Subject: [dmarc-ietf] Forensic Reports

From: Stephen Nightingale <[email-masked]>
Date: Thu, 17 Sep 2015 10:48:03 -0400

I have been looking at Forensic Report generation and I note that the
specification points to a number of different sources:

- rfc7489 DMARC points to rfc6591 AFRF, plus DMARC additions in section
7.3.1
- 6591 specifies additions to the Abuse Reporting Format, rfc5965.
- rfc5965 ARF lightly references rfc3462, the Multipart/Report content type.

I am teasing this out to generate actual reports.  Re-ordering the
evolving spec elements gives:

- rfc3462 Multipart/Report
- modified by rfc5965 Abuse Reporting Format
- modified by rfc6591 Authentication Failure Reporting Format using ARF
- with the addition of rfc6651 AFRF-DKIM
- and rfc6652 AFRF-SPF
- modified by rfc7489 DMARC, section 7.3.1.

Is there an updated and clarified public spec somewhere, along similar
lines? Would it be useful to create such a spec, and possibly include it
as an appendix to any future update to rfc7489?  I am willing to pull
this together if this would be a useful contribution.

Stephen Nightingale, NIST

---

From: Franck Martin <[email-masked]>
Date: Thu, 17 Sep 2015 18:30:43 -0500 (CDT)

----- Original Message -----
> From: "Stephen Nightingale" <[email-masked]>
> To: [email-masked]
> Sent: Thursday, September 17, 2015 7:48:03 AM
> Subject: [dmarc-ietf] Forensic Reports
> 
> 

We like to call them now "Failure Reports" because "forensic" gets the Snowden alarm on....

You may want to look at this code:
https://github.com/linkedin/dmarc-msys/blob/master/dmarc.lua#L440

---

From: Stephen Nightingale <[email-masked]>
Date: Fri, 18 Sep 2015 11:08:52 -0400

> https://github.com/linkedin/dmarc-msys/blob/master/dmarc.lua#L440

Thanks, that's an interesting datapoint.  Is there an example of an
actual failure report produced?  -- Other than the rather generic and
ancient one in rfc6591 Appendix B?  There is no example anywhere in rfc7489.

I could reverse engineer from an actual report instance better than from
lua code, into (a) a free-standing written spec and/or (b) a Python
implementation.

Cheers,

Stephen Nightingale, NIST.

---

From: "Murray S. Kucherawy" <[email-masked]>
Date: Fri, 18 Sep 2015 20:37:13 -0700

> this together if this would be a useful contribution.
There's nothing more current than what you've found.  If the kind of thing
you're asking for would be useful to the community, it could be done as a
section or appendix of the IETF version of the DMARC proposed standard
(when we get around to doing that).

-MSK