Subject: [Uta] tlsrpt

From: James Cloos <[email-masked]>
Date: Fri, 12 Apr 2019 11:01:00 -0400

I see that google has started sending tls reports to the rua listed in
_smtp._tls.ZONE. TXT RRs.

Has anyone else?

-JimC
-- 
James Cloos <[email-masked]>         OpenPGP: 0x997A9F17ED7DAEA6

---

From: "Brotman, Alexander" <[email-masked]>
Date: Fri, 12 Apr 2019 19:12:11 +0000

Yes, we've gotten a couple now.  There was an announcement on their blog:

https://security.googleblog.com/2019/04/gmail-making-email-more-secure-with-mta.html

Mostly talking about MTA-STS, but they do mention that TLSRPT started as well.

--
Alex Brotman
Sr. Engineer, Anti-Abuse & Messaging Policy
Comcast

> -----Original Message-----
> From: Uta <[email-masked]> On Behalf Of James Cloos
> Sent: Friday, April 12, 2019 11:01 AM
> To: [email-masked]
> Subject: [Uta] tlsrpt
> 
> _______________________________________________
> Uta mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/uta

---

From: Grant Taylor <[email-masked]>
Date: Fri, 12 Apr 2019 13:22:36 -0600

> _smtp._tls.ZONE. TXT RRs.

I received my first one this morning.

-- 
Grant. . . .
unix || die

---

From: James Cloos <[email-masked]>
Date: Sat, 13 Apr 2019 08:03:16 -0400

>>>>> "BA" == Brotman, Alexander <[email-masked]> writes:

BA> Yes, we've gotten a couple now.  There was an announcement on their blog:

Thanks, and apologies for my ambiguity.

I meant has any one else started sending tlsrpts?

-JimC

---

From: Alice Wonder <[email-masked]>
Date: Sun, 14 Apr 2019 09:49:14 -0700

> _smtp._tls.ZONE. TXT RRs.

Yes, and they are sending them to me even when there are no errors.
They are sending them to my little used mail server when they have made 
no attempts to deliver to that domain.

And there is no indication as to whether or not the report contains a 
failure, I have to open the JSON file to find out.

I want to RFC changed so that reports are only sent when there was a 
failure, like how I recall DMARC worked before I stopped using it due to 
the mail list false positive problem.

Google assumes I have software receiving those messages that will 
decompress the archive and parse the JSON. I don't, and do not plan to. 
Reports should only be sent when there is an error to report. In my opinion.

---

From: Grant Taylor <[email-masked]>
Date: Sun, 14 Apr 2019 12:47:30 -0600

> no attempts to deliver to that domain.

I'm surprised they are sending them to you when you say they are not 
delivering to your server.

I would expect that you can correlate the sending-mta-ip entries with 
entries in your MTA logs.

> failure, I have to open the JSON file to find out.

No.  :-/

> the mail list false positive problem.

I personally like the reports for passes in addition to the failures. 
Much like backup jobs, I like to see that they are running.  I configure 
a rule in my MUA to mark the messages as read, so they don't come to my 
attention as unread messages.  Yet they are still there if / when I want 
to go look to see if the backups have been running.

> Reports should only be sent when there is an error to report. In my 

I think that DMARC and MTA-STS are designed with the intent that 
something other than a human is going to be consuming the reports.  Such 
is life.  I don't know what I think of JSON vs XML vs something else.

I'm likely going to write something to receive the reports, extract and 
parse them to send me a summary.  All passes will be marked as read. 
Any failures will be unread for me to look at.

-- 
Grant. . . .
unix || die

---

From: Grant Taylor <[email-masked]>
Date: Sun, 14 Apr 2019 12:59:29 -0600

On 4/14/19 12:47 PM, Grant Taylor wrote:
> I don't know what I think of JSON vs XML vs something else.

Never mind.

I think I actually prefer the XML reports as they have not had all their 
white space removed.  As such, I think they are easier to parse.

-- 
Grant. . . .
unix || die

---

From: Viktor Dukhovni <[email-masked]>
Date: Sun, 14 Apr 2019 15:27:31 -0400

> On Apr 14, 2019, at 2:59 PM, Grant Taylor <gtaylor=[email-masked]> wrote:
> 
> I think I actually prefer the XML reports as they have not had all their white space removed.  As such, I think they are easier to parse.

For me, it is JSON by large margin.  Largely because I can use "jq", and
don't have to go near "xslt".

-- 
	Viktor.

---

From: James Cloos <[email-masked]>
Date: Sun, 14 Apr 2019 18:03:22 -0400

>>>>> "VD" == Viktor Dukhovni <[email-masked]> writes:

VD> For me, it is JSON by large margin.  Largely because I can use "jq", and
VD> don't have to go near "xslt".

I specified an https uri rather than an smtp one.

jq and json_pp work very well.

And it is easier to do whatever one wants with the reports.

The reports only just started, but Google-SMTP-STS has been querying my
/.well-known/mta-sts.txt files for weeks.  I think I first noticed those
back in January.  Maybe earlier.

-JimC

---

From: Alice Wonder <[email-masked]>
Date: Fri, 19 Apr 2019 21:53:41 -0700

On 4/14/19 11:47 AM, Grant Taylor wrote:
>> They are sending them to my little used mail server when they have 
>> made no attempts to deliver to that domain.
> 

They have sent to it before, just not during the time period for the report.

It has two e-mail accounts, both are mine, and rarely used.

---

From: Daniel Margolis <[email-masked]>
Date: Fri, 26 Apr 2019 14:27:58 +0200

Hey,

Google should only be sending TLSRPT reports for time periods in which
there was mail sent. Per the RFC, these should be sent even if there are no
failures; the "success count" serves as an indicator that reporting works,
etc.

Alice, if you want to share with me (off list, if you prefer) an example
report that you believe to be an error, perhaps I can help investigate.

As for automated handling, I have experimented with
https://www.uriports.com/, which handles TLSRPT. I don't know much about
the people behind this service, but they offer automated parsing of TLSRPT
(and a bunch of others, like DMARC), which is nifty. :)

Dan

-- 
How's my emailing? http://go/dan-email-slo

---

From: James Cloos <[email-masked]>
Date: Sat, 27 Apr 2019 12:07:41 -0400

>>>>> "DM" == Daniel Margolis <[email-masked]> writes:

DM> Google should only be sending TLSRPT reports for time periods in which
DM> there was mail sent.

They send me daily reports for each of my tlsrpt zones to which they've
sent any mail since they started grabbing the .well-knowns.  But not for
those to which they have never sent mail.

A no-mail report looks like:

{
   "contact-info" : "[email-masked]",
   "date-range" : {
      "start-datetime" : "2019-04-26T00:00:00Z"
      "end-datetime" : "2019-04-26T23:59:59Z",
   },
   "organization-name" : "Google Inc.",
   "report-id" : "2019-04-26T00:00:00Z_redacted"
}

-JimC

---

From: Daniel Margolis <[email-masked]>
Date: Sun, 28 Apr 2019 11:08:57 +0200

Interesting. That's possible.

Actually, let me step back. Not to be stupid, but reading the RFC, is there
a clear statement on when an MTA should send TLSRPT reports? Sending them
to a domain to whom you've never communicated before seems a bit odd, but I
actually can't figure out (at a quick skim) if sending reports for periods
in which you did not communicate with the MTA is recommended or not.

It *seems* weird to me. But--and I realize this is an odd question--is it
clear that this is not working-as-intended per the RFC?