Re: [dmarc-ietf] DMARC forensic reports (ruf=) and privacy

Дилян Палаузов <dilyan.palauzov@aegee.org> Sat, 26 January 2019 17:21 UTC

Return-Path: <dilyan.palauzov@aegee.org>
X-Original-To: dmarc@ietfa.amsl.com
Delivered-To: dmarc@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8DC18130F33 for <dmarc@ietfa.amsl.com>; Sat, 26 Jan 2019 09:21:32 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.999
X-Spam-Level:
X-Spam-Status: No, score=-1.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (4096-bit key) header.d=aegee.org
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id HTJpC39GS8YN for <dmarc@ietfa.amsl.com>; Sat, 26 Jan 2019 09:21:31 -0800 (PST)
Received: from mail.aegee.org (mail.aegee.org [144.76.142.78]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 137FB130E5F for <dmarc@ietf.org>; Sat, 26 Jan 2019 09:21:30 -0800 (PST)
Authentication-Results: mail.aegee.org/x0QHLSA4029944; auth=pass (PLAIN) smtp.auth=didopalauzov
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=aegee.org; s=k4096; t=1548523289; i=dkim+MSA-tls@aegee.org; r=y; bh=B1H4Hxh75PAr1Msqd3tw7hCZ0+thZ4INlyGw1UIX7Es=; h=Subject:From:To:Date:In-Reply-To:References; b=U7pN5ca74zHcYbh3M2IyVAI9qH7D0YwECPTUyZ4Ft3goLDMUVYKm6nMfJxTxuldCY mDuaRcnvA9+iv4jD+uR8ueerOmQuU1c/KB2uqhTP90uJy9jaxD2Hzkx/gzCDQV4K8A nWbfRveLecQKvzCsNK3hSMib7ffPIElyAl2t63TtcOorvhV4TnVUz6RQ/ib2Xnu1tV V+e+fQ1sD+cmYTM7C4wRTTtIm8yiB1Ci/ao9+l6f8zsk91npiIFdItrCLKLm/2lum0 npEA/g/nFZvDUM76BMdVF+ky29J8DvQsuD2vTY8rvJ5dEq6AgOHWKTy6j/Zu+Ir+n8 zW4icYPDzIY2xuxy0/qhtY2WLm03IvHZ1mZejNcsO0ylycfyBOHDFRZ1OIRO03mLUj whLs2eTcA7usvbDFWnqZPIvy+4aKvwGAnYyDDQHc1zSCq6n8BnNoKSjgLf0hWEVS+p dIQ2wWOWIBm3ezdhuTZtEc5E6G+HXAwAISm+YuGtHjh7EpuklaEK2dy8c5Lv4Ye4PB gg6Igs++TY1wPTfMvwao5z44v7npZc2FpVGuaLli1+LPXBNeF8EZxLBClrdzcgNL0o 4cNJ/dBPvr3VHsMFqaNXg6uhS3TpRedwDgoJ98FIWx7++OLI7TONGHxwH+x0m+kWAy xuXduWBsg2YlzfCUleP1vHyc=
Authentication-Results: mail.aegee.org/x0QHLSA4029944; dkim=none
Received: from Tylan (adsl-62-167-97-198.adslplus.ch [62.167.97.198]) (authenticated bits=0) by mail.aegee.org (8.15.2/8.15.2) with ESMTPSA id x0QHLSA4029944 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NO) for <dmarc@ietf.org>; Sat, 26 Jan 2019 17:21:28 GMT
Message-ID: <5cd324dcd2d76a77618f3f77d7d7a644c2d13564.camel@aegee.org>
From: =?UTF-8?Q?=D0=94=D0=B8=D0=BB=D1=8F=D0=BD_?= =?UTF-8?Q?=D0=9F=D0=B0=D0=BB=D0=B0=D1=83=D0=B7=D0=BE=D0=B2?= <dilyan.palauzov@aegee.org>
To: dmarc@ietf.org
Date: Sat, 26 Jan 2019 17:21:28 +0000
In-Reply-To: <20190126163123.AAA4B200D39816@ary.qy>
References: <20190126163123.AAA4B200D39816@ary.qy>
Content-Type: text/plain; charset="UTF-8"
User-Agent: Evolution 3.31.90
Mime-Version: 1.0
Content-Transfer-Encoding: 8bit
X-Virus-Scanned: clamav-milter 0.101.1 at mail.aegee.org
X-Virus-Status: Clean
Archived-At: <https://mailarchive.ietf.org/arch/msg/dmarc/vOkzx4OFDYxdD1t2f8f9s16KnCQ>
Subject: Re: [dmarc-ietf] DMARC forensic reports (ruf=) and privacy
X-BeenThere: dmarc@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: "Domain-based Message Authentication, Reporting, and Compliance \(DMARC\)" <dmarc.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/dmarc>, <mailto:dmarc-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/dmarc/>
List-Post: <mailto:dmarc@ietf.org>
List-Help: <mailto:dmarc-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/dmarc>, <mailto:dmarc-request@ietf.org?subject=subscribe>
X-List-Received-Date: Sat, 26 Jan 2019 17:21:33 -0000

Hello John,

On Sat, 2019-01-26 at 11:31 -0500, John Levine wrote:
> In article <6a56a3831dd4651e0d7610ee0c90f50749a7203b.camel@aegee.org> you write:
> > How can a domain owner communicate, that its users agree to have investigations on forensic reports, where DKIM
> > signatures failed (fot the purpose of avoiding repeating errors in DKIM signing/validation)?  In particular, that there
> > is no expectation of the users that a deleted message is erased and that the domain owner, DNS staff and email staff
> > function good as whole?
> 
> I suppose they could try to put it in the terms of service, but I
> wouldn't begin to guess whether that would be enforcable or even legal
> in places with the GDPR and other privacy laws.
> 
> More to the point, I wouldn't bother.  The failure reports are almost
> entirely useless.  Of the ones I get, the majority are random Chinese
> spam that happened to forge one of my domains on the From line, the
> rest are from mailing lists where I wouldn't expect DMARC to pass.

A domain owner can certainly clarify anything in the terms of service, but even if the domain owner does these
clarifications, s/he will not receive DKIM/DMARC forensic reports, because there is no mean to communicate to the
generators of those reports, that sending forensic reports violates users expectations.

The reasons mentioned here against sending forensic reports were, that this might not match user expectations (on
deleted information) and because email staff and DNS staff may differ.  I approached both concerns, by stating that user
expections can be put in Terms of Use and that a domain owner can decide, that for a domain it is acceptable to receive
forensic reports and insert this infomation in the Terms of Use.  So… what else exactly needs to happen, to resolve the
concerns against sending forensic reports (which was my original question)?

If GDPR is the only concern, this can also be clarified.  But clarifying that GDPR is not a problem, will be losing
time, if independent of it there are other concerns.

Imagine there is a failure report stating that after a direct communication between your server and another server, the
receiving server sends you an aggregate report, stating that 1% of the messages you sent yesterday do not validate DKIM.
How do you suggest to proceed to reduce this to 0%?

Regards
  Дилян