Re: [dmarc-ietf] Ticket #55 - Clarify legal and privacy implications of failure reports

[Dotzero <[e-mail]>]

On Wed, Dec 23, 2020 at 4:52 PM Murray S. Kucherawy <[e-mail]>
wrote:

> On Wed, Dec 23, 2020 at 12:08 PM John R Levine <[e-mail]> wrote:
>
>> > Failing that, I have another proposal to consider that might aid us in
>> > shipping a standards track DMARC sooner: Remove any and all mention of
>> > failure reports, and do all that in a later add-on document as was done
>> > with RFC 6651.
>>
>> Given how marginal failure reports have turned out to be, that doesn't
>> seem like a great use of our time.
>>
>
> Well the "Remove" part was the key to getting us unstuck if this turns out
> to be a pain point, if they are indeed marginal and seldom used.  So stick
> a "maybe" before "do".
>
> -MSK
>

Based on my experience, I disagree that failure reports are marginal and
seldom used. It's kind of like an iceberg, mostly below the surface. Seeing
as most of the action is (currently) between contracted parties, it would
be nice to hear some of the intermediaries such as Agari, ValiMail,
Dmarcian and ? chime in. Perhaps some of the large mailbox providers could
chime in on number of domains they are sending failure reports for. If
individual companies providing numbers are a problem, perhaps M3AAWG could
provide combined numbers from a number of mailbox providers/receivers.

Michael Hammer