Subject: [dmarc-ietf] ESC for Failed DMARC Validation

From: Дилян Палаузов <[email-masked]>
Date: Fri, 02 Aug 2019 16:00:11 +0000

Hello,

why sites do not sent failure reports?

Will a site, not sending failure report, be willing to use an Enhanced Status Code, to signal, that the DKIM/SPF
implementations of the receiver and sender disagree?

* * * New Enhanced Status Code for Failed DMARC Validation

Code: X.7.30
Assocaited basic status code: Any
Description:  Used as partial substitution to failure reports, when DMARC validation fails.  250 2.7.30 means, that the
message was delivered, ordinary or as junk, despite failed DMARC validation. 550 5.7.30 is used when the message is
rejected, because the DMARC validation failed.  This status code is only usefull, when the receiving site does not send
failure reports.

Regards
  Дилян

---

From: Alessandro Vesely <[email-masked]>
Date: Fri, 2 Aug 2019 19:18:24 +0200

Hi Dilyan,

I'm not clear if you refer to the "DSN" extension (rfc3461).  In fact, positive
DSNs contain the A-R header field, and so can inform the sender when a message
is accepted although some of SPF/ DKIM/ DMARC failed.

I don't send failure reports, as they look plenty of privacy risks.  Perhaps
they could be sent to trusted sites only, but that way they'd lose generality.

It's unfortunate that FR seem to be the only means to tell unwanted failures
from real spam/ phishing successfully blocked by the protocol.  Perhaps that
distinction could be added to aggregate reports, even if it's not an exact science.

Best
Ale

--

---

From: Дилян Палаузов <[email-masked]>
Date: Fri, 02 Aug 2019 17:52:08 +0000

Hello Alessandro,

I mean an enhanced status code, as at 
https://www.iana.org/assignments/smtp-enhanced-status-codes/smtp-enhanced-status-codes.xhtml .

Would you reply to messages failing DMARC with such a code, irrespective of whether the message was accepted or
rejected?  Are there privacy risks connected with such ESC?

Regards
  Дилян

---

From: "Murray S. Kucherawy" <[email-masked]>
Date: Fri, 2 Aug 2019 13:01:41 -0700

> https://www.iana.org/assignments/smtp-enhanced-status-codes/smtp-enhanced-status-codes.xhtml

RFC7372 registered some for exactly this purpose (though not specific to
DMARC).  Its Security Considerations section talks about the privacy risks.

I don't know if they're actually in use.

-MSK

---

From: Дилян Палаузов <[email-masked]>
Date: Fri, 02 Aug 2019 20:19:26 +0000

Hello Murray,

ESC X.7.20, X.7.21 and X.7.22 are glued to return code 550, while I propose an ESC, that works also with 250.

Apart from this, X.7.20 and X.7.21 cannot be used instead of the proposed X.7.30:

If a site sees a valid DKIM signature, and previous experience with the domain signing DKIM leads to increased trust in
this domain, then the signature is acceptable, but it does not have to align with the From: address.

With X.7.22:

      Description:        This status code is returned when a message
                          contains one or more passing DKIM
                          signatures, but none are acceptable because
                          none have an identifier(s)
                          that matches the author address(es) found in
                          the From header field.  This is a special
                          case of X.7.21. (This violates the advice
                          of Section 6.1 of RFC 6376.)

If “none have an identifier that matches the author address found in the From header field” means, that the DKIM part of
DMARC fails, then this ESC can be recommended by the DMARC specification to signal to the sender, that the DKIM
implementations of sender and receiver disagree, as a light substitute to the failure reports.

