Subject: Re: [dmarc-ietf] Aggregate reporting options tag name 'ao'

From: "Freddie Leeman" <[email-masked]>
Date: Wed, 7 Aug 2019 17:31:21 +0200

I agree that messages with both DKIM and SPF pass results can be useful when it comes to validating that everything is (still) in working order. But I come across domains with very high email volumes. So daily reports contain thousands of records that are consuming bandwidth, storage and processing power and in most cases aren't looked at (except for a count maybe). What could be the best of both worlds would be to add a ‘success_fraction’ tag that allows a domain owner to specify a fraction between 0 and 1 (1 being the default) just like https://www.w3.org/TR/network-error-logging/#the-success_fraction-member. I would still receive success reports but a 0.0001 fraction for instance. That will still allow me to detect fluctuation and changes while limiting the amount of records drastically. This would even allow domain owners to block success reports completely by setting a fraction of 0.

Your thoughts?
 
Van: Dotzero [mailto:[email-masked]]
Verzonden: donderdag 1 augustus 2019 00:22
Aan: Дилян Палаузов <[email-masked]>
CC: Freddie Leeman <[email-masked]>; IETF DMARC WG <[email-masked]>
Onderwerp: Re: [dmarc-ietf] Aggregate reporting options tag name 'ao'

Having both passes and failures is incredibly useful. The percentage of failures is very useful. Any set of mail streams will always have some failures. Once you know what the baseline rate for a (sub)domain is, simply seeing changes in that rate will help you identify problems.. An increase in the failure rate is generally either 1) someone trying to abuse your domain name; or 2) something has gone wrong with DKIM signing or someone associated with the domain organization has started sending mail from somewhere without appropriate SPF or DKIM.

Michael Hammer

On Wed, Jul 31, 2019 at 5:24 PM Дилян Палаузов <[email-masked]> wrote:
Hello Fredie,

DMARC limits the amount of servers that can generate emails for a particular domain.  The aggregate reports show to which extend DMARC does work correctly and when it fails for a domain.  The aggregate reports to not tell you how to fix your DKIM implementation, so that sender and receiver agree on the DKIM signature.  The per message failure reports tell you which messages were not signed correctly, so that you can check the DKIM implementation.

I thought some hours ago it could be useful to reduce the amount of reports, by not sending a report when things are 100% correct, but now I am not so sure.

The aggregate reports contain information, if something is not working correctly, but they also prove, if everything is running correctly.  If there is an option to reduce the reports to contain only information about failures, you don’t have a prove, that everything is working correctly.  Let’s say if you write a message to site S and don’t get an aggregate report back, this can mean, that DMARC passed, but it can also mean, that S does not evaluate DMARC or that DMARC failed and S does not send aggregate reports.  Is the lack of success-reports a prove of correctness or not?  I am inclined.

What do you want to do with the information about failures from the DMARC aggregate reports?

