Re: [dmarc-ietf] Two new fields in aggregate reports

2019-10-25 Thread John Levine
In article <682972a4-38e4-f5b2-3180-c5a03a3a0...@tana.it> you write: >Looking at aggregate reports, you cannot tell whether an authentication failure >is a sacrosanct signaling of your domain being abused rather than a legitimate >user going through external forwarders. Sure you can, you look at t

Re: [dmarc-ietf] Two new fields in aggregate reports

2019-10-25 Thread Alessandro Vesely
Hi Dilyan, On Fri 25/Oct/2019 12:51:43 +0200 Дилян Палаузов wrote: > > I do not see how this helps for DMARC. An email either validates DMARC, or > fails DMARC and the aggregate repors say per sending IP server (only direct > mail flow is reported), whether DMARC validates or fails. With this >

Re: [dmarc-ietf] Two new fields in aggregate reports

2019-10-25 Thread Dotzero
On Fri, Oct 25, 2019 at 1:53 PM Seth Blank wrote: > On Fri, Oct 25, 2019 at 10:49 AM John Levine wrote: > >> As far as I know, the point of DMARC reports is to help domain owners >> understand who is sending mail that purports to be from them. In a >> large organization it can be remarkably har

Re: [dmarc-ietf] Two new fields in aggregate reports

2019-10-25 Thread Chris Wedgwood
> I can't see how spam scores would be of any use for any of these > tasks. i don't think anyone will include those values even if they can/could for fear of it being used against them ___ dmarc mailing list dmarc@ietf.org https://www.ietf.org/mailman/l

Re: [dmarc-ietf] Two new fields in aggregate reports

2019-10-25 Thread Seth Blank
On Fri, Oct 25, 2019 at 10:49 AM John Levine wrote: > As far as I know, the point of DMARC reports is to help domain owners > understand who is sending mail that purports to be from them. In a > large organization it can be remarkably hard to track down every mail > server in every department or

Re: [dmarc-ietf] Two new fields in aggregate reports

2019-10-25 Thread John Levine
In article you write: >What is the purposes of the aggregate and non-aggregate reports? What are >non-goals? I asked several times here, >nobody answered. Perhaps a discussion on the goals and non-goal would help. As far as I know, the point of DMARC reports is to help domain owners understan

Re: [dmarc-ietf] Two new fields in aggregate reports

2019-10-25 Thread Chris Wedgwood
> Correct. However, it is an average, so a spammer would have a hard > time trying to work out the detail of how the receiver's score is > computed. [randomly] permute the input, seen 1000s of messages and look at how the score varies ... repeat ... __

Re: [dmarc-ietf] Two new fields in aggregate reports

2019-10-25 Thread Kurt Andersen (b)
On Fri, Oct 25, 2019 at 3:52 AM Дилян Палаузов wrote: > > If it is a goal to reuse the dmarc-reporting mechanism to report also > about perceived spam probability, then it can be > discussed in more details how this can be achieved. My experience is, > that asking a provider, why an obviously no

Re: [dmarc-ietf] Two new fields in aggregate reports

2019-10-25 Thread Дилян Палаузов
Hello Alessandro, I do not see how this helps for DMARC. An email either validates DMARC, or fails DMARC and the aggregate repors say per sending IP server (only direct mail flow is reported), whether DMARC validates or fails. With this information it is sufficient to determine, if the DMARC/D

Re: [dmarc-ietf] Two new fields in aggregate reports

2019-10-25 Thread Alessandro Vesely
On Fri 25/Oct/2019 02:53:32 +0200 Brandon Long wrote: > On Thu, Oct 24, 2019 at 10:55 AM Alessandro Vesely wrote: >> >> In order to ease the understanding of aggregate reports, I propose two >> additional per-record fields:>> >> >> *score*: The average score of the messages in the row; let's say