Re: [dmarc-ietf] Does Aggregate Reporting meet "Internet Scale" test?

2022-12-15 Thread John Levine
It appears that Todd Herr said: >As for law enforcement, I don't see "Officer, that unknown guy over there >did something bad, and I can't show you direct evidence of it, you're just >gonna have to trust me when I say he did it X times" as a motivator, >especially if the bad guy is likely to be

Re: [dmarc-ietf] Does Aggregate Reporting meet "Internet Scale" test?

2022-12-15 Thread Todd Herr
On Wed, Dec 14, 2022 at 5:45 PM Douglas Foster < dougfoster.emailstanda...@gmail.com> wrote: > Quantities > -- > I can see that FAIL quantities could be useful for motivating law > enforcement. It has the advantage of installed code and relatively little > processing cost. > I don't

Re: [dmarc-ietf] Does Aggregate Reporting meet "Internet Scale" test?

2022-12-14 Thread Douglas Foster
Quantities -- I can see that FAIL quantities could be useful for motivating law enforcement. It has the advantage of installed code and relatively little processing cost. But to Murray's specific questions: Yes, reporting quantity 1 is an inconsistency with the specification. This

Re: [dmarc-ietf] Does Aggregate Reporting meet "Internet Scale" test?

2022-12-11 Thread Alessandro Vesely
The worst case is a little worse than doubling the traffic. Consider the case that global traffic consists of N messages. It may happen that they are all for different pairs. In that case we have N aggregate reports, for 2N global traffic. It can be a little worse than that if we

Re: [dmarc-ietf] Does Aggregate Reporting meet "Internet Scale" test?

2022-12-11 Thread Alessandro Vesely
So we want to skip sending success reports, without indication of quantity? That already exists and is called failure reporting. Best Ale On Sun 11/Dec/2022 21:21:20 +0100 Douglas Foster wrote: I would not want to use randomization or percentages to discard actionable data., 1)  When

Re: [dmarc-ietf] Does Aggregate Reporting meet "Internet Scale" test?

2022-12-11 Thread Murray S. Kucherawy
On Sun, Dec 11, 2022 at 12:21 PM Douglas Foster < dougfoster.emailstanda...@gmail.com> wrote: > 2) What to include in reports > I have one reporting source that always reports a message count of 1, > without regard to the number of messages that I sent and he received. > Perhaps I'm

Re: [dmarc-ietf] Does Aggregate Reporting meet "Internet Scale" test?

2022-12-11 Thread Mark Alley
    Success reports and message count can give empirical evidence of a domain's mail flow health in most situations as far as implementation and monitoring goes, but there are circumstances that can cause data correlation from from this information to be less useful.     Anecdotal example -

Re: [dmarc-ietf] Does Aggregate Reporting meet "Internet Scale" test?

2022-12-11 Thread Douglas Foster
I would not want to use randomization or percentages to discard actionable data., 1) When to send reports. An actionable result is one which says "this server sent a message without a verifiable and aligned DKIM signature".This applies because: - Any message can be subject to forwarding, so

Re: [dmarc-ietf] Does Aggregate Reporting meet "Internet Scale" test?

2022-12-08 Thread Barry Leiba
Mike, > You clearly don't know what you are talking about. That's not an appropriate thing to say, and the rest of your message stands fine without it. Please avoid these kinds of statements. Barry, as chair. ___ dmarc mailing list dmarc@ietf.org

Re: [dmarc-ietf] Does Aggregate Reporting meet "Internet Scale" test?

2022-12-08 Thread Dotzero
On Thu, Dec 8, 2022 at 1:59 AM Douglas Foster < dougfoster.emailstanda...@gmail.com> wrote: > > 1) DMARC was a successful 2-company experiment, which was turned into a > widely implemented informational RFP. We are now writing the > standards-track version of that concept. We hope that

Re: [dmarc-ietf] Does Aggregate Reporting meet "Internet Scale" test?

2022-12-08 Thread Mark Alley
Adding clarification since I forgot to specify - this would be per-sender per-source. Not a set percentage of all mail received from a source, that obviously would not work as intended. On 12/8/2022 6:52 AM, Mark Alley wrote: This may have been thought of before, so forgive the potentially

Re: [dmarc-ietf] Does Aggregate Reporting meet "Internet Scale" test?

2022-12-08 Thread Mark Alley
This may have been thought of before, so forgive the potentially duplicate idea, I was musing earlier about feedback reporting based on a percent of the overall mail per-source. I'm thinking of something similar in concept to the pct= tag for published policy. This would reduce the overhead

Re: [dmarc-ietf] Does Aggregate Reporting meet "Internet Scale" test?

2022-12-07 Thread Douglas Foster
1) DMARC was a successful 2-company experiment, which was turned into a widely implemented informational RFP. We are now writing the standards-track version of that concept. We hope that Standards Track will provide the basis for significantly increased adoption. This seems the appropriate

Re: [dmarc-ietf] Does Aggregate Reporting meet "Internet Scale" test?

2022-12-06 Thread Seth Blank
I'm super unclear what you're talking about. https://dmarc.org/2022/03/dmarc-policies-up-84-for-2021/ Aggregate reporting is used by the largest volume senders on earth, and the vast majority of mail received by mailbox providers comes with a dmarc record and reporting address attached. This is

[dmarc-ietf] Does Aggregate Reporting meet "Internet Scale" test?

2022-12-05 Thread Douglas Foster
I began wondering if Aggregate Reporting works only because DMARC has been embraced by a small portion of domain owners. 1) Is Aggregate Reporting a significant portion of all mail? In some cases, Yes. My organization's data: Inbound volume is 11 times greater than my outbound volume. Inbound