Re: [dmarc-ietf] Fwd: Eliot's review of the DMARC spec

["John R Levine" <[e-mail]>]

> I wonder whether DMARC shouldn't be two specifications? It seems that 
> the validation portions of DMARC are well defined, straight forward to 
> implement, and could easily be implemented by most modern MTAs (whether 
> by milter, Amavis, or SpamAssassin).
>
> The reporting aspects OTOH, are complex and encumbered with technical 
> issues, security issues and sticky legal questions about information 
> disclosure. While the reporting is valuable, its value will certainly be 
> diminished by the number of organizations that implement it.

I don't see any benefit in that.  I expect the spec will be somewhat 
shorter when we're done, and in most cases I expect that people who 
implement one will at least partially implement the other.

>> I implement it as perform policy if (time mod 100) < pct, which I
>> think is what everyone else does, no DMARC state needed.  It's worth
>> mentioning this as an adequate implementation.
>
> I implemented with rand:
>
> $result->reason( type => 'sampled_out' ) if rand(100) >= $policy->pct;

rand() is usually seeded from the stuff including clock so it amounts to 
the same thing.  The point of course is that you can do the percent stuff 
by rolling dice, not by a rolling average.

Regards,
John Levine, [e-mail], Taughannock Networks, Trumansburg NY
"I dropped the toothpaste", said Tom, crestfallenly.