Re: [dmarc-ietf] auth-res vs. dmarc

[Dotzero <[e-mail]>]

On Wed, Dec 30, 2020 at 11:30 AM Michael Thomas <[e-mail]> wrote:

>
> On 12/30/20 8:22 AM, Dotzero wrote:
>
>
> DMARC != Auth-res. Auth-res provides all kinds of useful information than
>> just pass/fail. For DMARC Auth-res should provide what the policy was at a
>> bare minimum. But none of this seems to have any normative language
>> anywhere which is a problem unto itself. DMARC in auth-res seems to be an
>> orphan.
>>
>> Mike
>>
>
> You just stated the case as to why this discussion should be ruled out of
> scope.  " DMARC != Auth-res." and " DMARC in auth-res seems to be an orphan"
>
> This is the IETF DMARC working group, not the AUTH-RES working group. You
> gave the example of someone writing a crappy Thunderbird extension as a
> reason for the working group to change its focus. Perhaps getting the
> extension author to fix their extension might be a more fruitful effort.
>
>
> Because the author *can't* fix their extension for the 100th time. There
> is no normative mechanism for transporting the DMARC state in the auth-res
> header. And if the working group is not willing to do its part for auth
> res, then auth-res should just be moved to historic since there is nobody
> to maintain it, and no place to discuss its shortcomings. Requiring every
> downstream MTA and MUA to do DMARC policy checks would be a mess and *that*
> is most certainly in scope as scaling is an internet issue.
>
> Mike
>

And for the second time, that is not a DMARC problem, it is an auth-res
problem. It is also a problem for someone who writes an extension without
understanding what they are presenting to the end user.

Michael Hammer