Subject: Re: [dmarc-ietf] Abolishing DMARC policy quarantine

From: Hector Santos <[email-masked]>
Date: Thu, 01 Aug 2019 09:48:37 -0400

On 7/31/2019 11:32 PM, Murray S. Kucherawy wrote:

> On Sun, Jul 28, 2019 at 6:37 AM Tim Wicinski <[email-masked]
> <mailto:[email-masked]>> wrote:
>
>      From our end user point of view, I'm against abolishing
>     quarantine, even with its current shortcomings.
>
>
> Why's that?
>
> -MSK, also hatless

My opinion.

How the receiver implements mail filters SHOULD always remain as local 
policy.

We have always kept the concept open ended for all the DKIM Author 
Domain policy proposals, including SPF where hard failures (SPF -ALL, 
SSP Exclusive Policy, ADSP DISCARDABLE, DMARC reject/quarantine are 
hard failures) can be handled as follows:

1- Immediate permanent rejection at SMTP
1.1 - with SPF before or after DATA state.
1.2 - with a DKIM POLICY after DATA state
2- Accept at SMTP, disconnect, silent discard.
3- Accept at SMTP, disconnect, import into User's non-primary in-box, 
if any.

With a reject policy, the Author Domain prefers #1 or #2. but it can 
be implemented all three ways by the receiver. The ultimate outcome is 
a domain preference for rejectable failures not to reach the user's 
eye balls.

With quarantine, the Author Domain is requesting #3 type of mail 
handling because of concerns for false positives.  Allow the user to 
see the mail, just in case.

But what if the implementation site does not offer a "Quarantine" mail 
storage capable design model?  If this type of implementation is not 
acceptable per DMARC design specification, then the spec will need to 
state this possibility:

   For Quarantine Policy support, the implementation SHOULD offer a 
multiple
   user mail folder storage and viewing capability. If the implementation
   can not offer quarantine support, then it SHOULD 
__________________________.
   The author domain MUST be aware not all receivers can support a "Junk"
   folder concept were quarantine mail can be separated from the 
user's main
   mail pickup in-box.

So, I think, we should keep the quarantine policy because it does 
allow for the wider desirable design of for Mail Filtering Systems 
where multiple user folders can be supported and also for domains who 
are not yet 100% sure about issuing hard reject/discard directions.

If we take it out, there is still going to be receivers who will 
perform a quarantine concept regardless of a hard reject policy.

-- 
HLS

---

From: Дилян Палаузов <[email-masked]>
Date: Thu, 01 Aug 2019 14:38:08 +0000

Hello Hector,

you state, that a domain owner can request p=quarantine over p=reject because of concers of false positives.

Why shall one have concers about false positives, but will not be willing to fix them?

I do repeat myself, but the way to fix the false positives is to introduce p=reject, see which emails fail and are
returned and then fix the DKIM implementation for that messages.  That said, if you have concerns of false positives and
want to get rid of them, the way to go is do p=reject.  If there are concerns about false positives, but nobody wants to
fix them, you end having an unreliable system.  Besides, I do not see when a false positive happens, due DKIM stuff not
running correctly, whose problem is this:
• Of the sending domain owner,
• Of the user sending the mail (the only one who has nothing to say, except switching the provider),
• Of the site receiving the mail,
• Of the user receiving the mail?

Among several valid answers, a correct one is, that this is a problem of the one who has wrong DKIM implementation and
this is either the sending or the receiving site.  Since the problem is not of the sender, the sender shall have no say.

Note, that quarintining a message for a user, that never checks her spam folder, is equivalent to discarding the message
and for such users the choise is in practice reject or discard.

On Thu, 2019-08-01 at 09:48 -0400, Hector Santos wrote:
> [...]
> If we take quarantine out, there is still going to be receivers who will 

This is not exactly what I’m proposing with abolishing policy quarantine.

I propose, that there are only two policies that can be annouced by the domain owner:
• “none”, meaning that not all mails have DKIM-Signature that alings to From: to that domain
• “not none”, meaning that the domain owner announces, that all messages From: that (sub)domain are supposed to have
valid, aligned DKIM-Signatures.

For pragmatical reasons, the name for “not none” will be “reject”.

Moreover, I propose, that when the policy is “not none”, the recipient decides how to punish messages, that fail DMARC
validation and the specification elaborates the possibilitis.

So, with “not none” policy, some recipients will do hard reject and others not.  Just like sites which have not
deployedd DMARC.

In any case, if the consens is to keep policy quarantine, and the specification states, that implementations can allow
receiving sites to override the policy to reject (or to quarantine) and implementations can allow individual users to
override the policy (to reject or to quarantine), recommending what to do with messages that go simultaneously to users
which have not overridden the policy and to users which have overriden the sender policy, then I am fine.

Regards
  Дилян

---

From: Brandon Long <[email-masked]>
Date: Thu, 1 Aug 2019 13:29:29 -0700

On Tue, Jul 30, 2019 at 1:27 AM Alessandro Vesely <[email-masked]> wrote:

>
> On multiple policies, only 4 of the latter 34 have p=quarantine;
> sp=reject; the
> other 30 have p=reject; sp=quarantine.  By comparison, the previous 73 + 45
> have about the same ratio of p=hard/p=none; 45/28 for reject and 29/16 for
> quarantine, so some 63% of those have p=hard; sp=none.  Can one infer from
> here
> the intent of the 30 p=reject; sp=quarantine?
>

They've validated that all the senders for the main domain are authing, but
haven't done so for the
sub-domains.  Or they don't send from the primary domain.

> My feeling while looking at that data is that 'reject' is sometimes
> considered
> /better/ than 'quarantine', which I don't think is true.  This confusion
> can
> originate from the sequential order implied by that passage of Section
> 6.6.4
> that Steve quoted.  I agree that that Section needs to be amended.  In
> particular, the effect of pct=0 on From: rewriting should be mentioned.

I think many folks do think of it progressively.  For example, quarantine
can be overridden by the
recipient, by filter or manually looking, whereas reject typically can only
be overridden by the
administrator.

Quarantine also means that some percentage of people can fall for the
spam/phish even if it's quarantined,
whereas a reject is never seen by the receiver.

Reject seems to be the end goal, but folks have a hard time getting there
(hence the many companies sprung up
to help people get there).  Quarantine is a stepping stone because of the
ability to override, and the visibility by the
receivers (presumably the point of email is that the receivers want it)

Brandon