Re: [dmarc-ietf] DMARCbis issue: Separating reporting and policy

[Jim Fenton <[e-mail]>]

On 5/24/19 10:55 AM, Brandon Long wrote:
>
>
> On Thu, May 23, 2019 at 10:01 PM Jim Fenton <[e-mail]
> <mailto:[e-mail]>> wrote:
>
>     On 5/23/19 3:52 PM, John Levine wrote:
>     > In article <[e-mail]
>     <mailto:[e-mail]>> you
>     write:
>     >> There are domains that would like to receive reports, but whose
>     usage of
>     >> mail doesn't make it useful to express a policy. Conversely,
>     there are
>     >> domains that want to express a policy but aren't interested in
>     reports.
>     >> I'd like to advocate that DMARC be split up into two different
>     documents
>     >> dealing with reporting and policy separately. If it's useful to
>     have a
>     >> separate document that defines what it means to be
>     "DMARC-compliant"
>     >> that is referenced by both, that would be OK.
>     > Given that we already have one document, I would be very strongly
>     > opposed to this.  It's fine to fix things that are wrong, but trying
>     > to restructure it retroactively will inevitably lead to accidental
>     > incompatibilities.
>
>
>     MTA-STS and TLSRPT started out as one document as well, and separated
>     quite cleanly IMO. I'm not sure what kind of incompatibilities you
>     think
>     might be created.
>
>
> Does TLSRPT support both MTA-STS and DANE?  I would think that
> provides a logical
> reason to separate them that doesn't exist for DMARC.


TLSRPT does support both MTA-STS and DANE, but the same logical reason
probably exists for domains that want to generate or receive reports but
do not want to publish or honor policy assertions. Although I will admit
that publishing an MTA-STS policy is considerably more involved than
with DMARC.

-Jim