[dmarc-ietf] Another minor contradiction in the draft specification

["J. Gomez" <[e-mail]>]

Hello all.

The DMARC Requirement #7 in Section 3.4 reads:

  Message disposition requests via DMARC override those requested
  by any other public mechanism.

The old draft in its pre-IETF track ( http://dmarc.org/draft-dmarc-base-00-02.txt ) said in the fourth paragraph in Section 7:

  DMARC-compliant Mail Receivers MUST disregard any mail directive
  discovered as part of an authentication mechanism (e.g., ADSP, SPF)
  where a DMARC policy is also discovered. {R7}

However, now the current DMARC draft ( https://datatracker.ietf.org/doc/draft-kucherawy-dmarc-base/?include_text=1 ) says in that same spot:

   DMARC-compliant Mail Receivers SHOULD disregard any mail directive
   discovered as part of an authentication mechanism (e.g., ADSP, SPF)
   where a DMARC policy is also discovered that specifies a policy other
   than "none". {R7}

It can be argued that both MUST and SHOULD fall into {R7}, but it is dubious that excepting the policy of "p=none" from being subjected to either that MUST or SHOULD makes it also fall into {R7}. The new text effectively excepts "p=none" from Requirement #7, but Requirement #7 does not seem to allow for that.

Regards,

J. Gomez