Subject: [dmarc-ietf] Discussion - ARC/Extensible Reporting (Ticket #56)

From: "Brotman, Alex" <[email-masked]>
Date: Wed, 2 Dec 2020 19:46:54 +0000

Folks,

While this ticket/enhancement specifically mentions ARC, I could perhaps see the usefulness in other places.  It seems like it would be more beneficial to create a method by which other documents could provide XML- based "extensions" to the report.  This would allow mechanisms relying on DMARC to independently define their reporting schema to be included in DMARC aggregate reports.  Alternately, we could focus specifically on ARC, and work to include that in the base XML.  This means that any later reporting requirements could again require changes to the core drafts.

If possible, we'd like to see if we can reach some consensus within a few weeks.

--
Alex Brotman
Sr. Engineer, Anti-Abuse & Messaging Policy
Comcast

---

From: Alessandro Vesely <[email-masked]>
Date: Thu, 3 Dec 2020 12:24:28 +0100

> While this ticket/enhancement specifically mentions ARC, I could perhaps see the usefulness in other places.  It seems like it would be more beneficial to create a method by which other documents c…

Another possibility is for ARC to define its own report format.  Hijacking rua= 
targets to send a different kind of report should be allowed.  Otherwise, we 
could define a new tag, e.g. rue= (e for Extension).

In either case, as we're introduce variations in aggregate report content, we 
have to devise a method for determining what version/kind of report is attached 
to a given message.

Best
Ale
--

---

From: "Brotman, Alex" <[email-masked]>
Date: Thu, 3 Dec 2020 18:54:51 +0000

> -----Original Message-----
> From: dmarc <[email-masked]> On Behalf Of Alessandro Vesely
> Sent: Thursday, December 3, 2020 6:24 AM
> To: [email-masked]
> Subject: Re: [dmarc-ietf] Discussion - ARC/Extensible Reporting (Ticket #56)
>
> > While this ticket/enhancement specifically mentions ARC, I could perhaps
> see the usefulness in other places.  It seems like it would be more beneficial
> to create a method by which other documents could provide XML- based
> "extensions" to the report.  This would allow mechanisms relying on DMARC
> to independently define their reporting schema to be included in DMARC
> aggregate reports.  Alternately, we could focus specifically on ARC, and work
> to include that in the base XML.  This means that any later reporting
> requirements could again require changes to the core drafts.
> >
>
>
> have to devise a method for determining what version/kind of report is
> attached to a given message.
>

We could add an element called "<extensions>", and we allow ARC or whatever it may be to exist under that element.  The Aggregate Reporting document needs to specify that any extensions are expected to be proper XML, and if there are no extensions, an empty element is sufficient.  We could create a bit more structure as a requirement if we wanted:

<extensions>
  <extension name="arc" standard="ARC_DMARC_REPORTING_EXTENSION_DEFINITION">
    ... (as defined in referenced standard)
  </extension>
</extensions>

If a report parser doesn't know what ARC is (or any of the extensions), it could skip the processing.  I do understand this means that <extensions> element may break existing parsers, even when empty, though, I expect many of the things we're proposing may fracture the expected XML.

---

From: Alessandro Vesely <[email-masked]>
Date: Thu, 3 Dec 2020 20:43:46 +0100

On Thu 03/Dec/2020 19:54:51 +0100 Brotman, Alex wrote:
>>> While this ticket/enhancement specifically mentions ARC, I could
>>> perhaps see the usefulness in other places.  It seems like it would be
>>> more beneficial to create a method by which other documents could
>>> provide XML- based "extensions" to the report.  This would allow
>>> mechanisms relying on DMARC to independently define their reporting
>>> schema to be included in DMARC aggregate reports.  Alternately, we could
>>> focus specifically on ARC, and work to include that in the base XML.
>>> This means that any later reporting requirements could again require
>>> changes to the core drafts.>>>
>>
>>
>> Another possibility is for ARC to define its own report format.  Hijacking
>> rua= targets to send a different kind of report should be allowed.
>> Otherwise, we could define a new tag, e.g. rue= (e for Extension).>>
>> In either case, as we're introduce variations in aggregate report content,
>> we have to devise a method for determining what version/kind of report is 
>> attached to a given message.>>
> 
> We could add an element called "<extensions>", and we allow ARC or whatever
> it may be to exist under that element.  The Aggregate Reporting document
> needs to specify that any extensions are expected to be proper XML, and if
> there are no extensions, an empty element is sufficient.  We could create a
> bit more structure as a requirement if we wanted:> 
> <extensions>

