Re: [dmarc-ietf] DMARC forensic reports (ruf=) and privacy

I completely disagree.

I have p=none and I find the reports very useful.

The policy is about action taken, not DMARC results, which is what feedback is about.

Scott K

On February 6, 2019 10:11:55 PM UTC, "Дилян Палаузов" <dilyan.palauzov@aegee.org> wrote:
>Hello John,
>
>DMARC reports for p=none are not supposed to be useful, as they do not
>depend on the policy.
>
>If the question is about how to get reports on failing DKIM validation
>only on unexpectedly smashed messages, then I
>recall the last discussion on Ietf-dkim@ietf.org:
>
>- this is not DMARC, but DKIM domain
>- when the DKIM-Signature does not validate, contains r=y and the
>remainign provisions from RFC6651 do apply, a
>(usefull) report shall be sent
>- when a message is intentionally modified, in way that the
>DKIM-Signature gets invalidated, the modified message shall
>adapt somehow the fact that it was intentionally modified for
>particular DKIM-Signatures, so that no useless report is
>sent
>- Nobody wants to modify DKIM-Signature, so it is unclear where to add
>the information that the message was
>intentionally smashed in regards the first and second DKIM-Signature,
>but not for the third one.
>
>I proposed at the time to add a r=a tag, sending only report, when DKIM
>aligns to From:, so that after passing a MLM
>rewriting From: no reports shall be sent (contrary to r=y).  Now I
>realize, that for p=none there is no added
>usefulness, since
>- DKIM-Signature gets usually intentionally broken, while passing over
>the MLM, and
>- From: is not rewritten, therefore From: alignes to the signature,
>
>so a useless report will be sent for the message.
>
>Regards
>  Дилян
>
>
>On Tue, 2019-02-05 at 20:01 -0500, John Levine wrote:
>> In article <974c2d00017358cdf3b78037e4276234db2cfdee.camel@aegee.org>
>you write:
>> > Hello John,
>> > 
>> > On Sat, 2019-01-26 at 11:31 -0500, John Levine wrote:
>> > > …  The failure reports are almost
>> > > entirely useless.  Of the ones I get, the majority are random
>Chinese
>> > > spam that happened to forge one of my domains on the From line,
>the
>> > > rest are from mailing lists where I wouldn't expect DMARC to
>pass.
>> > How do you define a useful report and for which purpose do you want
>to receive reports? 
>> 
>> A useful report would be one that was a message that one of my users
>> had actually sent and was smashed in a way I didn't expect.
>> 
>> > I mean, when does sending reports to p=none make sense.
>> 
>> The feedback reporting doesn't depend on the policy.  Please review
>> section 7 of RFC 7489.
>> 
>> _______________________________________________
>> dmarc mailing list
>> dmarc@ietf.org
>> https://www.ietf.org/mailman/listinfo/dmarc
>
>_______________________________________________
>dmarc mailing list
>dmarc@ietf.org
>https://www.ietf.org/mailman/listinfo/dmarc