19:36:56 +0300

Hello Murray,

Yes, rewriting depends on policy. Look at From: headers for this mailing
list ([email-masked]), you can see it only munges From address for
domain with strict DMARC policy (if RFC5322.From domain publishes
"quarantine" or "reject" policy). This is very common behavior, it can
also be seen in Google Groups.

But, as it was correctly pointed by Dilyan Palauzov, there should be no
difference between "p=quarantine;pct=0" and "p=reject;pct=0" for valid
DMARC Mail Receiver implementation, so "p=reject;pct=0" can probably be
used instead.

24.07.2019 18:27, Murray S. Kucherawy пишет:
> On Fri, Jun 14, 2019 at 12:25 PM Vladimir Dubrovin
> <dubrovin=[email-masked]
> <mailto:[email-masked]>> wrote:
>
>     For example this mailing list ([email-masked]
>     <mailto:[email-masked]>) performs >From rewrite (aka From
>     munging), e.g. [email-masked]
>     <mailto:[email-masked]> is replaced with
>     dubrovin=[email-masked]
>     <mailto:dubrovin=[email-masked]>. It's because
>     corp.mail.ru <http://corp.mail.ru> has a strict DMARC policy
>     (reject). [email-masked] <mailto:[email-masked]> is not
>     overwritten, because gmail.com <http://gmail.com> has p=none and
>     ietf.org <http://ietf.org> only overwrites From only for domains
>     with "quarantine" and "reject" policies. It's quite common behavior.
>
>     If you are implementing DMARC for a new domain (let's say
>     example.org <http://example.org>), you usually start with
>     "p=none". With p=none you receive reports for failed DMARC for
>     different lists, like ietf.org <http://ietf.org>. Before switching
>     to stronger policy (p=reject), you may want to know which mailing
>     list will still fail DMARC, and which lists perform From munging
>     and, as a result, do not fail DMARC. For this purpose, before
>     switching to "p=reject" it's useful to switch to
>     "p=quarantine;pct=0". After this, you will only see mailing lists
> I'm confused; is this claiming that those rewrites happen by virtue of
> the fact that "p=quarantine" is the published policy?  Seems to me
> that rewriting will happen irrespective of what the published policy
> is for the From domain.
>
> Or is it the case that this changes the content of the aggregate
> reports in a way you find meaningful?
>
> -MSK
>
> _______________________________________________
> dmarc mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/dmarc

-- 
Vladimir Dubrovin
@ mail.ru

---

From: Дилян Палаузов <[email-masked]>
Date: Wed, 24 Jul 2019 16:52:27 +0000

Hello,

(I repeat what was said here, just in case)
 
As it was pointed out, p=quarantine; pct=0; is the same as p=none; and p=reject; ptc=0; is the same as p=quarantine;
pct=100, therefore p=quarantine; pct=0 is not the same as p=reject; pct=0 currently, per 
https://tools.ietf.org/html/rfc7489#section-6.6.4 (RFC DMARC, Section Message Sampling)

And then, for p=none or any equivalent form of it, there is no need or established practice for mungling, while for
p=reject; pct=0, or any equivalent form of it, there is mungling.

This is the current specification.  I proposed on this regard in fact two things:
- specifying that p=quarantine; pct=0 (email from 10th May to dmarc@ietf) the MLM does mungling
- abolishing policy quarantine

That is: p=reject; pct=0 gets almost the same as p=none, except that there is recommendatiton for MLM to mungle From:.

