At some point, an investigator will ask, "which of our systems sent these messages?"
I know how to search my logs for messages to domain example.com. I do not know how to search my logs for messages to domains hosted by hostingservice.tld. That is why I would expect SMTP To domain to be useful. An rua report is not supposed to be substitute for a forensic report,. All possible details are not supposed to be presented. Source IP, SMTP MailFrom domain, and SPF status should be sufficient to identify the organization responsible for the last hop. Why is additional mailflow data necessary? The best mail flow data would be to report the entire Received chain, but it would cause too much disaggregation. On Tue, Jan 26, 2021, 7:50 AM Alessandro Vesely <ves...@tana.it> wrote: > On Tue 26/Jan/2021 13:02:46 +0100 Douglas Foster wrote: > > DKIM Scopes > > I have not heard a compelling argument to require information about > > authentication tests that are unrelated to alignment testing. For > DKIM > > specifically, I think one scope should be sufficient, on this hierarchy: > > > > - The best-aligned scope that verified, or > > - the best-aligned scope that failed verification, or > > - a no-signature result otherwise. > > > > Anything more complex imposes a gratuitous data collection burden on the > > reporting domain and reduces aggregation significantly. On the > technical > > side, it has already been noted that variable-length lists are > particularly > > problematic for calculating aggregates. > > > Let me attach an HTML rendering of a report I received today, so we can > talk > about something real. > > Lines with IP 4.31.198.44 bear a ietf.org identifier. I see no reason to > remove it. It is useful for understanding the mailflow, which is what > DMARC > reporting is designed to do. > > > > Aggregation Controls > > > > We have discussed whether the target domain should be included in the > > report. I understand that doing so is not reasonable for the large > hosting > > services. On the other hand, including the target domain would be a > > trivial matter for smaller operations, and I think it would be valuable > for > > some research. Similarly, DKIM scopes are known to be useful for most > > investigations, but John has already observed that proliferation of DKIM > > scopes can be used to force disaggregation down to the individual > recipient > > level. > > > Even if this is a small example, learning the disaggregated, or even > individual > recipients does not help my understanding. Authentication is obviously > conditioned by how the Mediator treats my messages. > > I expect that Fastmail Pty Ltd carries out SPF and DKIM validation using > the > same algorithm, irrespective of the recipient. That is what I, as a > sender, am > interested in. Splitting the report in 66 lines wouldn't tell me anything > more, it would just consume more eyeballs. And is useless for people who > sum > up all reports and just look at the totals. In any case, I cannot verify > if > the messages I didn't send directly are real. > > If a multi-domain host allows personalized validation algorithms for some > domains, I'd expect they send separated aggregate reports, if any. > > > Best > Ale > -- > >
_______________________________________________ dmarc mailing list dmarc@ietf.org https://www.ietf.org/mailman/listinfo/dmarc