Re: [dmarc-ietf] Ticket #39 - remove p=quarantine

["Murray S. Kucherawy" <[e-mail]>]

On Wed, Dec 2, 2020 at 6:47 AM Dotzero <[e-mail]> wrote:

> p= DID NOT mistakenly choose to use the language of receiver actions. p=
> represents the domain-owner request to the receiver as to the disposition
> of messages which fail to validate. Any reading of "concern" is supposition
> on the part of yourself or other self appointed interpreters of the mind of
> the domain-owner or administrator. The vocabulary is perfectly fine as it
> accurately describes the request being made. It makes no attempt to read
> the underlying reasoning behind the request because, surprisingly, there is
> likely to be a wide range of underlying reasoning behind why various
> domains publish the policies they publish. This is an interoperability
> standard, not a seance.
>

Not sure I agree.

I have long held a quiet dislike for "quarantine" because that has a
particular meaning to milter implementations.  Specifically, milter can
render one of several final results about a message, one of which is
actually called "quarantine".  It means "park this in the queue
indefinitely until a human decides what to do with it."  There's no
indication to the operator that such a job is waiting for review unless one
goes and looks for such things.  The upshot of this is that quarantining in
that environment can become a denial of service attack if I send you enough
messages that end up getting handled that way and your queue disk fills, or
the queue takes an inordinately long time to process because these have
piled up and need to be inspected.

Certainly not all implementers will trip on this (maybe none will) but it's
an argument to me in favor of picking a word or set of words that describe
what the domain owner thinks of the message, rather than what the domain
owner thinks you should do with it.

-MSK (hatless)