Skip to main content

9. Privacy Considerations

This section discusses security and privacy considerations specific to the generation and transmission of DMARC reports.

9.1. Data Exposure Considerations​

Aggregate reports are limited in scope to DMARC policy and disposition results, to information pertaining to the underlying authentication mechanisms, and to the identifiers involved in DMARC validation.

Failed-message reporting provides message-specific details pertaining to authentication failures. Individual reports can contain message content as well as trace header fields. Domain Owners are able to analyze individual reports and attempt to determine root causes of authentication mechanism failures, gain insight into misconfigurations or other problems with email and network infrastructure, or inspect messages for insight into abusive practices.

Both report types may expose sensitive information, including:

  • Email addresses of senders and recipients.

  • IP addresses of mail servers, which could be used to infer network topology.

  • Authentication infrastructure details, such as DKIM selector names and SPF mechanisms.

  • Email content (in failure reports, if included).

9.1.1. Aggregate Report Data​

Aggregate reports contain only high-level statistical data and do not include message content. However, they do include:

  • Source IP addresses from which mail claiming to be from the Domain Owner's domain was sent.

  • Volume of mail from each source.

  • Authentication results (pass/fail) for SPF and DKIM.

  • Identifier alignment results.

This information could potentially be used to map the Domain Owner's email infrastructure or identify third-party services used to send email on behalf of the domain.

9.1.2. Failure Report Data​

Failure reports can contain significantly more sensitive information, including:

  • Complete message headers, which may contain internal routing information.

  • Message body (if included), which may contain confidential or personal information.

  • Authentication details, which could reveal infrastructure details.

9.2. Report Recipients​

A DMARC record can specify that reports should be sent to an address outside the domain being reported on. This creates additional privacy considerations:

  1. Third-party reporting: Domain Owners should carefully consider whether to direct reports to third-party services.

  2. Data sharing: Sending reports to external addresses means sharing information about the domain's email infrastructure and traffic patterns with a third party.

  3. Verification requirement: The verification mechanism described in Section 7.1 helps ensure that external report destinations are legitimately authorized by the Domain Owner.

Domain Owners should:

  • Carefully vet any third-party services to which they direct DMARC reports.

  • Understand what data is being shared and how it will be used.

  • Use encryption (e.g., TLS) when possible for report delivery to protect data in transit.

  • Consider privacy policies of report recipients and ensure they align with the Domain Owner's privacy requirements.

9.3. Data Minimization​

To minimize privacy risks:

  • Mail Receivers should consider what level of detail is necessary in failure reports and avoid including more data than needed.

  • Failure reports should redact or omit message body content unless specifically needed for debugging.

  • Domain Owners should limit the distribution of reports to only those parties that need access to the data.

  • Report processors should implement appropriate security controls to protect report data.

9.4. Compliance with Privacy Regulations​

Both Domain Owners and Mail Receivers should ensure that their handling of DMARC reports complies with applicable privacy regulations, such as:

  • GDPR (General Data Protection Regulation) in the European Union.

  • CCPA (California Consumer Privacy Act) in California.

  • Other regional or national privacy laws.

This includes:

  • Ensuring there is a legitimate basis for processing the data in reports.

  • Providing appropriate notice to individuals whose data may be included in reports.

  • Implementing appropriate security measures to protect report data.

  • Honoring data subject rights (e.g., access, deletion) where applicable.

Last updated on