Subject: Re: [Uta] Updated TLSRPT Draft (v07)

From: David Illsley <[email-masked]>
Date: Wed, 2 Aug 2017 09:15:34 +0100

A couple of minor comments:
1. Section 3 includes:
  "A URI specifying the endpoint to which aggregate information about
policy failures should be sent" and "When sending failure reports via SMTP"
This might imply that reports should only be sent when a failure is
experienced, whereas I believe the intention is for this to be like DMARC
where reporting is sent when messages are exchanged even if there are no
policy failures.
This could be clarified with the above changed to:
 "A URI specifying the endpoint to which aggregate information about policy
validation results should be sent" and "When sending aggregate reports via
SMTP"

2. Appendix 2: Example JSON Report - the JSON has a few syntax problems:
 - A , is required after the "summary" object
 - A " is required to close the result-type property in the third failure
 - A " is required to close the receiving-mx-hostname in the third failure

HTH
David

On Mon, Jul 31, 2017 at 6:35 PM, Brotman, Alexander <
[email-masked]> wrote:

> Hello Folks,
>
> We attempted to incorporate the feedback from Alexey and Chris as best we
> could, and we believe we have addressed each of their concerns either via
> the updated draft or via the mailing list.  The period for the WGLC is
> nearly over, and we wanted to try to provide an interim/updated draft for
> any final review.  Thank you for any comments.
>
> --
> Alex Brotman
> Sr. Engineer, Anti-Abuse
> Comcast
>
>
> _______________________________________________
> Uta mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/uta
>

---

From: David Illsley <[email-masked]>
Date: Fri, 11 Aug 2017 18:30:33 +0100

Additionally, I've just noticed that the rua field in TLSRPT is unlike
DMARC, and is a single URL, not a comma-separated list. In my experience
deploying DMARC, it's been useful to feed reports to multiple systems. If
that's an oversight, rather than an explicit decision, I'd be keen on
TLSRPT matching DMARC, and supporting a list.
Cheers,
David

On Wed, Aug 2, 2017 at 9:15 AM, David Illsley <[email-masked]>
wrote:

> policy validation results should be sent" and "When sending aggregate
> reports via SMTP"
>