Re: [dmarc-ietf] Ticket #39 - remove p=quarantine

[Brandon Long <[e-mail]>]

On Wed, Dec 2, 2020 at 11:09 AM Murray S. Kucherawy <[e-mail]>
wrote:

> On Wed, Dec 2, 2020 at 6:47 AM Dotzero <[e-mail]> wrote:
>
>> p= DID NOT mistakenly choose to use the language of receiver actions. p=
>> represents the domain-owner request to the receiver as to the disposition
>> of messages which fail to validate. Any reading of "concern" is supposition
>> on the part of yourself or other self appointed interpreters of the mind of
>> the domain-owner or administrator. The vocabulary is perfectly fine as it
>> accurately describes the request being made. It makes no attempt to read
>> the underlying reasoning behind the request because, surprisingly, there is
>> likely to be a wide range of underlying reasoning behind why various
>> domains publish the policies they publish. This is an interoperability
>> standard, not a seance.
>>
>
> Not sure I agree.
>
> I have long held a quiet dislike for "quarantine" because that has a
> particular meaning to milter implementations.  Specifically, milter can
> render one of several final results about a message, one of which is
> actually called "quarantine".  It means "park this in the queue
> indefinitely until a human decides what to do with it."  There's no
> indication to the operator that such a job is waiting for review unless one
> goes and looks for such things.  The upshot of this is that quarantining in
> that environment can become a denial of service attack if I send you enough
> messages that end up getting handled that way and your queue disk fills, or
> the queue takes an inordinately long time to process because these have
> piled up and need to be inspected.
>
> Certainly not all implementers will trip on this (maybe none will) but
> it's an argument to me in favor of picking a word or set of words that
> describe what the domain owner thinks of the message, rather than what the
> domain owner thinks you should do with it.
>

Hmm, reading this thread, I think one missing feature in the dmarc spec is
passing the expected disposition in the authres header, since presumably
the evaluation is at smtp time, but the mailbox
delivery itself would need to know it.  One could use the dmarc= names and
look up the dmarc policy itself to also figure that out with some amount of
work.

I know that Gmail and others put that information in the comments, but that
probably shouldn't be for something explicitly part of the spec like this.

Anyways, +1 to keeping p=quarantine as a concept, but willing to go along
with the consensus on naming.

Brandon