Re: [dmarc-ietf] Abolishing DMARC policy quarantine

[Alessandro Vesely <[e-mail]>]

On Sun 28/Jul/2019 12:49:12 +0200 Дилян Палаузов wrote:

> The penalty could be implemented with reply
> 550 Message failed DMARC validation and was delivered in the Junk folder of the recipient
> 


Usually, receiving MTAs drop the message after replying 5xx.


> If an ESP wants to forget about delivery, the ESP likely does not care
> whether it has implemented DMARC correctly and then it does not need
> quarantine mode.

They may want to protect their brand, avoiding that more spam be attributed to
them than what they actually generated.


> • If policy quarantine will be kept, will the none>quarantine>reject order
> be abolished, meaning “quarantine” will not be handled as softer variant of
> “reject”?  Meaning with p=reject; pct=30 messages are either delivered or
> rejected, but the specification does state anything about quaratining 70% of
> the failed messages.

I can hardly corroborate my analysis by looking at what I received.  My DB of
sending domains has:

96260 domain names, of which
55110 are organizational domains;
 3887 have DMARC records, of which
 3046 have policy 'none',
  418 have policy 'reject',
  271 have policy 'quarantine',
   73 have both 'none' and 'reject',
   45 have both 'none' and 'quarantine',
   34 have both 'quarantine' and 'reject'.

393 of those DMARC domains are not organizational domains, yet 79 of them also
specify sp=.  There is some confusion about how to setup DMARC; some easy howto
seems to be missing.

On multiple policies, only 4 of the latter 34 have p=quarantine; sp=reject; the
other 30 have p=reject; sp=quarantine.  By comparison, the previous 73 + 45
have about the same ratio of p=hard/p=none; 45/28 for reject and 29/16 for
quarantine, so some 63% of those have p=hard; sp=none.  Can one infer from here
the intent of the 30 p=reject; sp=quarantine?

My feeling while looking at that data is that 'reject' is sometimes considered
/better/ than 'quarantine', which I don't think is true.  This confusion can
originate from the sequential order implied by that passage of Section 6.6.4
that Steve quoted.  I agree that that Section needs to be amended.  In
particular, the effect of pct=0 on From: rewriting should be mentioned.


Best
Ale
--