Re: [dmarc-ietf] Recipient domain in aggregate reports (#23)

[Douglas Foster <[e-mail]>]

I am open to improvements.  Laura's original point was that an RUA  should
not facilitate stalking.  My inference from that is that it should not
allow reporting on messages to an individual recipient.

One of those attacks would be to use a unique domain to send a single email
to a single recipient.   If I get an RUA report, I have found something
about the individual.   So we need a minimum number of unique recipients
before reporting begins.

As you observe, someone could send a message to the single recipient and a
bunch of messages to made-up targets that are probably invalid.   So
invalid recipients should not count toward the minimum number of unique
recipients.  (Do we want invalid recipients included ever?)

Using many DKIM selectors is the next way to force disaggregation.   If I
use a different DKIM selector for each target domain, I obtain a report
that is substantially disaggregated, in defiance of the omitted To domain.
 If I use a different DKIM selector for each individual, I obtain a report
that tells me something about the disposition and destination of each
individual message (or at least each message which is included in an RUA
report.)

Given the voracious appetite for delivery information, it seems that mass
mailers have an incentive generate DKIM keys for each target email address,
and that when done on a large scale, this will create problems for DNS
performance and email processing performance.   Report generators do not
want that level of complexity in their report generation process, and
privacy advocates do not want to facilitate this level of tracking.

Is there a case to be made that disaggregation is a non-issue?

On Mon, May 3, 2021, 8:14 PM Murray S. Kucherawy <[e-mail]>
wrote:

> On Mon, May 3, 2021 at 5:26 AM Douglas Foster <
> [e-mail]> wrote:
>
>> I meant to say that we need N unique (and valid) smtp TO addresses, so
>> that an attacker cannot send a single email address and wait for an rua
>> report to know where it lands.
>>
>> Valid addresses are needed to hinder usage of bogus addresses to defeat
>> the test.
>>
>
> Is that enough?  If I control a domain, I can make up any number of
> apparently-valid envelope addresses I want.
>
> Using DKIM selectors for tracking will also put a huge load on DNS if
>> implemented at scale [...]
>>
>
> How so?
>
> -MSK
>