[dbound] Re: Related origins in Webauthn

[John Levine <[e-mail]>]

It appears that Andrew Sullivan  <[e-mail]> said:
>On Thu, Apr 23, 2026 at 01:52:00PM -0500, Jeffrey Walton wrote:
>>well known url.  I think dbound attempted to partition the set of all
>>domains (and not just group related ones).  Corrections, please.
>
>I don't think DBOUND was able to agree on what it was doing.

Agreed.  I saw at least three things:

1.  Formalize whatever the PSL does.

B.  Formalize boundaries of "same owner" for web cookies and/or wildcard certificates and/or DMARC policy

III.  Some kind of grand statement about public and private subtrees and their boundaries.

> For reasons I don't fully understand, the mail case didn't get any traction anyway.

We went off and did something else. The new version of DMARC lets people publish
_dmarc records anywhere in the DNS tree. If you don't find one for the name
you're looking for, you walk up the tree until you find one or don't. We looked
at a lot of domains and found that you'll rarely walk more than two levels, the
results of the tree walk were almost always the same as with the PSL, and in the
few cases where they were different, the current behavior often looks like it's
a mistake.

Back in the day, the DNS crowd insisted a tree walk would bring the DNS to its
knees. (This was roughly the same era that they insisted that adding new RRTYPEs
was trivial and anyone who disagreed was stupid.) But somehow someone snuck in
the CAA record which uses a tree walk, the knees-bringing didn't happen, so we
could use a tree walk, too.

An even more important point was that the people who wrote web browsers made it
quite clear that they have no interest in adding another DNS lookup to find the
cookie boundaries, and bundling a static copy of the PSL into each browser
release works for them.

R's,
John