We can do a better job at producing aggregate reports with an automatically verifiable content.  For example, prepending stuff like this:

<?xml version="1.0" encoding="UTF-8"?>
<dmarc:feedback xmlns:xs="http://www.w3.org/2001/XMLSchema-instance"
	xmlns:dmarc="http://dmarc.org/dmarc-xml/0.1"
	xs:schemaLocation="http://dmarc.org/dmarc-xml/0.1 rua.xsd">
	<report_metadata>
        ...

(Perhaps something better than "http://dmarc.org/dmarc-xml/0.1" for the version)

But then, would the <extensions> imply dmarc-xml grammar should be upgraded every time ARC (or whatever) is upgraded?

Separate reports sounds simpler.

Best
Ale
--

---

From: "Marc Bradshaw" <[email-masked]>
Date: Tue, 08 Dec 2020 09:17:16 +1100

There is value in including these in one report, especially where the extended property being reported on influences how DMARC is evaluated.

Using ARC as the example, when a p=reject policy was overriden by the receiver because of an ARC evaluation, when that data is included in the report the indirect mail flow can be clearly seen, which would not be the case if ARC were included as a separate report.

This could be included in an <extension> element, or could be included directly in the auth_results section of the report, based on an assumption that the things being reported SHOULD have an authentication results entry in processed mail.

<auth_results>
<dkim>...</dkim>
<spf>...</spf>
<arc> (as defined in arc standard) </arc>
<foo> (as defined in foo standard) </foo>
</auth_results>

These would be defined in a registry with reference to each standard, and parsers would ignore any sections they did not understand.

On Fri, 4 Dec 2020, at 6:43 AM, Alessandro Vesely wrote:
> _______________________________________________
> dmarc mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/dmarc
> 

--

  Marc Bradshaw
  marcbradshaw.net | @marcbradshaw <https://twitter.com/marcbradshaw>

---

From: "Brotman, Alex" <[email-masked]>
Date: Tue, 8 Dec 2020 20:29:09 +0000

I feel (as a receiver of reports) as though another reason to have these as a single report is so that the receiver of the report is able to more easily correlate the data/times.  I should be able to believe that all reports (without a specified ri) will be 0000-2359, though things happen, and systems break down.

From: dmarc <[email-masked]> On Behalf Of Marc Bradshaw
Sent: Monday, December 7, 2020 5:17 PM
To: DMARC IETF <[email-masked]>
Subject: Re: [dmarc-ietf] Discussion - ARC/Extensible Reporting (Ticket #56)

<auth_results>
<dkim>...</dkim>
<spf>...</spf>

On Fri, 4 Dec 2020, at 6:43 AM, Alessandro Vesely wrote:
On Thu 03/Dec/2020 19:54:51 +0100 Brotman, Alex wrote:
>> From: dmarc <[email-masked]<mailto:[email-masked]>> On Behalf Of Alessandro Vesely
>> To: [email-masked]<mailto:[email-masked]>

