Subject: [dmarc-ietf] New proposed wording for p=quarantiine

From: Дилян Палаузов <[email-masked]>
Date: Fri, 02 Aug 2019 22:02:15 +0000

Current wording for p=quarantine
      quarantine:  The Domain Owner wishes to have email that fails the
         DMARC mechanism check be treated by Mail Receivers as
         suspicious.  Depending on the capabilities of the Mail
         Receiver, this can mean "place into spam folder", "scrutinize
         with additional intensity", and/or "flag as suspicious".

Amendment to the wording for p=quarantine:

… or reject at SMTP level.  The Domain Owner wishes in addition, that the sender of messages failing DMARC are notified
about the suspicious handling with an appropriate rejection message.  Senders not willing to be notified that their
message is suspicious, shall use the NOTIFY=NEVER service extension.

In the past, Domain Owner could express as wish either to reject or to quarantine.  Considering that from the options:
only reject; only qurantine; and quarantine, while notifying the sender about the suspicious handling of the message;
nobody will choose only to quarantine, the interpretation of what the Domain Owner wishes by publishing quarantine was
changed to include the rejection component.

---

From: "John Levine" <[email-masked]>
Date: 2 Aug 2019 18:49:17 -0400

In article <[email-masked]> you write:
>… or reject at SMTP level. ...

No.  We really, really, don't like changes that aren't backward
compatible.  You can do what you want but there is no chance I would
ever make p=quarantine a signal to reject, and I think I am not
atypical.

R's,
John

PS: You can of course do whatever you want on your own system.

---

From: Дилян Палаузов <[email-masked]>
Date: Sat, 03 Aug 2019 02:06:18 +0000

Hello John,

the "... reject at SMTP level" is at least for messages, directed to an address, which does not support the concept of
quarantining.

Please propose what shall a site do, receiving a message, subject to quarantining, for an address, that does not support
quarantining.

Regards
  Dilyan

On Fri, 2019-08-02 at 18:49 -0400, John Levine wrote:
> _______________________________________________
> dmarc mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/dmarc

---

From: "John Levine" <[email-masked]>
Date: 2 Aug 2019 23:05:31 -0400

In article <[email-masked]> you write:
>Please propose what shall a site do, receiving a message, subject to quarantining, for an address, that does
>not support quarantining.

It should do what RFC 7489 says:

         ...  Depending on the capabilities of the Mail
         Receiver, this can mean "place into spam folder", "scrutinize
         with additional intensity", and/or "flag as suspicious".

Are you really saying your mail system has no spam folders, no way to
adjust spam filtering, and no way to mark messages as suspicious
(e.g., add "PROBABLY SPAM" to the subject line)?

If the problem is that it's an address that goes to some software
robot rather than being seen by people, do whatever you want.  That's
an edge case for DMARC.

R's,
John

---

From: Дилян Палаузов <[email-masked]>
Date: Sat, 03 Aug 2019 03:45:24 +0000

Hello John,

I am really saying, that some addresses, like majordomo@ , which send answer to each received and accepted message, have
no capability to perform a form of “quarantine”.

It does not matter, whether this is an edge case.  Once it is clarified how to act in this case, the same procedure can
be applied to mailboxes, where users want to have no Spam folder.  So mailboxes, which capability to quarantine messages
is disabled and for users, who do not want to receive messages with SUSPICIOUS in the subject line or have any
corresponding headers.  Or for users who statistically never open their Spam folder.

So it is a matter of clarifying what the domain owner wishes by publishing p=quarantine to happen to messages failing
DMARC validation, when the receiving address, voluntary or not voluntary, does not offer quarantining capability.

I have no problem, if the text "... reject at SMTP level" is not attached to the quarantine definition, but is implied
by reading other passages.  Then it does not make a difference.

Regards
  Дилян

---

From: Scott Kitterman <[email-masked]>
Date: Sat, 03 Aug 2019 07:02:26 +0000

Policy is an indication of sender preference, not a directive the receiver must follow.  I think the definition is fine.  If the sender prefers failing messages be quarantined, then they should use that policy.  They won't get what they want in all cases and that's fine.

Scott K

On August 3, 2019 3:45:24 AM UTC, "Дилян Палаузов" <[email-masked]> wrote:
>Hello John,
>
>I am really saying, that some addresses, like majordomo@ , which send
>answer to each received and accepted message, have
>It does not matter, whether this is an edge case.  Once it is clarified
>how to act in this case, the same procedure can
>be applied to mailboxes, where users want to have no Spam folder.  So
>mailboxes, which capability to quarantine messages
>is disabled and for users, who do not want to receive messages with
>SUSPICIOUS in the subject line or have any
>So it is a matter of clarifying what the domain owner wishes by
>publishing p=quarantine to happen to messages failing
>DMARC validation, when the receiving address, voluntary or not
>voluntary, does not offer quarantining capability.
>
>I have no problem, if the text "... reject at SMTP level" is not
>attached to the quarantine definition, but is implied
>> > the "... reject at SMTP level" is at least for messages, directed
>to an address, which does not support the
>> > concept of
>> > quarantining.
>> > 
>> > Please propose what shall a site do, receiving a message, subject
>to quarantining, for an address, that does

---

From: "Murray S. Kucherawy" <[email-masked]>
Date: Wed, 7 Aug 2019 08:13:18 -0700

On Sat, Aug 3, 2019 at 12:02 AM Scott Kitterman <[email-masked]>
wrote:

> Policy is an indication of sender preference, not a directive the receiver
> must follow.  I think the definition is fine.  If the sender prefers
> failing messages be quarantined, then they should use that policy.  They
> won't get what they want in all cases and that's fine.
>

This matches my understanding.

