[dmarc-ietf] Endless Email Loops with Aggregate Reports

[Dilyan Palauzov <[e-mail]>]

Hello,

DMARC aggregate reports can and do cause endless loops, too:

A site publishes an email address for receiving aggregate DMARC  
reports.  The rua-address bounces the messages (aggregate report)  
received there and the bounces does not validate the DMARC policy.  So  
on the next reporting period a new aggregate report is sent, stating  
that the reply on the previous report failed DMARC validation.

Unlike endless email loops caused by message-specific failure reports,  
the endless email loops caused by aggregate reports are by design  
rate-limited: one email per reported domain and reporting period.  A  
wait to reduce the possibility into getting in such loops is toT send  
the reports FROM:<>.

That said I propose recommending in DMARC, that both the  
message-specific reports and the aggregate reports are sent FROM:<> or  
NOTIFY=NEVER.

Shall I submit an erratum to RFC7489?

Regards
   Дилян