<?xml version="1.0" encoding="UTF-8"?>
<dmarc:feedback xmlns:xs="http://www.w3.org/2001/XMLSchema-instance<https://urldefense.com/v3/__http:/www.w3.org/2001/XMLSchema-instance__;!!CQl3mcHX2A!W_xDXVx707gc61M5TAh1t1CL61wpj57BHndbtFxULnxLzggrXnZfXLDP5T6PCW5mqmCE$>"
xmlns:dmarc="http://dmarc.org/dmarc-xml/0.1<https://urldefense.com/v3/__http:/dmarc.org/dmarc-xml/0.1__;!!CQl3mcHX2A!W_xDXVx707gc61M5TAh1t1CL61wpj57BHndbtFxULnxLzggrXnZfXLDP5T6PCX_7HCv_$>"
xs:schemaLocation="http://dmarc.org/dmarc-xml/0.1<https://urldefense.com/v3/__http:/dmarc.org/dmarc-xml/0.1__;!!CQl3mcHX2A!W_xDXVx707gc61M5TAh1t1CL61wpj57BHndbtFxULnxLzggrXnZfXLDP5T6PCX_7HCv_$> rua.xsd">
<report_metadata>
        ...

(Perhaps something better than "http://dmarc.org/dmarc-xml/0.1<https://urldefense.com/v3/__http:/dmarc.org/dmarc-xml/0.1__;!!CQl3mcHX2A!W_xDXVx707gc61M5TAh1t1CL61wpj57BHndbtFxULnxLzggrXnZfXLDP5T6PCX_7HCv_$>" for the version)

Best
Ale
--

_______________________________________________
dmarc mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/dmarc<https://urldefense.com/v3/__https:/www.ietf.org/mailman/listinfo/dmarc__;!!CQl3mcHX2A!W_xDXVx707gc61M5TAh1t1CL61wpj57BHndbtFxULnxLzggrXnZfXLDP5T6PCcp8JAZr$>

--
[https://secure.gravatar.com/avatar/b214a020f4eb135ce2a6901d7540bdb1?s=44&d=404]

  Marc Bradshaw
  marcbradshaw.net<https://urldefense.com/v3/__http:/marcbradshaw.net/__;!!CQl3mcHX2A!W_xDXVx707gc61M5TAh1t1CL61wpj57BHndbtFxULnxLzggrXnZfXLDP5T6PCcwnsT8Z$> | @marcbradshaw<https://urldefense.com/v3/__https:/twitter.com/marcbradshaw__;!!CQl3mcHX2A!W_xDXVx707gc61M5TAh1t1CL61wpj57BHndbtFxULnxLzggrXnZfXLDP5T6PCZsg4P4v$>

---

From: Emil Gustafsson <[email-masked]>
Date: Wed, 23 Dec 2020 11:49:19 -0800

While the common format would be great as a consumer of reports, I'm
wondering how many different reports there would be. New auth standards
don't pop up that often, so what other reports are you thinking about? I
can see two obvious candidates; the mailserver software and the spam/abuse
prevention software. It would be interesting to support something like that
too but shouldn't those just put the results inside the dkim/spf/arc
auth_results?
/E

On Tue, Dec 8, 2020 at 12:29 PM Brotman, Alex <Alex_Brotman=
[email-masked]> wrote:

