Re: [dmarc-ietf] Ticket #42 - Expand DMARC reporting URI functionality

[Ken O'Driscoll <[e-mail]>]

> -----Original Message-----
> From: dmarc <[e-mail]> On Behalf Of John R Levine
> Sent: Friday 4 December 2020 18:22
> To: Alessandro Vesely <[e-mail]>; John R Levine <[e-mail]>;
> [e-mail]
> Subject: Re: [dmarc-ietf] Ticket #42 - Expand DMARC reporting URI
> functionality
> 
> >> I meant "at the same time" as in during the same reporting run.  As
> >> Dave noted, if you sent any particular report by https, there's no
> >> need to send it again by mail.
> >
> > Got it.  However, the spec says it's a list of addresses to which
> > aggregate feedback is to be sent.  When there are multiple entries, up
> > to now, reports are sent to each.
> 
> Hm, we might want to revisit that.  If a domain wants mail sent to three
> places, it's not like it's hard to arrange for forwarding.  My intention
> is that if you send the report by https, you're done.

In many circumstances, mail forwarding may be quite difficult to arrange.

Many organisations use an external service to handle their reports. Currently, if such an organisation wishes to add another report receiver, they are in control of that process by modifying their DNS zone.

However, if they can only specify one report receiver then it is that report receiver who must handle any forwarding in the case of multiple parties.

The pre and post acceptance filtering that most mailbox providers implement can make them unreliable for delivering DMARC reports to user mailboxes. So, an organisation would likely have to set up a separate mail infrastructure should they wish to retain control of what parties receive their DMARC reports.

Of course, third party report processing services could also add support for such forwarding. But, given that such a feature could facilitate a competitor, I'm sceptical it would make business sense to many of them. On top of that, it's easier to receive than send so there is an ongoing cost in providing email forwarding.

As to the utility of having more than one report destination, I regularly receive client DMARC reports on top of their existing service as part of consultancy engagements. It is also the only way for an organisation without their own email infrastructure to simultaneously evaluate more than one report processing service. So I believe there is utility there.

Ken.