Re: [dmarc-ietf] DMARC policy discovery and invalid tag exception.

[Dotzero <[e-mail]>]

On Sat, Nov 11, 2023 at 9:17 AM Neil Anuskiewicz <neil=
[e-mail]> wrote:

>
>
> On Oct 25, 2023, at 3:57 AM, Olivier Hureau <
> [e-mail]> wrote:
>
> 
> On 25/10/2023 08:10, Steven M Jones wrote:
>
> It's not so much changing the handling as changing the reporting.
>
> * The policy to apply is "none," because the p/sp/np value was faulty.
> Done.
> * Next step, if there's no "rua" target you can't report - which is now
> equivalent to bailing out of DMARC processing for this message.
>
> I am not fan of this exceptions, it breaks the ABNF ... 'A DMARC policy
> record MUST comply with the formal specification found in Section 5.4
> <https://www.ietf.org/archive/id/draft-ietf-dmarc-dmarcbis-28.html#formal-definition>
> '
> The record 'v=DMARC1; p=foobar; rua=mailto:[e-mail]
> <[e-mail]>' does not comply with the formal specification (ABNF
> rule dmarc-request)
> Furthemore, 'mailto://example.com <//example.com>' is a valid URI
> according to RFC3986. If we take into consideration the record 'v=DMARC1;
> p=foobar; rua=mailto://example.com <//example.com>' : a 'rua' tag is
> present and contains at least one syntactically valid reporting URI (no
> need to have a mailto). Who are we going to send the reports specifying the
> errors?
>
> What about using the error report of RFC 7489 for this purpose instead of
> aggregate report? (
> https://datatracker.ietf.org/doc/html/rfc7489#section-7.2.2 )
>
> I have never seen any error report but I think that error reports were a
> great ideas because they can advertise the domain owner (through the valid
> URI) for any failing external destination verification
> We could also use the error reports for  to reports any syntactic errors
> in the record could be also useful, in my opinion.
>
> Email is not dead! Now the bad news: error reports (commonly called
> failure or forensic reports are not long for this world. The only major MBP
> that I see failure reports from is Yahoo. I’m not advocating eliminating
> failure reports altogether as when one of these mythical creatures appears
> they can be very useful. But I wonder if Yahoo discusses stopping failure
> reports then failure reports would be far less useful. I do understand the
> PII concerns.
>
> My point is that the concept of failure reports sounds good in theory but
> I’d say we are in irons now with a decent chance of running aground. It
> might be an opportune time to rethink the failure report. I don’t know.
>

The fact that you aren't seeing failure reports doesn't mean they aren't
being generated. My experience has been that they are being made available
through 3rd parties where there is a contractual relationship.

Michael Hammer