Re: [dmarc-ietf] Recipient domain in aggregate reports (#23)

[Todd Herr <[e-mail]>]

Apologies to Matt; I sent this originally only to him when I meant to send
it to the list...

On Wed, Apr 28, 2021 at 4:27 AM Matthäus Wander <mail=
[e-mail]> wrote:

> Hello everyone,
>
> I'm new to the party. I'd like to bring in some practical experience of
> working with DMARC rua reports.
>
> #23 introduces "receiving_domains" in the report metadata, justified by
> large infrastructures that host a large number of domains (e.g. Google).
>
> I think, this information would be more useful per-record rather than in
> the global metadata. As large infrastructures tend to include many
> different records in the report, the analyst needs a correlation between
> record and recipient domain.
>
> The <identifiers> section has an optional "envelope_to" already:
> >        <!-- The envelope recipient domain. -->
> >        <xs:element name="envelope_to" type="xs:string"
> >                    minOccurs="0"/>
>
> Is there a benefit in the global "receiving_domains" over the per-record
> "envelope_to"?
>
> Most reporters don't include "envelope_to" (e.g. Google). This field
> could be made more prominent in the draft. The main body mentions
> "header_from" only, but neither "envelope_to" nor "envelope_from".
>

There is a hole in my understanding of this topic that I'm hoping someone
can fill here, and that hole is this: I don't understand the value of
reporting out receiving domains.

The reason I don't understand it is because my expectation as a sender
receiving a report about my sending domain would be that my DMARC
validation results from a given receiving infrastructure would generally
not vary across the different receiving domains, regardless of if there was
one domain, ten domains, or ten thousand domains hosted by the reporting
infrastructure. To extend my expectations further, unless I'm dedicating
part of my infrastructure to sending solely to one and only one receiving
site, I would expect my DMARC validation results to generally not vary
across different reporting infrastructures. I'm declaring here that "DMARC
validation results" are separate from "applied receiver handling policy"
because as a sender I can only control the former; "DMARC validation
results" means "whether or not SPF and/or DKIM passed and was aligned and
consequently resulted in a DMARC pass or fail".

If I'm reading draft-ietf-dmarc-aggregate-reporting-02 correctly,
receiving_domains, defined as the "List of domains which received messages
for the domain in this report" I guess it could perhaps help me as a report
consumer in the case where I receive a report from an previously unknown or
unfamiliar to me reporter that hosts many domains, and if that's the use
case, then perhaps the field ought to be amended to "List of the top
$SMALL_NUMBER domains which received messages for the domain in this
report" because as a report consumer I don't need to see 837 domains listed
when realistically one or two will suffice.

What is the value that I'm not seeing in reporting out receiving domains?
-- 

*Todd Herr* | Sr. Technical Program Manager
*e:* [e-mail]
*m:* 703.220.4153

This email and all data transmitted with it contains confidential and/or
proprietary information intended solely for the use of individual(s)
authorized to receive it. If you are not an intended and authorized
recipient you are hereby notified of any use, disclosure, copying or
distribution of the information included in this transmission is prohibited
and may be unlawful. Please immediately notify the sender by replying to
this email and then delete it from your system.