On Thu, Dec 24, 2020 at 1:55 PM John R Levine <[email protected]> wrote:
> > Security considerations > > Failure reports provide detailed information about the failure of a > single message or a group of similar messages failing for the same > reason. They are meant to aid domain owners to detect why failures > reported in aggregate form occured. It is important to note these > reports can contain either the header or the entire content of a > failed message, which in turn may contain personally identifiable > information, which should be considered when deciding whether to > generate such reports. > > Sorry; late to the party due to the holiday... Is it not also important to note that the recipient of the failure report (the domain owner) may not be the originator of the failed message, and that fact should also weigh into the consideration of deciding whether to generate such reports? If A publishes a DMARC policy record, and a bad actor sends intentionally fraudulent mail using A's domain as the RFC5322.From to addresses that are not among A's current customer base, and therefore unknown to A, sending failure reports to A that don't redact these email addresses reveals PII to A that A has no business receiving. -- *Todd Herr* | Sr. Technical Program Manager *e:* [email protected] *p:* 703.220.4153 This email and all data transmitted with it contains confidential and/or proprietary information intended solely for the use of individual(s) authorized to receive it. If you are not an intended and authorized recipient you are hereby notified of any use, disclosure, copying or distribution of the information included in this transmission is prohibited and may be unlawful. Please immediately notify the sender by replying to this email and then delete it from your system.
_______________________________________________ dmarc mailing list [email protected] https://www.ietf.org/mailman/listinfo/dmarc
