Re: [dmarc-ietf] Ticket #55 - Clarify legal and privacy implications of failure reports

[John R Levine <[e-mail]>]

> On Thu 24/Dec/2020 03:39:03 +0100 Tim Wicinski wrote:
>> I Believe I agree with the current version, but can someone post what we 
>> think is the final text?

See below, with the two changes mentioned before and Mr Copy Edit's minor 
tightening up which I hope are not controversial.

Ale said:
> I posted it here:
> https://github.com/ietf-wg-dmarc/draft-ietf-dmarc-failure-reporting

Hold it. I don't recall that we agreed to break failure reports into a 
separate document.  It makes more work and I see no agreement to change
anything beyond the security paragraph.  In particular, we have nothing to 
offer on what one might or might not redact.

R's,
Jobn

Security considerations

Failure reports provide detailed information about the failure of a
single message or a group of similar messages failing for the same
reason. They are meant to aid domain owners to detect why failures
reported in aggregate form occured. It is important to note these
reports can contain either the header or the entire content of a
failed message, which in turn may contain personally identifiable
information, which should be considered when deciding whether to
generate such reports.