Re: [dmarc-ietf] DMARCbis issue: what is DMARC ?

[Alessandro Vesely <[e-mail]>]

On Fri 24/May/2019 20:25:33 +0200 John R Levine wrote:
> 
> Deploying DMARC seems to mean any subset of these:
> 
> 1a.  Publish a DMARC record
> 1b.  Publish a DMARC record with a restrictive policy
> 2a.  Evaluate DMARC status of incoming messages
> 2b.  Use that status to manage message disposition
> 3.   Collect reports
> 4a.  Send aggregate reports
> 4b.  Send failure reports


Nice one!  That analysis should make it to some implementation guide.  I'd
suggest an addition, though:

3a.  Receive and possibly read records
3b.  Collect them

I only do 3a, let me attach an example.  (It also exemplifies 4a, but the
htmlizer is the same.)  I look at sent or received reports occasionally.  They
are automatically deleted after some time.  I never happened to need to process
them as a collection.  If I did, I guess I should reset the accumulated results
when the relevant DMARC/DKIM/SPF records change.  I hope the implementation
guide will explain this.


> It is my impression that most domains that have "deployed DMARC" have done 1b
> and 3.  I've done 1a, 2a, 3, and a very small amount of 2b.  Only a few sites
> do 4a and even fewer do 4b.
> 
> I'm getting the impression that what we need is a non-normative deployment
> guide, not as part of the spec.


+1.  Recall that the current spec is formally non-normative (which might
explain the lack of normative language in Section 8).  If we have to split, I'd
suggest to split into a normative and a non-normative part, where the latter is
an implementation guide.

IMHO: 4a is needed to evaluate the effect of policies, otherwise the protocol
is blind.


Best
Ale
--