Regards
  Дилян
On Wed, 2019-07-24 at 19:36 +0300, Vladimir Dubrovin wrote:
> 
> Hello Murray,
> 
> Yes, rewriting depends on policy. Look at From: headers for this mailing list ([email-masked]), you can see it only munges From address for domain with strict DMARC policy (if RFC5322.From domain publishes "quarantine" or "reject" policy). This is very common behavior, it can also be seen in Google Groups.
> 
> But, as it was correctly pointed by Dilyan Palauzov, there should be no difference between "p=quarantine;pct=0" and "p=reject;pct=0" for valid DMARC Mail Receiver implementation, so "p=reject;pct=0" can probably be used instead. 
> 
> > On Fri, Jun 14, 2019 at 12:25 PM Vladimir Dubrovin <dubrovin=[email-masked]> wrote:
> > > For example this mailing list ([email-masked]) performs >From rewrite (aka From munging), e.g. [email-masked] is replaced with dubrovin=[email-masked].                 It's because corp.mail.ru has a strict DMARC policy (reject). [email-masked] is not overwritten, because gmail.com has p=none and ietf.org only overwrites From only for domains with "quarantine" and "reject" policies. It's quite common behavior.
> > > 
> > > If you are implementing DMARC for a new domain (let's say example.org), you usually start with "p=none". With p=none you receive reports for failed DMARC for different lists, like ietf.org. Before switching to stronger policy (p=reject), you may want to know which mailing list will still fail DMARC, and which lists perform From munging and, as a result, do not fail DMARC. For this purpose, before switching to "p=reject" it's useful to switch to "p=quarantine;pct=0". After this, you will only see mailing lists without From munging in DMARC reports.
> > > 
> > 
> > I'm confused; is this claiming that those rewrites happen by virtue of the fact that "p=quarantine" is the published policy?  Seems to me that rewriting will happen irrespective of what the published policy is for the From domain.
> > 
> > Or is it the case that this changes the content of the aggregate reports in a way you find meaningful?
> > 
> > -MSK
> > 
> >

---

From: "Murray S. Kucherawy" <[email-masked]>
Date: Wed, 24 Jul 2019 16:07:27 -0400

OK, I see what you're getting at.

It's interesting that the industry has decided to interpret "p=reject;
pct=0" the way we intended "p=quarantine; pct=100".

As for your proposal:

On Wed, Jul 24, 2019 at 12:52 PM Дилян Палаузов <[email-masked]>
wrote:

> And then, for p=none or any equivalent form of it, there is no need or
> established practice for mungling, while for
> That is: p=reject; pct=0 gets almost the same as p=none, except that there
> is recommendatiton for MLM to mungle From:.
>

I'm a little worried about this, but maybe it's just The Way Of Things.  We
had intended the publication of a DMARC policy to be a message from the
ADMD owning a domain name to any ADMD receiving mail from it about how to
handle unauthenticated or unaligned messages.  It's actually morphed on its
own into also being a message to any MLM that might be in the way to take
particular rewriting actions.  I wonder if the standards track version of
DMARC should explicitly take this into account.

-MSK

---

From: Steve Atkins <[email-masked]>
Date: Wed, 24 Jul 2019 21:45:42 +0100

> On Jul 24, 2019, at 9:07 PM, Murray S. Kucherawy <[email-masked]> wrote:
> 
> OK, I see what you're getting at..
> 
> It's interesting that the industry has decided to interpret "p=reject; pct=0" the way we intended "p=quarantine; pct=100".

It's semi-explicitly defined that way in the RFC, isn't it?

Cheers,
  Steve

> 
> As for your proposal:
> 
> On Wed, Jul 24, 2019 at 12:52 PM Дилян Палаузов <[email-masked]> wrote:
> I'm a little worried about this, but maybe it's just The Way Of Things.  We had intended the publication of a DMARC policy to be a message from the ADMD owning a domain name to any ADMD receiving mail from it about how to handle unauthenticated or unaligned messages.  It's actually morphed on its own into also being a message to any MLM that might be in the way to take particular rewriting actions.  I wonder if the standards track version of DMARC should explicitly take this into account..
> 
> -MSK
>

---

From: "Murray S. Kucherawy" <[email-masked]>
Date: Wed, 24 Jul 2019 19:06:44 -0400

> It's semi-explicitly defined that way in the RFC, isn't it?

If so, we should fix it because (a) I don't think that's how we intended
it, and (b) in any case, nothing in there should be only semi-explicit.

-MSK

---

From: Dotzero <[email-masked]>
Date: Wed, 24 Jul 2019 19:27:11 -0400

> it, and (b) in any case, nothing in there should be only semi-explicit.

My recollection is that we definitely did not intend that.

Michael Hammer

---

From: Steve Atkins <[email-masked]>
Date: Thu, 25 Jul 2019 13:53:55 +0100

> On Jul 25, 2019, at 12:06 AM, Murray S. Kucherawy <[email-masked]> wrote:
> 
> On Wed, Jul 24, 2019 at 4:45 PM Steve Atkins <[email-masked]> wrote:
> If so, we should fix it because (a) I don't think that's how we intended it, and (b) in any case, nothing in there should be only semi-explicit.

rfc 7489 6.6.4

"If email is subject to the DMARC policy of "reject", the Mail
   Receiver SHOULD reject the message (see  Section 10.3).  If the email
   is not subject to the "reject" policy (due to the "pct" tag), the
   Mail Receiver SHOULD treat the email as though the "quarantine"
   policy applies.  This behavior allows Domain Owners to experiment
   with progressively stronger policies without relaxing existing
   policy."

