Re: [dmarc-ietf] Tickets 98 and 99 -- fake reports are not a problem and if they were authentication would not help

[Alessandro Vesely <[e-mail]>]

On Mon 25/Jan/2021 14:25:23 +0100 Todd Herr wrote:
> About that, aggregate reports are meant to be machine-parsed, and in my own 
> experience that's accomplished by running a cron job a couple times a day to 
> process the rua mailbox. (Personally, I favored Mark Overmeer's perl stuff; 
> open the mailbox, cycle through each message, strip off the attachment, unzip 
> it, and pass it to the tools that John wrote to read the XML and store the 
> results in a database, but I was working at a relatively small site.)


For a counter example, I read aggregate reports one by one, if at all.  They 
get an automated HTML rendering that makes it easy to see success at a glance, 
and the mail site is small enough that I can afford doing so.  Authentication 
status is visible at a glance too, so I can judge the report's merit.

IMHO, reports SHOULD be authenticated.

Best
Ale
--