-MSK

---

From: Дилян Палаузов <[email-masked]>
Date: Sat, 10 Aug 2019 08:43:51 +0000

Hello,

to the idea to amend the existing definition of p=:

the text “

The Domain Owner wishes in addition, that the sender of messages failing DMARC are notified about the suspicious
handling with an appropriate rejection message.  Senders not willing to be notified that their message is suspicious,
shall use the NOTIFY=NEVER service extension.

In the past, Domain Owner could express as wish either to reject or to quarantine.  Considering that from the options:
only reject; only qurantine; and quarantine, while notifying the sender about the suspicious handling of the message;
nobody will choose only to quarantine, the interpretation of what the Domain Owner wishes by publishing quarantine was
changed to include the rejection component.”

so far two voices were against.  The reasoning against the amendment is that writing what the domain owner wants is just
its preference, not anything binding, and the current definition is sufficient.

My motivation in favour the amendment is, that currently nobody has the practice to quarantine messages and inform the
sender of the special delivery status at the same time.   Spelling more precisely what the domain owner wants will
suggest the implementations to implement precisely that preference.

With other words, the sole reason why a receiving host does not notify the sender for quarintined message might be, that
the receiving site has not come to this idea.  The additional text removes the cause.

If there was a common practice by now to deliver as junk and reject with appropriate text at SMTP level, then the
amendment would have been less necessary.

Regards
  Дилян

On Wed, 2019-08-07 at 08:13 -0700, Murray S. Kucherawy wrote:
> On Sat, Aug 3, 2019 at 12:02 AM Scott Kitterman <[email-masked]> wrote:

---

From: Dotzero <[email-masked]>
Date: Sat, 10 Aug 2019 11:07:38 -0400

On Sat, Aug 10, 2019 at 4:44 AM Дилян Палаузов <[email-masked]>
wrote:

> handling with an appropriate rejection message.  Senders not willing to be
> notified that their message is suspicious,
> In the past, Domain Owner could express as wish either to reject or to
> quarantine.  Considering that from the options:
> only reject; only qurantine; and quarantine, while notifying the sender
> about the suspicious handling of the message;
> nobody will choose only to quarantine, the interpretation of what the
> Domain Owner wishes by publishing quarantine was
> so far two voices were against.  The reasoning against the amendment is
> that writing what the domain owner wants is just

I'll add a third voice. When we came up with DMARC - yes, I was part of the
original dmarc.org team -  we were extremely cognizant of the fact that
there is no way to bind receivers/validators to the preferences expressed
by senders. The whole purpose of DMARC was to take something that was
working through private contractual agreements in a private group and make
it available more generally and publicly. Today there are receivers which
only make reporting available on a contractual basis through 3rd party
intermediaries or because there are direct relationships between the sender
and receiver. It is important to recognize what is required for
interoperability (in a standard) and what is a want that goes beyond what
is appropriate for a standard documenting technical interoperability.

>
> My motivation in favour the amendment is, that currently nobody has the
> practice to quarantine messages and inform the
> sender of the special delivery status at the same time.   Spelling more
> precisely what the domain owner wants will
> With other words, the sole reason why a receiving host does not notify the
> sender for quarintined message might be, that

Technical standards, as a general rule, should not be written based on
suppositions with regard to hypothetical causations that lack any empirical
evidence to support those suppositions. One could just as easily suppose
that the reason that receiving hosts do not notify the purported sending
domain is that they believe it is a bad idea. In either case it is a
supposition without any validation. We are not mind readers.

> amendment would have been less necessary.
You are asserting the amendment is necessary but you are providing no data
to support your assertion. My experience covering a corpus of billions of
emails does not support your assertion.   I therefore agree with Scott and
Murray that no amendment is appropriate in this case.

Michael Hammer

---

From: Brandon Long <[email-masked]>
Date: Tue, 20 Aug 2019 16:08:37 -0700

> suggest the implementations to implement precisely that preference.

It's not standard, but Google does add a string DMARC:QUARANTINE to
our 250 response to DATA for messages that policy
evaluated to quarantine.  I'm not sure anyone ever noticed, of course.
We've been doing it since 2012.

I'm not agreeing with the amendment, merely pointing this out.

Sender notifications would have to be one of:
1) Something like Google does, some 2xx response that contains extra
information the sending server would have to act on (which
becomes challenging in forwarding situations)
2) A 5xx response but also accept the message so a DSN is generated by
the sending (maybe intermediary) server. While I'm sure plenty of
servers
already do something like this at least for honeypots, this seems like
a twisting of the standards.
3) A 2xx response, accept the message, and the receiver generating a
DSN.  This has the obvious typical backscatter issue.

So, I can see why our implementor chose #1, but also the low utility of it.

Brandon