It's pretty clear and well-defined; the case we're talking about, "p=reject; pct=0", is
just a special case of this general rule.

All emails will not be subject to the "reject" policy due to the pct=0 tag, so the mail
receiver should treat all emails as though the policy "quarantine" applies (which
is the same as "p=quarantine; pct=100").

Cheers,
  Steve

---

From: Alessandro Vesely <[email-masked]>
Date: Fri, 26 Jul 2019 16:30:36 +0200

> is the same as "p=quarantine; pct=100").

I, for one, had missed that point.  Thanks for clarifying it.

It seems to mean that the resulting steps are, for example:

"p=quarantine; pct=0"  (check From: rewriting)
"p=quarantine; pct=10" (some messages go to the spam folder)
"p=quarantine; pct=20"
...
"p=quarantine; pct=100"
"p=reject; pct=0"      (same as the previous step)
"p=reject; pct=10"     (some messages bounce back)
"p=reject; pct=20"
...

Is that what we want to suggest?  In that case, we should be clearer.  Perhaps
by adding an example in a new appendix.  However, I hardly see the above
sequence as progressive.

I had always considered quarantine and reject to be two more or less similar
alternatives.  Each has its merits and shortcomings, and can be chosen
according to a sender's needs.

An advantage of reject is that one gets NDNs, which are much more universally
adopted than failure reports.  Perhaps a bank or similar transactional sender
would rather prefer reject, because they can timely resend bounced transactions
or notices thereof in order to have their duties accomplished.

OTOH, quarantine lets one forget about delivery, perhaps with a backhanded
thought of recipients rummaging through their spam folders in search of a
missing message.  That style seems to me to better suit ESPs, whose duty is
rather to have a lot of mails sent than to make sure that each message is
acknowledged, albeit they try and maximize the ratio.

IMHO, by abolishing quarantine, we make the protocol less flexible than it is.

Best
Ale
--

---

From: Дилян Палаузов <[email-masked]>
Date: Sun, 28 Jul 2019 10:49:12 +0000

Hello Alessandro,

abolishing policy quarantine means with p=reject that for failed messages there should be some penalty and the receiving
site decides on the form of the penalty, e.g. quarantine or reject.

In fact I see the DMARC specification updated to use consistently some neutral word, like penalty or punishment attached
to p=reject, once p=quarantine is abolished.  This word is then dissected into “quarantine or reject” at the place where
it elaborates on the possible penalties, or how to do reject right.

The penalty could be implemented with reply
550 Message failed DMARC validation and was delivered in the Junk folder of the recipient

This form has the advantage over either quarantine or reject, that for lost messages, the sender can call the recipient
and the recipient can dig for the message.  So the message does not have to be resent and no surprizes happen.  I do not
see how could this reply mess anything, except in the cases where the sender does not speak English.

> IMHO, by abolishing quarantine, we make the protocol less flexible than it is.

If an ESP wants to forget about delivery, the ESP likely does not care whether it has implemented DMARC correctly and
then it does not need quarantine mode.

The penalty is applied to messages that are either sent by spammers or by the domain owner.  If messages are from
spammers, for the domain owner it is irrelevant, what kind of penalty is applied, but for users doing reject means
having to scan less messages in the Junk mailbox.

If messages are from the domain owner and fail DKIM/DMARC validation, the only way to fix DKIM/DMARC is to use policy
reject.	 There is no other way to find out which messages fail DKIM/DMARC, as single message faiulure reports are rarely
sent, and without knowing which messages fail DMARC fixing the problem is unnecessary complicated.

So here, p=quarantine is in fact an option for providers, who do not care, whether they have implemented DMARC
correctly.

All that said:

• Is there a consensus on abolishing policy quarantine?
• If policy quarantine will be kept, will the none>quarantine>reject order be abolished, meaning “quarantine” will not
be handled as softer variant of “reject”?  Meaning with p=reject; pct=30 messages are either delivered or rejected, but
the specification does state anything about quaratining 70% of the failed messages.

