Re: [dmarc-ietf] Guidance around constructing an AAR when multiple AR headers are present?

[Brandon Long <[e-mail]>]

On Wed, May 24, 2017 at 12:26 PM, John Levine <[e-mail]> wrote:

> In article <CAOZAAfOsRrQF2M3NzcB3h2Tc03mtFfG8mOJ0pqU+_cx=whcBLQ@mail.
> gmail.com> you write:
> >Looking at random messages on this list, I've seen anywhere from two to
> >five AR headers per message. Locally, with opendkim and opendmarc running,
> >there are three locally generated AR headers that get passed to openarc.
> It
> >looks like seeing multiple AR headers is going to be a common occurrence
> >for ARC implementations to handle.
>
> When I take a look, I only see one, from ietfa.amsl.com.  If I were
> having the list mailed to me, I'd expect to see two, that one plus the
> one my system adds.  It is rather peculiar to have multiple headers
> with the same service identifier, since section 5 of RFC 7601 says
> that you normally delete exsting A-R headers with the same
> authserv-id before you add a new one.
>

Section 1.6 specifies that you would delete them on entrance to the ADMD,
and 2.1 seems to specify that multiple are allowed, and example B.4 shows
an example where multiple are used.

On my system, the SMTP daemon calls the spf2, opendkim, and opendmarc
> libraries, and then puts all the results in a single A-R header.  For
> example, when I look at mail from a list I forward to a gmail account,
> I see one A-R header from mx.google.com, one from my system, and maybe
> one from the original system.  I think that's more typical.
>
> >Is this a problem the group thinks needs discussion?
>
> Only if there are a lot of MTAs that don't report their results in one
> header.
>

I think the default using the open* libs is to do so, so probably.  OTOH,
how to do so seems fairly obvious, I'm not clear on why doing so needs to
be specified.  Being sure the spec specifies that only one is allowed,
definitely.

Brandon