Re: [dmarc-ietf] Concerns for not Sending a Failure Report?

Дилян Палаузов <dilyan.palauzov@aegee.org> Sun, 04 August 2019 11:47 UTC

Return-Path: <dilyan.palauzov@aegee.org>
X-Original-To: dmarc@ietfa.amsl.com
Delivered-To: dmarc@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 96BFA120025 for <dmarc@ietfa.amsl.com>; Sun, 4 Aug 2019 04:47:07 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.999
X-Spam-Level:
X-Spam-Status: No, score=-1.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_NONE=0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (4096-bit key) header.d=aegee.org
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id qhGS2TVaiZlp for <dmarc@ietfa.amsl.com>; Sun, 4 Aug 2019 04:47:06 -0700 (PDT)
Received: from mail.aegee.org (mail.aegee.org [144.76.142.78]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id AB407120019 for <dmarc@ietf.org>; Sun, 4 Aug 2019 04:47:05 -0700 (PDT)
Authentication-Results: mail.aegee.org/x74Bl10e029318; auth=pass (LOGIN) smtp.auth=didopalauzov
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=aegee.org; s=k4096; t=1564919223; i=dkim+MSA-tls@aegee.org; r=y; bh=8szj5lN3/sIq1M6uuvPVwihLvylWnPo4eA/X4NkCsAQ=; h=Subject:From:To:Date:In-Reply-To:References; b=qNGWSURcoMdirU/UGy5us9p1qQgQoswttATjmVcy+Be5sEOOvDE7UoeZ5yIrooF9H mDtRpANe1nTivZpTFgTy1PbXSaGIhmzfQ84ZHkq28SoDmW07shxzOVNxjbIIrk0u4L xmA2RiYT+rHA4sISHjrUcngDeem7XkymJBeYEzc+AZfywSku4EhMxlIq7GOqeyBRr3 OJ6pZ74z199BIWawnRY2MmNSmDpeHWPP6x+KCsHTXRhjSOGt6l2y/WUZVGKvHDNq76 LCE1nXoibanigJaSKUcLf2IE2QkV4Cpqvqz8jQAPFkJQnUcWapUVq/aM/5wFx8G1/k vteXO8/XiqUp5xv6yajZo2UMlt0kBi3p4tVjdmALj16Z82MmbR1vnWxXmMoBzhMZGA aOUYXvXLxbt/nJoBNCgL9UR/djl+VWcTrQCi3fC9npP4FPDr1aYP62gGxbelf9sRfo qPOpEIx190IA8QoWA0ODQmcbxcxCmbBW8LRq0yrgJIHGJ/pRa47k8IoFdbfh4PXLj2 3xQsPCFZ2Ke5evrhVqgnWVvTOJrBYNZ3ulyjXSFF3CpgxqKf/8eaVM+DQRrcCQm6lA 5WjJkn0nlmyi1kfEdhq/trzzSIFqPfRiETJ2xkRVPgGFgADvjpZhLd1OOByAlEgg3m LoWBPyLkLEB3AwvAwYZpRE7Y=
Authentication-Results: mail.aegee.org/x74Bl10e029318; dkim=none
Received: from Tylan (87-118-146-153.ip.btc-net.bg [87.118.146.153]) (authenticated bits=0) by mail.aegee.org (8.15.2/8.15.2) with ESMTPSA id x74Bl10e029318 (version=TLSv1.3 cipher=TLS_AES_256_GCM_SHA384 bits=256 verify=NO); Sun, 4 Aug 2019 11:47:02 GMT
Message-ID: <9e57756d0099acb3dcf5915e77a38045343d463a.camel@aegee.org>
From: =?UTF-8?Q?=D0=94=D0=B8=D0=BB=D1=8F=D0=BD_?= =?UTF-8?Q?=D0=9F=D0=B0=D0=BB=D0=B0=D1=83=D0=B7=D0=BE=D0=B2?= <dilyan.palauzov@aegee.org>
To: Alessandro Vesely <vesely@tana.it>, dmarc@ietf.org
Date: Sun, 04 Aug 2019 11:47:01 +0000
In-Reply-To: <036af2bc-4c77-af23-376d-1a2ce60e064f@tana.it>
References: <e84652a9df6b61e599f30e7fae6c0c728faf5ce5.camel@aegee.org> <5DD2CBA9-6F28-483C-9B08-8D3A41526BD7@wordtothewise.com> <d36a922d6bbb8426167e44d434e07b62faf86f21.camel@aegee.org> <6FCCAD3E-C2EB-4613-B0C0-148AE3387D21@wordtothewise.com> <bf96723d0a98477bac0f6f54742d3eb4d03f30a6.camel@aegee.org> <036af2bc-4c77-af23-376d-1a2ce60e064f@tana.it>
Content-Type: text/plain; charset="UTF-8"
User-Agent: Evolution 3.33.90
MIME-Version: 1.0
Content-Transfer-Encoding: 8bit
X-Virus-Scanned: clamav-milter 0.101.2 at mail.aegee.org
X-Virus-Status: Clean
Archived-At: <https://mailarchive.ietf.org/arch/msg/dmarc/PcG3AjeBbs20RuY5ugg-tkvteMQ>
Subject: Re: [dmarc-ietf] Concerns for not Sending a Failure Report?
X-BeenThere: dmarc@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: "Domain-based Message Authentication, Reporting, and Compliance \(DMARC\)" <dmarc.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/dmarc>, <mailto:dmarc-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/dmarc/>
List-Post: <mailto:dmarc@ietf.org>
List-Help: <mailto:dmarc-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/dmarc>, <mailto:dmarc-request@ietf.org?subject=subscribe>
X-List-Received-Date: Sun, 04 Aug 2019 11:47:08 -0000