The first argument in favour of keeping policy quarantine was exactly this order (quarantine is a softer variant of
reject and before deploying reject one has to exercise with quarantine).

Regards
  Дилян

On Fri, 2019-07-26 at 16:30 +0200, Alessandro Vesely wrote:
> ....
> ....

---

From: Tim Wicinski <[email-masked]>
Date: Sun, 28 Jul 2019 09:36:39 -0400

>From our end user point of view, I'm against abolishing quarantine, even
with its current shortcomings.

Tim
(no hat)

On Sun, Jul 28, 2019 at 8:48 AM Дилян Палаузов <[email-masked]>
wrote:

> Hello Alessandro,
>
> abolishing policy quarantine means with p=reject that for failed messages
> there should be some penalty and the receiving
> In fact I see the DMARC specification updated to use consistently some
> neutral word, like penalty or punishment attached
> to p=reject, once p=quarantine is abolished.  This word is then dissected
> into “quarantine or reject” at the place where
> This form has the advantage over either quarantine or reject, that for
> lost messages, the sender can call the recipient
> and the recipient can dig for the message.  So the message does not have
> to be resent and no surprizes happen.  I do not
> If an ESP wants to forget about delivery, the ESP likely does not care
> whether it has implemented DMARC correctly and
> spammers, for the domain owner it is irrelevant, what kind of penalty is
> applied, but for users doing reject means
> If messages are from the domain owner and fail DKIM/DMARC validation, the
> only way to fix DKIM/DMARC is to use policy
> reject.  There is no other way to find out which messages fail DKIM/DMARC,
> as single message faiulure reports are rarely
> • If policy quarantine will be kept, will the none>quarantine>reject order
> be abolished, meaning “quarantine” will not
> be handled as softer variant of “reject”?  Meaning with p=reject; pct=30
> messages are either delivered or rejected, but
> > > > > It's interesting that the industry has decided to interpret
> "p=reject; pct=0" the way we intended "p=quarantine; pct=100".
> > > >
> > > > If so, we should fix it because (a) I don't think that's how we
> intended it, and (b) in any case, nothing in there should be only
> semi-explicit.
> > >
> > > rfc 7489 6.6.4
> > >

---

From: Alessandro Vesely <[email-masked]>
Date: Tue, 30 Jul 2019 10:27:26 +0200

> 550 Message failed DMARC validation and was delivered in the Junk folder of the recipient

Usually, receiving MTAs drop the message after replying 5xx.

> whether it has implemented DMARC correctly and then it does not need
> quarantine mode.

They may want to protect their brand, avoiding that more spam be attributed to
them than what they actually generated.

> be abolished, meaning “quarantine” will not be handled as softer variant of
> “reject”?  Meaning with p=reject; pct=30 messages are either delivered or
> rejected, but the specification does state anything about quaratining 70% of
> the failed messages.

I can hardly corroborate my analysis by looking at what I received.  My DB of
sending domains has:

96260 domain names, of which
55110 are organizational domains;
 3887 have DMARC records, of which
 3046 have policy 'none',
  418 have policy 'reject',
  271 have policy 'quarantine',
   73 have both 'none' and 'reject',
   45 have both 'none' and 'quarantine',
   34 have both 'quarantine' and 'reject'.

393 of those DMARC domains are not organizational domains, yet 79 of them also
specify sp=.  There is some confusion about how to setup DMARC; some easy howto
seems to be missing.

On multiple policies, only 4 of the latter 34 have p=quarantine; sp=reject; the
other 30 have p=reject; sp=quarantine.  By comparison, the previous 73 + 45
have about the same ratio of p=hard/p=none; 45/28 for reject and 29/16 for
quarantine, so some 63% of those have p=hard; sp=none.  Can one infer from here
the intent of the 30 p=reject; sp=quarantine?

My feeling while looking at that data is that 'reject' is sometimes considered
/better/ than 'quarantine', which I don't think is true.  This confusion can
originate from the sequential order implied by that passage of Section 6.6.4
that Steve quoted.  I agree that that Section needs to be amended.  In
particular, the effect of pct=0 on From: rewriting should be mentioned.

Best
Ale
--

---

From: "Murray S. Kucherawy" <[email-masked]>
Date: Wed, 31 Jul 2019 20:32:14 -0700

> with its current shortcomings.

Why's that?

-MSK, also hatless