Re: [dmarc-ietf] Is there any recommendation to send DMARC message-specific failure reports FROM:<> ?

Dilyan Palauzov <Dilyan.Palauzov@aegee.org> Sun, 26 May 2019 05:10 UTC

Return-Path: <Dilyan.Palauzov@aegee.org>
X-Original-To: dmarc@ietfa.amsl.com
Delivered-To: dmarc@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 32A62120020 for <dmarc@ietfa.amsl.com>; Sat, 25 May 2019 22:10:05 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.999
X-Spam-Level:
X-Spam-Status: No, score=-1.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (4096-bit key) header.d=aegee.org
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id F7JNv8MSA7EZ for <dmarc@ietfa.amsl.com>; Sat, 25 May 2019 22:10:02 -0700 (PDT)
Received: from mail.aegee.org (mail.aegee.org [144.76.142.78]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 39C78120058 for <dmarc@ietf.org>; Sat, 25 May 2019 22:10:01 -0700 (PDT)
Received: from mail.aegee.org (localhost [127.0.0.1]) by mail.aegee.org (8.15.2/8.15.2) with ESMTP id x4Q59wt0017814 for <dmarc@ietf.org>; Sun, 26 May 2019 05:09:59 GMT
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=aegee.org; s=k4096; t=1558847399; i=dkim+sm-localhost@aegee.org; r=y; bh=APyrTdCI9SqRj9l5gbweVMTqN7tDN7DlxD+gEetG6Tc=; h=Date:From:To:Subject:References:In-Reply-To; b=d8LjLXI8cgBNUjHeN8tI/DMUpq0tL8LkeLuGGtz9fSzr3udQTKhF72DT6eoevm9QB wlHvsCKc+0gpmCGDXbZS7i+p7Q79YORZNUxgDAVJcqj2WWwYi0Q9x+u4/EndhQg6V1 dn1d5SrLnyfjK4FD7E3a/Lf7u+e7LlLmwWb8vPAzDg6/u3aNYR7+qpvUNOwvquUtKB l1AnWElXtLdppIcog6lGY4lyMl2vuGoRYLOqaS9OfY3gROuiPyuXLfCWGsvBeGNMaB cgsOiv5I5blSY735RHxtPAA1QE2XE9A1lJohbk6E07Y1YlieUr7+lCb0olU6GLENzt ClycVwZ51sQM8dt4tnTzr/xA4hkp5+NRDKkde2uixhxZrn+AkWHZiuapbENOLCGXib lScewRsC9JyVU6zqNb8v7yytPaIaY9ZMCKfmURkWySwkm0QNCvFgA2hG4wziym8N1c HWNfIgWjZUiW/Z/ylH4iqL6xXFuED79rQgDCDlO0pgspoZcuOPl8MTXUZ71smyPyr2 79Xl7R3LVoGmsIHD/V0IHMLMV1qldOMHiTq1odtAeaMcrQsuLQsav3WDnmQx1iFVNm OtYXk4/uOrIwCyiocEiMKY9MijgSRtnlSnAgFTXpp9Vm16XtK7IpHi7lr1sASv9av4 DbaXb7KB3Bx7rNAX8hyt2TQE=
Authentication-Results: mail.aegee.org/x4Q59wt0017814; dkim=none
Received: from 87-118-146-153.ip.btc-net.bg (87-118-146-153.ip.btc-net.bg [87.118.146.153]) by webmail.aegee.org (Horde Framework) with HTTPS; Sun, 26 May 2019 05:09:58 +0000
Date: Sun, 26 May 2019 05:09:58 +0000
Message-ID: <20190526050958.Horde.6VaAxRZKGLqyeJ4Uov0vrXR@webmail.aegee.org>
From: Dilyan Palauzov <Dilyan.Palauzov@aegee.org>
To: dmarc@ietf.org
References: <20190525183556.Horde.zvg1bNsYbvs_enKZPKjlhVV@webmail.aegee.org> <20190525215318.1580620149E52F@ary.qy>
In-Reply-To: <20190525215318.1580620149E52F@ary.qy>
User-Agent: Horde Application Framework 5
Content-Type: text/plain; charset="utf-8"; format="flowed"; DelSp="Yes"
MIME-Version: 1.0
Content-Disposition: inline
Content-Transfer-Encoding: 8bit
X-Virus-Scanned: clamav-milter 0.101.2 at mail.aegee.org
X-Virus-Status: Clean
Archived-At: <https://mailarchive.ietf.org/arch/msg/dmarc/cHEsImAPALVMDDn2Xzll6uDXYvA>
Subject: Re: [dmarc-ietf] Is there any recommendation to send DMARC message-specific failure reports FROM:<> ?
X-BeenThere: dmarc@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: "Domain-based Message Authentication, Reporting, and Compliance \(DMARC\)" <dmarc.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/dmarc>, <mailto:dmarc-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/dmarc/>
List-Post: <mailto:dmarc@ietf.org>
List-Help: <mailto:dmarc-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/dmarc>, <mailto:dmarc-request@ietf.org?subject=subscribe>
X-List-Received-Date: Sun, 26 May 2019 05:10:05 -0000

Hello John,

in case of modernwebsite.pl:

DNS TXT _dmarc.modernwebsite.pl is "v=DMARC1; p=reject; pct=100;  
rua=mailto:postmaster@modernwebsite.pl;  
ruf=mailto:postmaster@modernwebsite.pl; aspf=s;adkim=s;"

Emails to postmaster@modernwebsite.pl are answered with “Undelivered  
Mail Returned to Sender”.  The answers do not align to the DMARC  
policy reject, so a new message-specific failure repot is sent.

The loop happens, when you do send failure reports, not just receiving such.

Regards
   Дилян

----- Message from John Levine <johnl@taugh.com> ---------
    Date: 25 May 2019 17:53:17 -0400
    From: John Levine <johnl@taugh.com>
Subject: Re: [dmarc-ietf] Is there any recommendation to send DMARC  
message-specific failure reports FROM:<> ?
      To: dmarc@ietf.org
      Cc: Dilyan.Palauzov@aegee.org


> In article  
> <20190525183556.Horde.zvg1bNsYbvs_enKZPKjlhVV@webmail.aegee.org> you  
> write:
>> Consider this scenario: an email from a domain, with DMARC policy
>> “p=reject; ruf=postmaster@domain” fails validation.  A
>> message-specific report is sent to postmaster@domain.  The report is
>> bounced (or there is any reply on it) and the reply is again From:
>> that domain and does not validate DMARC.  In turn a new
>> message-specific report is sent and this loop ends, when some disk
>> gets full.  With FROM:<> or NOTIFY=NEVER there would be no such loop.
>
> The trickle of failure reports I get are from addresses like these:
>
> forensicdmarc@seznam.cz
> mailnull@segv.crash.com
> dmarc-noreply@linkedin.com
> opendmarc@hamartun.priv.no
> prvs=1020be0dc4=noreply@manthorp.com
>
> I would expect that any mail sent to those addresses is unlikely to
> provoke a failure report, no matter how mangled it is when it arrives.
>
> We've had failure reports for almost seven years and I don't ever
> recall someone getting into a mail loop so it's not a problem in
> practice.
>
> _______________________________________________
> dmarc mailing list
> dmarc@ietf.org
> https://www.ietf.org/mailman/listinfo/dmarc


----- End message from John Levine <johnl@taugh.com> -----