Re: [dmarc-ietf] reporting documents, Ticket #55 - Clarify legal and privacy implications of failure reports

[Michael Thomas <[e-mail]>]

On 12/28/20 10:05 AM, Seth Blank wrote:
> We agreed to split aggregate and failure reporting into different 
> documents, and this split was discussed on the list several times, as 
> well as at IETF 108.
>
> The intention was to split apart the key components that realistically 
> get updated in different manners / at different cadences.
>
> Aggregate reports and failure reports get used in wholly different 
> manners, have fundamentally different use cases, are implemented in 
> wildly different ways, and have completely different privacy and 
> security considerations. Hence, we agreed they should be split into 
> separate documents, so each can be concise, to the point, and 
> independently updated.
>

Does that mean all of the reporting? So that DMARC is really ADSP-bis? 
The reporting is clearly a completely separate protocol from the policy 
mechanism, and is far more likely to mutate than the base policy 
mechanism which has changed very little from ADSP. I mean, as far as I 
can tell the main change from ADSP is to include spf too.

Mike