Subject: [dmarc-ietf] Missing report elements and dmarc.org information based on deprecated drafs

From: "Freddie Leeman" <[email-masked]>
Date: Wed, 7 Aug 2019 15:46:35 +0200

I've been digging through the DMARC pre-IETF drafts and IETF drafts and came to the following conclusion:

The following report elements were added to (pre IETF) draft-dmarc-base-00-03 (January 2013) [1]:
* IdentifierType 'envelope_from'
* SPFAuthResultType 'scope'
* DKIMAuthResultType 'selector'
* feedback 'version'

The following report elements were added to IETF draft-kucherawy-dmarc-base-02 (December 2013) [2]:
* PolicyPublishedType 'fo'

I went through the data from the largest suppliers of DMARC aggregate reports in the last 7 days, and came to the disappointing conclusion that emailsrvr.com, google.com, linkedin.com, Yahoo! Inc., and zoho.com NEVER publish the above elements in their DMARC aggregate reports.
It looks like most DMARC report sending organizations (even the DMARC founding contributors like Google, Yahoo! And LinkedIn) based their code on the pre 2013 drafts and haven't touched that code since. This explains why XML elements are missing from their reports and report validation fails. You would expect that as soon as the RFC was published in March 2015, the organizations would have updated to the final XML schema, but unfortunately most didn't. What surprises me even more is that the site dmarc.org holds information and examples that are also based on the deprecated first drafts [3,4]. 

If we can't even publish reliable information on the dmarc.org website and get founding contributors to follow the DMARC RFC guidelines, I think DMARC will not become the reliable standard it should be. I've been in contact with most (large) organizations that fail validation but so far only Comcast has been willing to listen and fix their DMARC reporting. 

[1] https://dmarc.org/draft-dmarc-base-00-03.txt
[2] https://tools.ietf.org/html/draft-kucherawy-dmarc-base-02
[3] https://dmarc.org/wiki/FAQ#receivers (I need to implement aggregate reports, what do they look like?)
[4] https://dmarc.org/dmarc-xml/0.1/rua.xsd

-- Freddie Leeman

---

From: "Murray S. Kucherawy" <[email-masked]>
Date: Wed, 7 Aug 2019 08:54:53 -0700

> came to the following conclusion:

Seems to me the working group has a choice to make here, somewhere between
"reinforce the XML specification as published" and "take the consensus of
what's implemented and publish that as the revised standard".  Either way,
this should certainly be a work item for standards track DMARC.

-MSK

---

From: Alessandro Vesely <[email-masked]>
Date: Thu, 8 Aug 2019 13:11:33 +0200

> this should certainly be a work item for standards track DMARC.

I vote "reinforce the XML specification as published".  I assume that
is going to mean the next, standard track publication, not any
obsolete one.

Best
Ale
--