Subject: Re: [regext] RDAP preference on abuse reporting

From: Tom Harrison <[email-masked]>
Date: Mon, 7 Mar 2022 21:10:56 +1000

On Tue, Feb 22, 2022 at 08:29:53AM +0100, Mario Loffredo wrote:
> Il 21/02/2022 18:25, Alessandro Vesely ha scritto:
>> On Mon 21/Feb/2022 11:34:14 +0100 Mario Loffredo wrote:
>>> Il 21/02/2022 09:54, Alessandro Vesely ha scritto:
>>>> On Mon 21/Feb/2022 08:30:53 +0100 Mario Loffredo wrote:
>>>>> What I suggested, it can be valid as a general rule
>>>>> applicable to every RDAP response provided that the server
>>>>> returns a contact with the abuse role.
>>>> 
>>>> So the missing paragraph about "pref" could be filed as an
>>>> erratum to RFC7483?
>>>> 
>>> What should such a missing paragraph say beyond what is stated in
>>> section 5.3 of RFC6350 ?
>> 
>> Perhaps, the first paragraph of Appendix A.1 could have had an
>> additional sentence saying something like so:
>> 
>>     For automated usage, it is recommended that, if preference is
>>     specified, only the most preferred element be used.

The problem with "only" in the above is that the less-preferred email
address is still usable, and should be used whenever the
more-preferred email address doesn't work as expected.  Resource
holders (or their delegates) are expected to monitor both addresses
for abuse complaints: see 5.3.3 of
https://www.apnic.net/community/policy/resources.  Given the above, it
looks like the definition of "pref" from RFC 6350 covers what's
intended.

> For example, since the proposal of provisioning the abuse mailbox seems
> something accepted by every RIR according to what is described in
> https://www.ripe.net/participate/policies/proposals/2019-04, RIRs can agree
> on a common way to include it in the RDAP response (maybe they're just doing
> this, please members from RIRs have a voice if you think!)

For reference, there is an RDAP profile for the RIRs, available at
https://bitbucket.org/nroecg/nro-rdap-profile/raw/v1/nro-rdap-profile.txt
and registered with IANA (see
https://www.iana.org/assignments/rdap-extensions/rdap-extensions.xhtml).
It is not yet implemented by all RIRs.  Relevantly, it requires RIRs
to include abuse contact details for INR objects where possible, and
also notes that the "pref" parameter may appear in jCards.  It does
not include anything about marking/distinguishing email addresses that
are intended for automatic abuse reporting or similar, though.

-Tom