Subject: Re: [dmarc-ietf] Reporting DMARC policy in A-R header fields

From: Alessandro Vesely <[email-masked]>
Date: Thu, 1 Aug 2019 09:39:59 +0200

On Wed 31/Jul/2019 12:46:00 +0200 Scott Kitterman wrote:

>> Would it be possible to add a result of "quarantine"?  Having dmarc=fail
>> and dns.policy=quarantine leaves a good deal of interpretation to the MDA.
>>  If one could write dmarc=quarantine, a simple string search or regular 
>> expression would do.
> That's a great example of why dns.policy= isn't the way to go.  It's too
> generic.  If it's dmarc.policy=quarantine, there's no ambiguity.

"dmarc" is already found in the methodspec.  See below.

> You can't put quarantine as the DMARC result, because that's not what it is.
> The DMARC result is pass/fail/none. 

A tentative regex (assuming untrusted ones removed, and no deceptive comments) can be:

if (/^Authentication-Results:.*dmarc\s*=\s*fail[^;]*dmarc\.policy\s*=\s*quarantine/)
	to "./Maildir/.Junk";

You can see that spelling the ptype is redundant.  While it is important to report which published policy was applied, the choice of ptype boils down to a question of taste.  At any rate, the code exemplified above is still too complicate to beat a well crafted comment.  Consider:

Authentication-Results: example.com;
   dmarc=fail dmarc.policy=quarantine (dmarc=quarantine);

and

if (/^Authentication-Results:.*dmarc\s*=\s*quarantine/)
	to "./Maildir/.Junk";

Since you mentioned that conveying the outcome of the method in a comment is not cool, I proposed to convey it in the result.  I understand that the semantics of results aspired to be boolean, pass and non-pass.  The existing flavors of non-pass, none, temperror, permerror and fail, exist in order to suggest the appropriate action.  To quarantine is one appropriate action.

Best
Ale
--

---

From: "John Levine" <[email-masked]>
Date: 1 Aug 2019 23:14:01 -0400

Catching up on my mail after a laptop disaster, ...

In article <4600949.rz9u5RyGOV@l5580> you write:
>I think comments should be free-form.  If we want data that can be machine 
>parsed, we should specify it.
>
>I think the above works in ABNF terms.  It's:
>
>Authentication-Results:" authserv-id; method=result ptype.property=value 
>ptype.property=value

I agree.  We all put the DKIM stuff in comments but that's silly.  If
it's worth recording, it's worth doing in a way that we all agree
about and can parse.

R's,
John
-- 
Regards,
John Levine, [email-masked], Primary Perpetrator of "The Internet for Dummies",
Please consider the environment before reading this e-mail. https://jl.ly

---

From: "Stan Kalisch" <[email-masked]>
Date: Fri, 02 Aug 2019 02:23:37 -0400

> it's worth recording, it's worth doing in a way that we all agree

Yes please.

Stan

---

From: tjw ietf <[email-masked]>
Date: Fri, 2 Aug 2019 07:26:28 -0400

+1

No hats

From my high tech gadget

> On Aug 2, 2019, at 02:23, Stan Kalisch <[email-masked]> wrote:
> 
> _______________________________________________
> dmarc mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/dmarc