[dmarc-discuss] RUA validation

[Jim Popovitch]

On Tue, Jan 31, 2012 at 4:26 PM, Michael Adkins <madkins at fb.com> wrote:
> Assuming that the spam attempts make it far enough through the SMTP
> transaction for a DMARC evaluation to take place, Bill would get a daily
> report from any ISPs who provide reporting and are willing to send it to a
> domain other than billsgiftgivaway.tld.  So yes, that would likely result
> in Bill receiving some number of reports containing the details of the
> botnet you had used as well as the domain you registered, which he would
> likely forward to his lawyers. ;)

If it was the ruf... he would have much much much more evidence (if he
could even recover the perverbial .mdb corruption from the influx)
;-)

> There's some opportunity for mischief
> there, but since we're only talking about a single report per day per
> receiving domain I don't think it would be any worse than the amount of
> damage you could just do with plain old backscatter.  Do you have
> suggestions for additional or replacement text for section 15.6?

I, personally, think there needs to be some initial back-n-forth (like
there is in FBL setups) to validate the report receiver is worthy of
any and all reports.

-Jim P.