> I feel (as a receiver of reports) as though another reason to have these
> as a single report is so that the receiver of the report is able to more
> easily correlate the data/times.  I should be able to believe that all
> reports (without a specified ri) will be 0000-2359, though things happen,
> and systems break down.
>
>
>
> --
>
> Alex Brotman
>
> *From:* dmarc <[email-masked]> *On Behalf Of * Marc Bradshaw
> *Sent:* Monday, December 7, 2020 5:17 PM
> *To:* DMARC IETF <[email-masked]>
> *Subject:* Re: [dmarc-ietf] Discussion - ARC/Extensible Reporting (Ticket
> #56)
>
>
>
>
>
> There is value in including these in one report, especially where the
> extended property being reported on influences how DMARC is evaluated.
>
>
>
> Using ARC as the example, when a p=reject policy was overriden by the
> receiver because of an ARC evaluation, when that data is included in the
> report the indirect mail flow can be clearly seen, which would not be the
> case if ARC were included as a separate report.
>
>
>
> This could be included in an <extension> element, or could be included
> directly in the auth_results section of the report, based on an assumption
> that the things being reported SHOULD have an authentication results entry
> in processed mail.
>
>
>
> <auth_results>
>
> <dkim>...</dkim>
>
> <spf>...</spf>
>
> These would be defined in a registry with reference to each standard, and
> parsers would ignore any sections they did not understand.
>
>
>
> >    <extension name="arc"
> standard="ARC_DMARC_REPORTING_EXTENSION_DEFINITION">
>
> > If a report parser doesn't know what ARC is (or any of the extensions),
> it could skip the processing.  I do understand this means that <extensions>
> element may break existing parsers, even when empty, though, I expect many
> of the things we're proposing may fracture the expected XML.
>
>
>
>
>
> We can do a better job at producing aggregate reports with an
> automatically verifiable content.  For example, prepending stuff like this:
>
>
>
> <dmarc:feedback xmlns:xs="http://www.w3.org/2001/XMLSchema-instance
> <https://urldefense.com/v3/__http:/www.w3.org/2001/XMLSchema-instance__;!!CQl3mcHX2A!W_xDXVx707gc61M5TAh1t1CL61wpj57BHndbtFxULnxLzggrXnZfXLDP5T6PCW5mqmCE$>
> "
>
> xmlns:dmarc="http://dmarc.org/dmarc-xml/0.1
> <https://urldefense.com/v3/__http:/dmarc.org/dmarc-xml/0.1__;!!CQl3mcHX2A!W_xDXVx707gc61M5TAh1t1CL61wpj57BHndbtFxULnxLzggrXnZfXLDP5T6PCX_7HCv_$>
> "
>
> xs:schemaLocation="http://dmarc.org/dmarc-xml/0.1
> <https://urldefense.com/v3/__http:/dmarc.org/dmarc-xml/0.1__;!!CQl3mcHX2A!W_xDXVx707gc61M5TAh1t1CL61wpj57BHndbtFxULnxLzggrXnZfXLDP5T6PCX_7HCv_$>
> rua.xsd">
>
> <report_metadata>
>
>         ...
>
>
>
> (Perhaps something better than "http://dmarc.org/dmarc-xml/0.1
> <https://urldefense.com/v3/__http:/dmarc.org/dmarc-xml/0.1__;!!CQl3mcHX2A!W_xDXVx707gc61M5TAh1t1CL61wpj57BHndbtFxULnxLzggrXnZfXLDP5T6PCX_7HCv_$>"
> for the version)
>
>
>
> But then, would the <extensions> imply dmarc-xml grammar should be
> upgraded every time ARC (or whatever) is upgraded?
>
>
>
> <https://urldefense.com/v3/__https:/www.ietf.org/mailman/listinfo/dmarc__;!!CQl3mcHX2A!W_xDXVx707gc61M5TAh1t1CL61wpj57BHndbtFxULnxLzggrXnZfXLDP5T6PCcp8JAZr$>
>
>
>
>
>
> --
>
>   Marc Bradshaw
>
>   marcbradshaw.net
> <https://urldefense.com/v3/__http:/marcbradshaw.net/__;!!CQl3mcHX2A!W_xDXVx707gc61M5TAh1t1CL61wpj57BHndbtFxULnxLzggrXnZfXLDP5T6PCcwnsT8Z$>
> | @marcbradshaw
> <https://urldefense.com/v3/__https:/twitter.com/marcbradshaw__;!!CQl3mcHX2A!W_xDXVx707gc61M5TAh1t1CL61wpj57BHndbtFxULnxLzggrXnZfXLDP5T6PCZsg4P4v$>
>
>
>
>

---

From: Alessandro Vesely <[email-masked]>
Date: Thu, 24 Dec 2020 12:31:04 +0100

On Mon 07/Dec/2020 23:17:16 +0100 Marc Bradshaw wrote:
> 
> There is value in including these in one report, especially where the extended 
> property being reported on influences how DMARC is evaluated.

I think I represent a meagre minority of people who reads individual DMARC 
reports.  Most other people I heard of pour their reports into a database and 
then query the latter.  For them, it is indifferent whether reports come in a 
single file or spread among multiple ones.

> Using ARC as the example, when a p=reject policy was overridden by the receiver 
> because of an ARC evaluation, when that data is included in the report the 
> indirect mail flow can be clearly seen, which would not be the case if ARC were 
> included as a separate report.

