I began wondering if Aggregate Reporting works only because DMARC has been embraced by a small portion of domain owners.
1) Is Aggregate Reporting a significant portion of all mail? In some cases, Yes. My organization's data: Inbound volume is 11 times greater than my outbound volume. Inbound mail has 1 new domain for every 5 messages Net result: If I were to do reporting, and reporting became requested for most or all domains, my outbound mail volume would triple, because my outbound report volume would be twice as large as my outbound business mail volume. 2) Is Aggregate Reporting efficient? Restating previous concerns: "All Signature" reporting means: We keep evaluating even after successful authentication has been established, so that we can capture and store data of little actual value, even though it causes reduced aggregation and longer reports. "No Problems found, No changes found" reporting means: We send redundant reports day after day. "All Requesters" reporting means: We send reports even to domain owners that were blocked because of domain reputation. A good place to start would be to extend the reporting interval for no-problem-found reports. Doug Foster
_______________________________________________ dmarc mailing list [email protected] https://www.ietf.org/mailman/listinfo/dmarc