Greetings
  Дилян

On Fri, 2019-08-02 at 13:01 -0700, Murray S. Kucherawy wrote:
> On Fri, Aug 2, 2019 at 10:52 AM Дилян Палаузов <[email-masked]> wrote:
> RFC7372 registered some for exactly this purpose (though not specific to DMARC).  Its Security Considerations section talks about the privacy risks.
> 
> _______________________________________________
> dmarc mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/dmarc

---

From: "Murray S. Kucherawy" <[email-masked]>
Date: Fri, 2 Aug 2019 13:54:58 -0700

The wording you're using seems inconsistent to me.  Specifically, you're
saying that x.7.30 means one thing when attached to a 200-series reply, but
the opposite when attached to a 500-series reply.  I would prefer to see
two separate codes if you're going to do this.

But the bigger question is implementation.  Who would make use of this,
either as a sender or a receiver?

-MSK

On Fri, Aug 2, 2019 at 1:19 PM Дилян Палаузов <[email-masked]>
wrote:

> Hello Murray,
>
> ESC X.7.20, X.7.21 and X.7.22 are glued to return code 550, while I
> propose an ESC, that works also with 250.
>
> If a site sees a valid DKIM signature, and previous experience with the
> domain signing DKIM leads to increased trust in
> If “none have an identifier that matches the author address found in the
> From header field” means, that the DKIM part of

---

From: "Rolf E. Sonneveld" <[email-masked]>
Date: Fri, 2 Aug 2019 23:06:27 +0200

On 02-08-19 22:54, Murray S. Kucherawy wrote:
> The wording you're using seems inconsistent to me.. Specifically, 
> you're saying that x.7.30 means one thing when attached to a 
> 200-series reply, but the opposite when attached to a 500-series 
> reply.  I would prefer to see two separate codes if you're going to do 
> this.
>
> But the bigger question is implementation.  Who would make use of 
> this, either as a sender or a receiver?

a receiver could assist a sender in adjusting its egress mail process 
without the need for the receiver to collect a lot of DMARC reports and 
analyse them. A sender could use it to improve its outbound mailflow. I 
doubt however whether anyone will implement this as it assists possible 
adversaries as well...

/rolf

---

From: Дилян Палаузов <[email-masked]>
Date: Fri, 02 Aug 2019 21:27:48 +0000

Hello,

these are already now two ESC: 2.7.30 and 5.7.30.  X.7.30 means in both cases, that DMARC validation failed.

For a domain with policy p=reject; pct=0 the mail is delivered (250 2.7.30), despite failed DMARCр and for a domain with
p=reject; pct=100 when DMARC failed and the mail is rejected (550 5.7.30).

Please propose a different wording, I do not see a contradiction in my wording.

Who will use it?

I asked, why failure reports are not sent by some sites, and would the ones, who do not send failure reports, use the
X.7.30 code. (Thus, if for failure reports there are concerns, while for ESC X.7.30 there are no concerns).

I expect that at least parties who want to fix their DMARC/DKIM implementation will use it.  The aggregate reports
provide hints, that the DKIM implementation does not work.

This ESC is not meant as a shortcut to collecting a lot of reports and analyzing them, it is a mean to act when no
reports are sent.

Regards
  Дилян

---

From: Alessandro Vesely <[email-masked]>
Date: Sat, 3 Aug 2019 18:27:01 +0200

Hi,

> p=reject; pct=100 when DMARC failed and the mail is rejected (550 5.7.30).

A message can be rejected as soon as a reason to do so it is found.  That
principle uniquely defines the reject response.  The accept response cannot
collect what every filter thought about the message.  To act as you propose,
the DMARC filter should be granted the special privilege to set the text of the
response in any case.

On Courier-MTA there's no API to support that.  Do Postfix or Sendmail provide
one?  I doubt, since SMTP doesn't attach a special significance to the text of
the response, except for the 220, 221, 251, 421, and 551 reply codes.

Best
Ale
--

---

From: Дилян Палаузов <[email-masked]>
Date: Sun, 04 Aug 2019 10:26:07 +0000

Hello Alessandro,

if a site wants to emit X.7.30, it will find a way to do so (sometimes or always).

I prefer an ESC over an SMTP service extension, since I consider ESCs as much easier to implement and otherwise both
options are the same.

Regards
  Дилян