[dmarc-discuss] policy overrides and 'what-if'

[Paul Midgen]

It's tricky. There are some well-known override cases such as forwarding and MLMs where you could infer what happened at the receiver, but when you see something like "local_policy" I think the best you can do is use the rate of occurrence as an error margin on what-if estimates derived by incorporating the total unambiguous results with the well-known override cases.

e.g. "set p=quarantine and 52% +/- 2.3% of your mail will be quarantined"
 
-----Original Message-----
From: dmarc-discuss-bounces at blackops.org [mailto:dmarc-discuss-bounces at blackops.org] On Behalf Of Ben Clifford
Sent: Tuesday, April 03, 2012 7:04 PM
To: dmarc-discuss at dmarc.org
Subject: [dmarc-discuss] policy overrides and 'what-if'

I'm interested in taking reports from p=none DMARC reports, and giving "what-if" results about those reports for when p=reject or p=quarantine.

Its not clear to me how I should interpret PolicyOverrideReasons when doing this.

I'll always see a disposition of 'none' because p=none, even when I see reports of DKIM and SPF mechanisms failing.

When there is no PolicyOverrideReason in a record, and I see all DKIM and SPF mechanisms failing in that record, I believe it is correct to infer that changing to p=reject would mean this record would change to a reject disposition, and so I can pop up a big red flag my report user interface. (is that a correct assumption?)

But, if I see a disposition of none, and a policyoverride, what can I assume?

Can I assume that the override means that the specified disposition would remain unchanged even if the DMARC policy changes to p=reject?

Or does the policyoverride mean "we applied a different policy. if you're a human maybe you can figure it out, but this report does not contain enough information for you to figure out the 'what-if' behaviour mechanically?"

Ben

-- 


_______________________________________________
dmarc-discuss mailing list
dmarc-discuss at dmarc.org
http://www.dmarc.org/mailman/listinfo/dmarc-discuss
NOTE: Participating in this list means you agree to the DMARC Note Well terms (http://www.dmarc.org/note_well.html)