Re: [dmarc-ietf] Ticket #55 - Clarify legal and privacy implications of failure reports

[John R Levine <[e-mail]>]

I think that text is way too long and overspecific but we've already spent 
too much time on this so I'll stop and see if there are other opinions.


On Tue, 22 Dec 2020, Alessandro Vesely wrote:
> OLD
>
>   "Failure reports," or "failed message reports," provide diagnostic
>   information about messages that a Mail Receiver has determined do not
>   pass the DMARC mechanism.  These reports are generally sent at the
>   time such messages are received and evaluated, to provide the Domain
>   Owner with timely notification that such failures are occurring, and
>   to provide information that may assist in diagnosing the cause of the
>   failures.
>
>
> NEW
>
>   Failure reports provide detailed information about the failure of a single
>   message or a group of similar messages failing for the same reason.  They
>   are meant to aid extreme cases where a domain owner is unable to detect > why
>   failures reported in aggregate form did occur.  As an extension of other
>   kinds of failure notifications, these reports can contain either the > content
>   of a failed message or just its header.  The latter characteristic entails
>   severe privacy concerns.  For that reason, and because it turned out not > to
>   be important, failure reporting is usually disabled.

Regards,
John Levine, [e-mail], Taughannock Networks, Trumansburg NY
Please consider the environment before reading this e-mail. https://jl.ly