Subject: Re: [marf] I-D Action:draft-ietf-marf-dkim-reporting-00.txt review

From: Daniel Black <[email-masked]>
Date: Sun, 27 Jun 2010 17:44:10 +1000

late review:

First complements on a good draft that builds on the foundations of ARF to 
keep domain owners aware of failures related to DKIM/ADSP failures with 
respect to their administrative domain.

I see a small scope for enhancement of this draft to provide third party 
signatures with feedback if the message gets rejected at the end. After all, 
what's the point of sending something through knowing its going to be 
rejected?

More specifically, I see an application with mailing list managers (MLMs). MLM 
would attach a DKIM signature in such a way that hopefully recipients would be 
able to decisions to accept the third party signature added. In the same way 
that MLM use bounce messages to realise that some list subscribers have moved 
on or otherwise have disfunctional mailboxes, this dkim reporting mechanism 
could enable MLM to receive feedback that the efforts to deliver to a 
subscriber message aren't successful. This feedback loop should be used when 
the MLM signature is intact however the recipient decides to reject/discard 
the message due to ADSP or another DKIM signature failure.

Specific changes to facilitate this are:

Introduction

"domain owner" -> "domain owner or intermediary"

typo introduction - publicatons -> publications

3.
1st paragraph

"domain owner" -> "domain owner or intermediary"

in the r= paragraph:

"or (b)......" -> "(b)......, or (c) the message was rejected because of a 
DKIM signature or ADSP failure not associated with this signature."

key-ro-type  paragraph: append - / "i"

4 Optional Key Reporting Address for DKIM-ADSP
I'm assuming ri is an interval measured in number of messages rather than a 
time based (number of hours, days, weeks) interval?

5.1.  Requested Reports for DKIM Failures

append:

"i  Reports are requested if this message was rejected for a DKIM or ADSP 
failure reasons not related to this signature"

7.3 DKIM Failure Types

I'm assuming revoked is implicitly DNS key not found in DNS?

Should there be others like 'integrity:  The key referenced by the signature 
on the message could failed integrity checks during retrieval (e.g. DNSSEC 
failure).

What about other more traditional server failure DNS errors?

Is this workable/useful?

Daniel