It's basically fine, but of course that doesn't keep me from suggesting changes.
There's two fairly different contexts in which people use ARF. The original one, and still by far the most common, is when two mail systems make a private agreement to exchange abuse reports, usually reports due to recipients manually reporting messages as spam. The other one is sending reports between parties that don't know each other, with the recipient address typically being abuse@domain, or looked up via RIR WHOIS or the like. The reports may be manual, or automated due to hitting spam traps, or scored high by spam filters, or anything else. At least one large provider (Yahoo) has said that it wants all its reports as ARF, and I've been sending all my reports as ARF for over a year. I can report that it works at least as well as any other form. I'd suggest reorganizing the draft a little to clarify that prior agreement vs. no prior agreement are two different applications, both in current use. If people want, I can suggest specific changes. R's, John _______________________________________________ marf mailing list [email protected] https://www.ietf.org/mailman/listinfo/marf
