Re: [dmarc-ietf] auth-res vs. dmarc

[Michael Thomas <[e-mail]>]

On 12/30/20 8:22 AM, Dotzero wrote:
>
>     DMARC != Auth-res. Auth-res provides all kinds of useful
>     information than just pass/fail. For DMARC Auth-res should provide
>     what the policy was at a bare minimum. But none of this seems to
>     have any normative language anywhere which is a problem unto
>     itself. DMARC in auth-res seems to be an orphan.
>
>     Mike
>
>
> You just stated the case as to why this discussion should be ruled out 
> of scope.  " DMARC != Auth-res." and " DMARC in auth-res seems to be 
> an orphan"
>
> This is the IETF DMARC working group, not the AUTH-RES working group. 
> You gave the example of someone writing a crappy Thunderbird extension 
> as a reason for the working group to change its focus. Perhaps getting 
> the extension author to fix their extension might be a more fruitful 
> effort.
>

Because the author *can't* fix their extension for the 100th time. There 
is no normative mechanism for transporting the DMARC state in the 
auth-res header. And if the working group is not willing to do its part 
for auth res, then auth-res should just be moved to historic since there 
is nobody to maintain it, and no place to discuss its shortcomings. 
Requiring every downstream MTA and MUA to do DMARC policy checks would 
be a mess and *that* is most certainly in scope as scaling is an 
internet issue.

Mike