Subject: [dmarc-ietf] DMARC bis: ticket 63: make p=none with no reporting URI invalid?

From: Seth Blank <[email-masked]>
Date: Fri, 15 May 2020 11:26:24 -0700

https://trac.ietf.org/trac/dmarc/ticket/63

A published DMARC record that consists solely of "v=DMARC1; p=none" is
syntactically valid, but is semantically equivalent to having no record at
all.

>From an ecosystem perspective, especially in Europe, data has been shared
showing an increasing number of domains putting in bare p=none records, and
then claiming that they are implementing DMARC and have some layer of
protection against spoofing of their domain.

Explicitly making this case invalid would remove confusion from the
ecosystem, and allow any checker that is up to spec to properly flag a bare
p=none record as being the same as not having a record at all.

Should we make it invalid to have p=none without a reporting address?

-- 

*Seth Blank* | VP, Standards and New Technologies
*e:* [email-masked]
*p:* 415.273.8818

This email and all data transmitted with it contains confidential and/or
proprietary information intended solely for the use of individual(s)
authorized to receive it. If you are not an intended and authorized
recipient you are hereby notified of any use, disclosure, copying or
distribution of the information included in this transmission is prohibited
and may be unlawful. Please immediately notify the sender by replying to
this email and then delete it from your system.

---

From: Scott Kitterman <[email-masked]>
Date: Fri, 15 May 2020 16:02:46 -0400

> Should we make it invalid to have p=none without a reporting address?

I'll bite:

No.

This is unrelated to interoperability and unlikely to actually improve 
anything (this reminds me of the occasional suggestions to make v=spf1 +all 
special for SPF records).

Let's imagine a world where a domain that wants to claim they do DMARC in 
accordance with the latest RFC 7489bis takes their  "v=DMARC1; p=none" record 
and adds an RUA reporting address to it to comply.  Then they never set up the 
email address and the RUA reports all bounce.  It's compliant, right?

So then people demand a fix to require the address to be accept mail.  We spend 
two years doing that and then that same domain starts accepting mail to the 
RUA address, but they route it to /dev/null.

Then people complain about the waste of bandwidth associated with sending 
reports that get thrown away...

There's really no end to this.  Let's not start down the path.

Scott K

---

From: "John Levine" <[email-masked]>
Date: 15 May 2020 21:03:59 -0400

>special for SPF records).

Agreed. If we want to create a profile so people can give themselves a
DMARC gold star, we can do that, but let's not mess up the spec.

Also, I can imagine situations where a plain p=none makese sense, for
some tiny domain that sends out two robotic notifications a week or
the like.  It too little to be worth instrumenting.

R's,
John

---

From: Hector Santos <[email-masked]>
Date: Sat, 16 May 2020 00:47:05 -0400

On 5/15/2020 2:26 PM, Seth Blank wrote:
> syntactically valid, but is semantically equivalent to having no
> record at all.
>
>  From an ecosystem perspective, especially in Europe, data has been
> shared showing an increasing number of domains putting in bare p=none
> records, and then claiming that they are implementing DMARC and have
> some layer of protection against spoofing of their domain.
>
> ecosystem, and allow any checker that is up to spec to properly flag a
> bare p=none record as being the same as not having a record at all.
>

No. Reporting can not be mandated.

-- 
HLS

---

From: Alessandro Vesely <[email-masked]>
Date: Sat, 16 May 2020 11:37:32 +0200

On Fri 15/May/2020 20:26:24 +0200 Seth Blank wrote:
> syntactically valid, but is semantically equivalent to having no record at all.
> 
> Explicitly making this case invalid would remove confusion from the ecosystem,
> and allow any checker that is up to spec to properly flag a bare p=none record
> as being the same as not having a record at all.
> 

No.  A bare "v=DMARC1; p=none" still behaves better than NXDOMAIN, and may cut
the number of necessary queries.  We should instead recommend it.

Best
Ale
--

---

From: Tim Wicinski <[email-masked]>
Date: Thu, 21 May 2020 17:57:22 -0400

(with no hats)

p=none with no reporting is fine, and we should keep it.

One thing the WG could do is a BCP document on operational recommendations
where there are certain suggestions like this.

tim

On Sat, May 16, 2020 at 5:37 AM Alessandro Vesely <[email-masked]> wrote:

> ecosystem,
> _______________________________________________
> dmarc mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/dmarc
>

---

From: Dotzero <[email-masked]>
Date: Thu, 21 May 2020 21:09:56 -0400

On Thu, May 21, 2020 at 5:57 PM Tim Wicinski <[email-masked]> wrote:

> +1

Michael Hammer