Re: [dmarc-ietf] Ticket #55 - Clarify legal and privacy implications of failure reports

["Murray S. Kucherawy" <[e-mail]>]

Hatless:

On Wed, Dec 23, 2020 at 10:10 AM John R Levine <[e-mail]> wrote:

> On Wed, 23 Dec 2020, Ned Freed wrote:
> >  Failure reports provide detailed information about the failure of a
> single
> >  message or a group of similar messages failing for the same reason. They
> >  are meant to aid in cases where a domain owner is unable to detect why
> >  failures reported in aggregate form did occur. It is important to note
> >  these reports can contain either the header or the entire content of a
> >  failed message, which in turn may contain personally identifiable
> >  information, which should be considered when decoding whether or not to
> >  generate such reports.
>
> Ship it.
>

Modulo a couple of tweaks (below), I agree.

Failing that, I have another proposal to consider that might aid us in
shipping a standards track DMARC sooner: Remove any and all mention of
failure reports, and do all that in a later add-on document as was done
with RFC 6651.

Tweaks:

* s/whether or not/whether/
* s/decoding/deciding/

-MSK