Re: [dmarc-ietf] DMARC forensic reports (ruf=) and privacy

[Alessandro Vesely <[e-mail]>]

On Sat 26/Jan/2019 18:21:28 +0100 Дилян Палаузов wrote:

> Imagine there is a failure report stating that after a direct communication
> between your server and another server, the receiving server sends you an
> aggregate report, stating that 1% of the messages you sent yesterday do not
> validate DKIM. How do you suggest to proceed to reduce this to 0%?

No way.  There are lots of little traps, for one example plain text messages
where a line start with "From ", like so:

>From here on, this message likely fails DKIM.

As small as this cases appear, if you program your MTA to fix them before DKIM
signing, you are going to break any OpenPGP/SMIME signatures that users had
affixed before.

You can educate users to use format=flowed, good luck.

You can push for global maildir usage, even harder.

The bottom line is that, in practice, understanding where that 1% failures come
from won't help eliminate them.


Best
Ale
--