Re: [dmarc-ietf] Abolishing DMARC policy quarantine

[Brandon Long <[e-mail]>]

On Tue, Jul 30, 2019 at 1:27 AM Alessandro Vesely <[e-mail]> wrote:

>
> On multiple policies, only 4 of the latter 34 have p=quarantine;
> sp=reject; the
> other 30 have p=reject; sp=quarantine.  By comparison, the previous 73 + 45
> have about the same ratio of p=hard/p=none; 45/28 for reject and 29/16 for
> quarantine, so some 63% of those have p=hard; sp=none.  Can one infer from
> here
> the intent of the 30 p=reject; sp=quarantine?
>

They've validated that all the senders for the main domain are authing, but
haven't done so for the
sub-domains.  Or they don't send from the primary domain.


> My feeling while looking at that data is that 'reject' is sometimes
> considered
> /better/ than 'quarantine', which I don't think is true.  This confusion
> can
> originate from the sequential order implied by that passage of Section
> 6.6.4
> that Steve quoted.  I agree that that Section needs to be amended.  In
> particular, the effect of pct=0 on From: rewriting should be mentioned.


I think many folks do think of it progressively.  For example, quarantine
can be overridden by the
recipient, by filter or manually looking, whereas reject typically can only
be overridden by the
administrator.

Quarantine also means that some percentage of people can fall for the
spam/phish even if it's quarantined,
whereas a reject is never seen by the receiver.

Reject seems to be the end goal, but folks have a hard time getting there
(hence the many companies sprung up
to help people get there).  Quarantine is a stepping stone because of the
ability to override, and the visibility by the
receivers (presumably the point of email is that the receivers want it)

Brandon