[dmarc-ietf] Re: I-D Action: draft-ietf-dmarc-failure-reporting-19.txt

[Alessandro Vesely <[e-mail]>]

On Wed 05/Nov/2025 17:57:33 +0100 Al Iverson wrote:
>
> I think it was overkill to remove (sometimes referred to as "forensic 
> reports") from section 7. I don't know enough to know if there's an 
> IETF terminology reason to remove that, but assuming not, my 
> recommendation is to restore it, just because it helps drive 
> understanding -- driving the connection that regardless of which term 
> is used, that's what we're ultimately referring to. Meaning, it 
> bridges an understanding gap, and that's generally a positive thing.


Todd asked for it to be removed, because the word "forensic" doesn't appear in 
either DMARCbis or the Aggregate Reporting document.

If we want to restore it, it should be after the first occurrence of the term 
"Failure reports", in the Introduction.


> Also in section 7, I don't understand this statement: "On the other
> hand, a Domain Owner publishing an internal Report Consumer, can put a
> dot-forward at that mailbox." Could somebody ELI5? I mean, I know what
> email forwarding is, and I understand most of these words, but I think
> there's context missing. (I'd also suggest rewording it to not use the
> inside baseball term "dot-forward," but I'm not able to offer a
> rewrite because I'm missing something about the broader context of the
> statement.)


Section 7.2 speculates on the recipient type indicated in the ruf=tag.  It 
prompts report generator to consider the recipient type they are sending 
reports to.  Invoking dot-forward warns that, in any case, the information a 
report generator reads from the DMARC Policy record may not include all end 
recipients.


Best
Ale
--