Re: [dmarc-ietf] Aggregate Reporting - "Not Evaluated" result

[Dotzero <[e-mail]>]

On Sun, Oct 23, 2022 at 6:29 AM Alessandro Vesely <[e-mail]> wrote:

> On Sat 22/Oct/2022 18:25:55 +0200 Dotzero wrote:
> > Unaligned signatures are orthogonal/irrelevant to DMARC. They may be
> useful in
> > other contexts. In the DKIM standard, signatures mean that the signer is
> > asserting some (unspecified) responsibility for the signed message. That
> may be
> > useful for some reputation systems.
>
>
> Somewhat skewed w.r.t. orthogonality, actually.  Indirect flows are
> explicitly
> mentioned in the I-D as a reason to override DMARC dispositions:
>

DMARC only gives a pass if either SPF or DKIM passes. Unaligned DKIM
signatures will NEVER give a DMARC pass.

>
>     There MAY be an element for reason, meant to include any notes the
>     reporter might want to include as to why the disposition policy does
>     not match the policy_published, such as a Local Policy override
>     (possible values listed in Appendix A).
>

Local Policy is just that. When a Receiver invokes Local Policy it is
saying "I don't care what DMARC says, I'm choosing to ignore DMARC Policy
and do something else".

>
> ARC too is a kind of unaligned signature, albeit with a bunch of
> additions.
> The extra information it carries, designed to bestow enough trust in the
> chain
> of custody to outweigh the self-referential reliance of aligned From:,
> doesn't
> substantially change the semantic of DKIM signatures.  And we should say
> how to
> report it, sooner or later.
>
> ARC != DMARC. It is a seperate RFC that gives participants an alternative
> means of evaluating mail flows when DKIM signatures are broken. Nothing
> more and nothing less.
>
> I'm not proposing to mandate the evaluation of any evaluable item.
> However,
> I'd neither discourage it.  Perhaps technology will provide us with
> ecological
> sources of energy.
>

There is nothing wrong with using whatever data points you have available.
That doesn't necessarily mean that such evaluations and choices are DMARC.

Michael Hammer.