Re: [dmarc-ietf] DMARC forensic reports (ruf=) and privacy

Hello John,

DMARC reports for p=none are not supposed to be useful, as they do not depend on the policy.

If the question is about how to get reports on failing DKIM validation only on unexpectedly smashed messages, then I
recall the last discussion on Ietf-dkim@ietf.org:

- this is not DMARC, but DKIM domain
- when the DKIM-Signature does not validate, contains r=y and the remainign provisions from RFC6651 do apply, a
(usefull) report shall be sent
- when a message is intentionally modified, in way that the DKIM-Signature gets invalidated, the modified message shall
adapt somehow the fact that it was intentionally modified for particular DKIM-Signatures, so that no useless report is
sent
- Nobody wants to modify DKIM-Signature, so it is unclear where to add the information that the message was
intentionally smashed in regards the first and second DKIM-Signature, but not for the third one.

I proposed at the time to add a r=a tag, sending only report, when DKIM aligns to From:, so that after passing a MLM
rewriting From: no reports shall be sent (contrary to r=y).  Now I realize, that for p=none there is no added
usefulness, since
- DKIM-Signature gets usually intentionally broken, while passing over the MLM, and
- From: is not rewritten, therefore From: alignes to the signature,

so a useless report will be sent for the message.

Regards
  Дилян

On Tue, 2019-02-05 at 20:01 -0500, John Levine wrote:
> In article <974c2d00017358cdf3b78037e4276234db2cfdee.camel@aegee.org> you write:
> > Hello John,
> > 
> > On Sat, 2019-01-26 at 11:31 -0500, John Levine wrote:
> > > …  The failure reports are almost
> > > entirely useless.  Of the ones I get, the majority are random Chinese
> > > spam that happened to forge one of my domains on the From line, the
> > > rest are from mailing lists where I wouldn't expect DMARC to pass.
> > How do you define a useful report and for which purpose do you want to receive reports? 
> 
> A useful report would be one that was a message that one of my users
> had actually sent and was smashed in a way I didn't expect.
> 
> > I mean, when does sending reports to p=none make sense.
> 
> The feedback reporting doesn't depend on the policy.  Please review
> section 7 of RFC 7489.
> 
> _______________________________________________
> dmarc mailing list
> dmarc@ietf.org
> https://www.ietf.org/mailman/listinfo/dmarc