When I look at an aggregate record whose relaying IP is 4.31.198.44, SPF domain 
is ietf.org, and some DKIM signatures are also tagged ietf.org, it is clear to 
me that it is an indirect mail flow.

Sometimes I get:
<reason><type>local_policy</type><comment>arc=pass</comment></reason>

If I had a separated ARC file keyed on relaying IPs, I could have found ARC 
values in there and matched them against that row in the DMARC report.

> This could be included in an <extension> element, or could be included directly 
> in the auth_results section of the report, based on an assumption that the 
> things being reported SHOULD have an authentication results entry in processed 
> mail.
> 
> <auth_results>
> <dkim>...</dkim>
> <spf>...</spf>

Say you have:
<arc><domain>example.com</domain><result>pass</result></arc>

What would that mean?  Perhaps that, according to example.com, the message did 
pass, but by what authentication method?

An <arc> stanza in auth_results would have to be succinct.  If there is more 
structured data, auth_results doesn't seem to be the right place to stuff it.

I'd propose to first define what data ARC would report.  How to report it comes 
after.

> parsers would ignore any sections they did not understand.

I'd hope we'll come out with proper XML syntax, a namespace like, say, 
urn:ietf:params:xml:ns:dmarc:aggregate:1.1 or some such, and a proper schema 
location.  I think the <selector> element of <dkim> has to become mandatory, 
which makes a difference between reports using a pre-standardization schema and 
upgraded ones.  Then, an XML schema can import other schemata, but dependencies 
and increased complexity will have to be weighted in.

Best
Ale
--

---

From: "Brotman, Alex" <[email-masked]>
Date: Wed, 30 Dec 2020 21:48:57 +0000

We’ve already mentioned ARC.  Could it also be extended to allow for Domain Reputation reporting back to the sender?  Instead of a central access point, the data is sent periodically to the domain holder, and they can then utilize the data as they see fit.  I could also see a use case for BIMI reporting.  I’m sure others could think of other use cases.

If we prefer it to exist outside of the main body of data, it may result in duplication of data, but also allows for more flexibility. This allows the original DMARC Aggregate data to remain consistent as well.  On the other hand, allowing it to exist within the record elements would allow it to be more easily correlated with the existing data.  I think my (slight) preference (as a report handler) is to have it outside of the main body of the report, but I could be swayed.

From: Emil Gustafsson <emgu=[email-masked]>
Sent: Wednesday, December 23, 2020 2:49 PM
To: Brotman, Alex <[email-masked]>
Cc: Marc Bradshaw <[email-masked]>; DMARC IETF <[email-masked]>
Subject: Re: [dmarc-ietf] Discussion - ARC/Extensible Reporting (Ticket #56)

While the common format would be great as a consumer of reports, I'm wondering how many different reports there would be. New auth standards don't pop up that often, so what other reports are you thinking about? I can see two obvious candidates; the mailserver software and the spam/abuse prevention software. It would be interesting to support something like that too but shouldn't those just put the results inside the dkim/spf/arc auth_results?
/E

On Tue, Dec 8, 2020 at 12:29 PM Brotman, Alex <Alex_Brotman=[email-masked]<mailto:[email-masked]>> wrote:
I feel (as a receiver of reports) as though another reason to have these as a single report is so that the receiver of the report is able to more easily correlate the data/times.  I should be able to believe that all reports (without a specified ri) will be 0000-2359, though things happen, and systems break down.

From: dmarc <[email-masked]<mailto:[email-masked]>> On Behalf Of Marc Bradshaw
Sent: Monday, December 7, 2020 5:17 PM
To: DMARC IETF <[email-masked]<mailto:[email-masked]>>
Subject: Re: [dmarc-ietf] Discussion - ARC/Extensible Reporting (Ticket #56)

<auth_results>
<dkim>...</dkim>
<spf>...</spf>

Best
Ale
--

--
[Image removed by sender.]

  Marc Bradshaw