Re: [dmarc-ietf] Endless Email Loops with Aggregate Reports

[Alessandro Vesely <[e-mail]>]

Hi Tim,

On Tue 04/Jun/2019 09:47:16 +0200 Tim Draegen wrote:
>> On Jun 1, 2019, at 4:13 AM, Murray S. Kucherawy 
>>> On Fri, May 31, 2019 at 10:55 AM Dilyan Palauzov
>>>
>>>     Shall I submit an erratum to RFC7489?
>>>
>>
>> I would, yes.  And this should certainly be recorded as something we need to
>> fix for standards track DMARC, whether by chasing down RFC7489 errata or via
>> a dedicated issue in this WG's tracker.
> 
> I did not see this item submitted as errata, so I put it into the tracker:
> 
>   https://trac.ietf.org/trac/dmarc/ticket/30
> 
> I'd like to float the idea that this scenario might be something operators
> address when they're generating reports (perhaps mentioned in DMARC Usage Guide?). 


That's a good idea.


> That said, the NOTIFY=NEVER idea makes a lot of sense to me, but I have to
> admit I'm not exactly sure how easy it is for operators to set this. If its not
> super obvious and available everywhere for free, I have to assume this means
> it'll be partially deployed forever, which puts us back at square one.
> 
> Sending with an empty RFC5321.MAILFROM sort of turns DMARC reports into a form
> of DSN. Implications unknown!


Not quite.  The ticket is wrong in mentioning bounces, because they don't
trigger an aggregate report.  Aggregate reports cover _any_ message that is
received with a From: domain having a DMARC record and a rua address.  That
obviously includes any aggregate reports that is received from the relevant
address.

The best solution I saw is not to send aggregate reports from a domain that has
a DMARC record with a rua address:
http://lists.dmarc.org/pipermail/dmarc-discuss/2018-October/004164.html

When I read that, I changed the From: header field of my generator, but I'm not
sure I did fix anything.  Once triggered, that kind of loop would last forever,
with <count>1</count> every day from both sides acknowledging each other's
report.  I looked for such a loop and found none, perhaps because every other
domain had already applied the trick?


Best
Ale
--