Regards
  Дилян

On Wed, 2019-07-31 at 19:31 +0200, Freddie Leeman wrote:
> Hi Дилян,
>  
> Thanks for your input and feedback. Maybe a single tag, that allows the domain owner to avoid receiving aggregate reports for messages that align, would be enough? I personally have little experience with mailing lists which, I understand, can be a real pain when it comes to SPF/DKIM. So would a tag that instructs the receiving party to only send an aggregate report whenever the DMARC policies is applied be a better option?
>  
> Kind regards,
> Freddie
>  
> Van: Дилян Палаузов [mailto:[email-masked]]
> Verzonden: woensdag 31 juli 2019 17:29
> Aan: [email-masked]
> Onderwerp: Re: [dmarc-ietf] Aggregate reporting options tag name 'ao'
>  
> Hello Freddie,
> 
> if a message has 5 DKIM-Signatures, some of them fail DKIM validation and some of them do not align, irrespective of validation status, you want to receive a report for the failed DKIM signatures. The proposed option d is in the DKIM domain. DMARC without alignment is DKIM or SPF. To get a report for failed DKIM signature you put in the DKIM-Signature header r=y. After the mail passes over a mailing list, the signature is invalidated and you get a useless report. Your intension is to limit the amount of useless reports, but this particular option goes in the opposite direction.
> 
> If you remove the SPF records and ensure that each leaving message is signed, you do not need the ao=1 option, as each report on failure will be about DKIM.
> 
> With ao=s whenever a mail is sent to an alias and redirected to another server, you will get a useless report. I am not exactly sure, but I think SPF contained some reporting mechanisms, so this option might duplicate them.
> 
> Perhaps you want to propose a mechanism, that hides the successful deliveries (useless report) and only reports problematic cases?
> 
> Regards
> Дилян
> 
> 
> On July 31, 2019 5:58:18 PM GMT+03:00, Freddie Leeman <freddie=[email-masked]> wrote:
> > Would it be useful to add an ‘ao’ tag name for aggregate reporting options? Something like:
> >  
> > ao:         Aggregate reporting options (plain-text; OPTIONAL; default is "0").
> > Provides requested options for generation of aggregate reports. This tag's content MUST be ignored if a "rua" tag is not specified. The value of this tag is a colon-separated list of characters that indicate aggregate reporting options as follows:
> >  
> > 0: Generate a DMARC aggregate report for every message, regardless of its alignment.
> > 1: Generate a DMARC aggregate report if any underlying authentication mechanism produced something other than an aligned "pass" result.
> > d: Generate a DMARC aggregate report if the message had a signature that failed evaluation, regardless of its alignment.
> > s: Generate a DMARC aggregate report if the message failed SPF evaluation, regardless of its alignment.
> >  
> > This would allow domain owners to save on tons of reports to be handled and processing that are useless in most scenarios. For instance, when I’ve deployed my SPF/DKIM/DMARC policy and I’m pleased with my policie’s results, I would still want to use the reporting to detect and fix changes in my email environment. If a million mails a day are nicely processed with DKIM and SPF aligned, I do not need those entries in my aggregate reports. I’m only interested in the reports where either DKIM or SPF fails. In most scenario’s this will cut data transfer and report processing with more than 99 percent. Whenever there is a bump in the number of reports received, I can detect that something is wrong and I might need to add a host to my SPF policy or need to fix my DKIM signing.
> >  
> > I was amazed that these options weren’t in the current RFC, as these do exist for failure reports. Am I missing something? Is there a reason why this would be a bad idea?
> >  
> > Kind regards,
> > Freddie
> 
> _______________________________________________
> dmarc mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/dmarc

_______________________________________________
dmarc mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/dmarc

---

From: Alessandro Vesely <[email-masked]>
Date: Thu, 8 Aug 2019 12:34:38 +0200

No, wait a minute, what are we talking about?

I've re-browsed this thread, and various passages seem to be talking
about failure reports.  The Network Error Logging is also similar  to
failure reports inasmuch as they talk of logging each instance of a
class of events, or a percentage thereof.  *Aggregate* reports arrive
once a day, and millions of successful messages from a handful of IP
addresses result in a handful of records, reported within a single
message, along with any failures.  The bandwidth difference is
negligible.  Multiply that by the number of mailbox providers, what is it?

I never experimented frequencies higher than once every 24 hours,
neither for the ri= I set, nor for honoring requests —I run the
process once a day.  Anyway, I reckon that sending more often
increases the total amount of data sent, hence the bandwidth.  If it
is problematic to receive all those reports, the protocol should
specify a different sending strategy.  IMHO, that's not the case.

Best
Ale
--

---

From: "Freddie Leeman" <[email-masked]>
Date: Thu, 8 Aug 2019 14:30:51 +0200

Wait, you are right. I was talking about aggregate reports. But since the reports contains a single record per source IP this shouldn't be much data unless the domain has a huge range of (SPF allowed) sources. In case of a large scale abuse the messages would fail both DKIM and SPF and you want those reports, even if there are thousands. Thank you for clearing this up. I think we can put this threat to rest.

-----Oorspronkelijk bericht-----
Van: Alessandro Vesely [mailto:[email-masked]] 
Verzonden: donderdag 8 augustus 2019 12:35
Aan: [email-masked]
Onderwerp: Re: [dmarc-ietf] Aggregate reporting options tag name 'ao'

I've re-browsed this thread, and various passages seem to be talking about failure reports.  The Network Error Logging is also similar  to failure reports inasmuch as they talk of logging each instance of a class of events, or a percentage thereof.  *Aggregate* reports arrive once a day, and millions of successful messages from a handful of IP addresses result in a handful of records, reported within a single message, along with any failures.  The bandwidth difference is negligible.  Multiply that by the number of mailbox providers, what is it?

I never experimented frequencies higher than once every 24 hours, neither for the ri= I set, nor for honoring requests —I run the process once a day.  Anyway, I reckon that sending more often increases the total amount of data sent, hence the bandwidth.  If it is problematic to receive all those reports, the protocol should specify a different sending strategy.  IMHO, that's not the case.

Best
Ale
--