Hello Alessandro,

what is the purpose of the failure reports?

If the purpose is align DKIM, SPF and DNS implementations of senders and receivers, then I am proposing ways to exchange
information for debugging.

I do not propose how to obtain information about scammers’ actions.  DMARC is invented to make the workflow of scammers
impossible, it is not about exchanging information of performed scammers’ action.

If a site promises to its users, that all emails will be encrypted, then publishing a ruf= address likely violates that
promise.  This is not necessary true, if the failure report is delivered (encrypted) only to the person who sent the
original message.  This creates a big fuzz, whether forwarding always the failure reports to the sender of the original
message is a good idea and goes out of scope.

I changed my mind:

The DKIM—Signature has a tag r=y.  It is a matter of adding a new value r=a, that means both:
• The writer of the message, or a site which has received the message at some moment, is willing that a failure report
for failed DKIM validation is sent, for every present DKIM-Signature that aligns to DMARC.  The one who adds r=a can
have a copy of the message.
• Receiving sites can assume, that whoever adds r=a has a already a copy of the message and sending failure report with
the content of the email does not reveal information to the recepient of the report about the content of the email.

Now, if nearly all mails from a domailn, that pass DMARC have r=a and emails that fail DMARC from the domain, have no
r=a, then the lack of r=a on its own, makes the mail suspicious.

Will scammers start inserting r=a?

Will be there a doubt, when both r=a and ruf= are present, that both the writer of the message and the domain owner are
willing to receive failure reports and neither of them has concerns, when the reports are sent?

Regards
  Дилян

On Sun, 2019-08-04 at 12:56 +0200, Alessandro Vesely wrote:
> Hi Dilyan,
> 
> On Sun 04/Aug/2019 12:10:51 +0200 Дилян Палаузов wrote:
> 
> > The receiving server knows, which IP address sent the mail and it knows, to
> > which IP addresses set the failure report will go.  If there is a match in
> > the IP addresses, then the receiving server knows that the one who will get
> > the report is also the one, who has anyway access to the message.
> 
> That's not always true.  For example, I know of mailbox providers who, on
> delivery, automatically encrypt cleartext messages to the public key of the
> recipients, including the Sent folder.  Operators at that provider's aren't
> able to sniff message contents unless they're sent back on failure by receiving
> sites.  In general, users trust their mailbox providers also because of the
> policies they enact.  Matching those policies with unwarranted disclosure of
> messages is not straightforward.
> 
> In addition, the most interesting reports are messages not coming from my IP.
> Scammers abusing may domain name use their own IPs.  I see those failures in
> the aggregate reports, but don't know if the IPs mentioned there correspond to
> mailing lists or other legitimate forwarders, or even some ill-informed users
> of mine who send their mail through their ISPs.  That's why I need failure
> reports.  It would be enough if the aggregate reports contained an indication
> of the spamminess of those messages, or the reputation of those IPs.
> 
> Failure reports for messages originating from my IP are only useful for
> debugging.  An activity which I can more easily do by using free mailboxes, as
> you said, or sites specifically dedicated to testing email.
> 
> 
> Best
> Ale