Re: [dmarc-ietf] Ticket #39 - remove p=quarantine

Dotzero <> Wed, 02 December 2020 03:02 UTC

Return-Path: <>
Received: from localhost (localhost []) by (Postfix) with ESMTP id C9CE43A1084 for <>; Tue, 1 Dec 2020 19:02:13 -0800 (PST)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: -2.097
X-Spam-Status: No, score=-2.097 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Authentication-Results: (amavisd-new); dkim=pass (2048-bit key)
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id B1J-dPAtCzWa for <>; Tue, 1 Dec 2020 19:02:11 -0800 (PST)
Received: from ( [IPv6:2607:f8b0:4864:20::82f]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by (Postfix) with ESMTPS id 892133A107C for <>; Tue, 1 Dec 2020 19:02:05 -0800 (PST)
Received: by with SMTP id v11so86712qtq.12 for <>; Tue, 01 Dec 2020 19:02:05 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=kU1KoRnVyi6kPEPphpkeTOsMa7mxaXb8sccZ8Ri2N/Y=; b=d1IzYTwG47pFc5SfiGpxyjShx4pylcK6ZMGRx/n530WOBtZVnMaI056i2C3iOsViaq LMFxaxNOryiaa1NJFAVopcAnkzD1mfzkrZUAslcPhZQHU2VkkyQ6wW4oTPyiOSymFqrH NN1aCupDmbSIL+NijbuflyYzaWuCdQO6As5tnaz6Myx4nVvK0crHFaGQlSdwOz6yZDNn 5R1ydNsb3JrKgkPgsSwhVjQnqMNHOQvce1adYxoVatu5wHCqazZOOErugSD7+RM9prwd EIGNGR8RPWy3ef9Wka15B68jwhZKABRV8U2xQhlQci3rAIsgiBHBsTmM/gGEhXPUEslH Ua+A==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=kU1KoRnVyi6kPEPphpkeTOsMa7mxaXb8sccZ8Ri2N/Y=; b=eMFM9cpUrfLJOMbm5IipV2C+lUqtKcJxoLtaKkaazKEqqCM2XlnJum330hkUC+wwwS 5R2VUlp5KRT7FUkU15sR78Wb2C2KiQhZqbbs61QR8ERV79doEL49w9y+4UtB5HY8VuwA nN2HfOduNnGEMCQ9h6KhNHVpUTHf4GNFcZ3qQupy51QzvgFj3iXwHZh0jNyPdhYaXvVq EHbh+REBghxFD46m8P4dyI8vTZsKWI7smh0b34Mqw8sUizg2SE2ZdUkuNBbnhPXlWHZk zaW3tqcc+2lp7Tmo9GD2N9jrA5nEBSh0ui4YBJ8ZkR397ws2TzS9N8WELdboqiFjQl+E bRrQ==
X-Gm-Message-State: AOAM530mrXzhk9GmRrPOzCvqG1VONDIVsP5mu1EiVGLSgXofdDRhUIoO C4LaUWHA7OsoWHgkc5f5xqHILZ3pJ3nzY703cfnR+/wn
X-Google-Smtp-Source: ABdhPJyS071X6JMmAxfllh2Ibt0sbd+nSKk7IbUrh/r+JDROZp49wqEudSJ08RmXifGB4MeZlMhY3DHrStCy+w58XkU=
X-Received: by 2002:ac8:5d53:: with SMTP id g19mr654874qtx.354.1606878124502; Tue, 01 Dec 2020 19:02:04 -0800 (PST)
MIME-Version: 1.0
References: <> <> <> <>
In-Reply-To: <>
From: Dotzero <>
Date: Tue, 1 Dec 2020 22:01:53 -0500
Message-ID: <>
To: Steven M Jones <>
Content-Type: multipart/alternative; boundary="000000000000cef2a205b572773e"
Archived-At: <>
Subject: Re: [dmarc-ietf] Ticket #39 - remove p=quarantine
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: "Domain-based Message Authentication, Reporting, and Compliance \(DMARC\)" <>
List-Unsubscribe: <>, <>
List-Archive: <>
List-Post: <>
List-Help: <>
List-Subscribe: <>, <>
X-List-Received-Date: Wed, 02 Dec 2020 03:02:21 -0000

On Tue, Dec 1, 2020 at 8:43 PM Steven M Jones <> wrote:

> On 12/1/20 4:16 PM, Douglas Foster wrote:
> >
> > I have always assumed that p=quarantine and pct<>100 were included to
> > provide political cover for "Nervous Nellies" who were afraid to
> > enable p=reject.
> p=none, p=quarantine, and the pct= option were all included so that
> organizations could set policies according to their own risk/reward
> evaluation, including changes to those evaluations over time.

Absolutely agree with Steve on this. The key phrase is "risk/reward
evaluation". As about the first person to publish DMARC records (before the
specification was public), I went straight to p=reject, but I had the
benefit of feedback from participating mailbox providers before we even had
an agreed upon reporting format. Even with that, I missed one oddball
server for both DKIM signing and SPF. The organization I worked for had a
number of heavily abused domains from a direct domain abuse perspective.
None of the mail was going through mailing lists or other intermediaries
other than a very small fraction of a percent going through vanity domains,
etc. My point is that if my circumstances were different I might have gone
through p=quarantine or even stayed there permanently.

> > Pct<>100 is pretty much similar.   A sender can specify pct=20, but
> > that does not mean that I am going to allow spam into my system 80% of
> > the time simply to make the sender happy.
> I really hope no casual readers get the impression that DMARC bypasses
> spam filtering. DMARC evaluations are expected to be independent of spam
> evaluations. If there's any overlap here, perhaps it would be for DMARC
> (and/or underlying protocols) to provide reliable domain attribution to
> drive a local policy decision about filtering.

DMARC does one thing and one thing only - It mitigates direct domain abuse.
It does not stop spam, phishing or a multitude of other problems.

> > Leaving it deployed is a useful ruse to promote deployment.   I favor
> > leaving both mechanisms in place.
> While I deplore characterizing these policy elements as a "ruse," I
> agree that p=quarantine should be kept.

Again, I agree with Steve on this.

Michael Hammer