IETF Logo Mail Archive

Re: [dmarc-ietf] Is there any recommendation to send DMARC message-specific failure reports FROM:<> ?

"John Levine" <johnl@taugh.com> Sun, 26 May 2019 14:46 UTC

Return-Path: <johnl@iecc.com>
X-Original-To: dmarc@ietfa.amsl.com
Delivered-To: dmarc@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 970BB120135 for <dmarc@ietfa.amsl.com>; Sun, 26 May 2019 07:46:13 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.999
X-Spam-Level:
X-Spam-Status: No, score=-1.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HEADER_FROM_DIFFERENT_DOMAINS=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1536-bit key) header.d=iecc.com header.b=dnlyjR8k; dkim=pass (1536-bit key) header.d=taugh.com header.b=nvh5X0nu
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id xPOAmWVaKDC1 for <dmarc@ietfa.amsl.com>; Sun, 26 May 2019 07:46:12 -0700 (PDT)
Received: from gal.iecc.com (gal.iecc.com [IPv6:2001:470:1f07:1126:0:43:6f73:7461]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E2F21120043 for <dmarc@ietf.org>; Sun, 26 May 2019 07:46:11 -0700 (PDT)
Received: (qmail 95106 invoked from network); 26 May 2019 14:46:11 -0000
DKIM-Signature: v=1; a=rsa-sha256; c=simple; d=iecc.com; h=date:message-id:from:to:cc:subject:in-reply-to:mime-version:content-type:content-transfer-encoding; s=17380.5ceaa6b3.k1905; i=johnl-iecc.com@submit.iecc.com; bh=SQMys9UMDL6XQeJ+JTBUzutnPAa0iJQRselM20ZFJos=; b=dnlyjR8kPG2KGMBABQc7usS014zJ3WVw/Z5NmX5j+3WFUKMCWEP1P11o0645y0zeQ90BLm3gAR/FStB3ScbCw/Rlngosb8ZGkwzqDm8HAmuQ7Y37c7aAI+fmA/QifWR6JtHwFvepEBYC3Ujs+pitBAIuLgtytQw99JIN++UamgIQgveSQBomwKrk1PUIgV0TCQRv+l9xCmkUP2FiO83xrBExM9oiiwEs/Cqwgj/HRFHKh/Xwm42C6bwI0elP0iDI
DKIM-Signature: v=1; a=rsa-sha256; c=simple; d=taugh.com; h=date:message-id:from:to:cc:subject:in-reply-to:mime-version:content-type:content-transfer-encoding; s=17380.5ceaa6b3.k1905; olt=johnl-iecc.com@submit.iecc.com; bh=SQMys9UMDL6XQeJ+JTBUzutnPAa0iJQRselM20ZFJos=; b=nvh5X0nus45+5+08tXM7+ZxjWalnodTM0QbBvBthYvMZiIuVguButiiHQA+uvLDwb2u/cjiLlemi6QR4stxfh+szbPz9bKT0r8RzSC1OyPdzp4j2gvWRAVYFYsRQ98LbWTWQ6kSoHG81UxJQuI3yZErTR+aiY87VLfh5rM27/3hUDpDMQzwgREmBtyHFgQdEykPEU0S1Efdth+Hs2W8ZekUC5tv8Vf4BmaE8uXNWLV0xXEOeiuKZBGe8jOTAF8FA
Received: from ary.qy ([64.246.232.221]) by imap.iecc.com ([64.57.183.75]) with ESMTPSA (TLS1.2 ECDHE-RSA AES-256-GCM AEAD, johnl@iecc.com) via TCP; 26 May 2019 14:46:10 -0000
Received: by ary.qy (Postfix, from userid 501) id 706282014A0BB0; Sun, 26 May 2019 10:46:09 -0400 (EDT)
Date: Sun, 26 May 2019 10:46:09 -0400
Message-Id: <20190526144610.706282014A0BB0@ary.qy>
From: John Levine <johnl@taugh.com>
To: dmarc@ietf.org
Cc: Dilyan.Palauzov@aegee.org
In-Reply-To: <115E2CD4-AF67-4A8D-85BA-567BA74D34A4@aegee.org>
Organization: Taughannock Networks
X-Headerized: yes
Mime-Version: 1.0
Content-type: text/plain; charset="utf-8"
Content-transfer-encoding: 8bit
Archived-At: <https://mailarchive.ietf.org/arch/msg/dmarc/rJDsrSZrwDuO1RuHKY6j9_BMPlo>
Subject: Re: [dmarc-ietf] Is there any recommendation to send DMARC message-specific failure reports FROM:<> ?
X-BeenThere: dmarc@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: "Domain-based Message Authentication, Reporting, and Compliance \(DMARC\)" <dmarc.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/dmarc>, <mailto:dmarc-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/dmarc/>
List-Post: <mailto:dmarc@ietf.org>
List-Help: <mailto:dmarc-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/dmarc>, <mailto:dmarc-request@ietf.org?subject=subscribe>
X-List-Received-Date: Sun, 26 May 2019 14:46:14 -0000

In article <115E2CD4-AF67-4A8D-85BA-567BA74D34A4@aegee.org> you write:
>-=-=-=-=-=-
>
>Hello Grant,
>
>it is a misconfiguration, but it still creates a mail loop for the site, that is not misconfigured.
>
>To what I can say the emails are accepted at SMTP time and then bounced.
>
>I  not asking to modify DMARC, but to recommend sending message-specific, individual failure reports FROM: <>, in
>order to be protected from “misconfiguration attacks”.

Given that we've seen one report loop in seven years, my inclination
would be to suggest that you simply blackhole whatever IP their
bounces are coming from and leave it at that.




-- 
Regards,
John Levine, johnl@iecc.com, Primary Perpetrator of "The Internet for Dummies",
Please consider the environment before reading this e-mail. https://jl.ly

v2.23.0 | Report a Bug | By Email