Re: [dmarc-ietf] Performance and reliability concerns

[Seth Blank <[e-mail]>]

This topic has been well discussed, consensus is clear and
properly represented in the document, and WGLC is behind us.

This thread is closed.

Seth, as Chair

On Wed, Apr 10, 2024 at 5:31 PM Douglas Foster <
[e-mail]> wrote:

> I am concerned that the Tree Walk will have poorer performance and poorer
> reliability than implementations based on RFC 7489
>
> The boundary between organizational domains and their registries is very
> stable, which is why it is highly suitable for a static reference like a
> locally-implemented PSL.   Database lookups are fast and reliable.
>
> The Tree Walk calls for the organizational domain to be recomputed on
> every message, for every identifier of interest.  This means that the
> volume of DNS queries will increase, although the percentage increase will
> be highly dependent upon the optimizations built into a Tree Walk
> implementation.   Overall, any Tree Walk implementation is expected to be a
> net increase in workload to both the evaluation server and the DNS
> environment.
>
> These extra DNS queries also hurt reliability.   A walk result is
> uncertain if any query along the path produces a timeout error.   When a
> path result becomes uncertain, the overall DMARC result may become
> uncertain.  This risk exists in PSL implementations, since the evaluator
> still needs to retrieve DMARC policy, SPF policy, and DKIM keys, but the
> Tree Walk is at greater risk because it performs so many more DNS queries,
> and these extra queries will be adding to any congestion that may be
> causing timeout results.
>
> The magnitude of this concern depends on the frequency of DNS Timeout
> problems.   Upon reviewing my DMARC aggregate reports and my own data, I
> was surprised that both sources indicate TempError results occur at a much
> higher rate than my expectations.
>
> One way to minimize this problem risk is to store error-free results in a
> cache structure outside of DNS.  The already-existing PSL database provides
> a starting point for this cache.   Once a cache is available, the Tree Walk
> process can be moved offline, and used as a tool for validating and
> updating the PSL, while continuing to use the fast and reliable PSL
> database for real-time queries.  This addresses both the performance
> problem and the consistency problem.
>
> For those who don’t implement something similar, I expect them to be
> frustrated when they discover that the extra overhead required by the Tree
> Walk is coupled with reduced consistency of computed DMARC results.
>
>
> Doug
> _______________________________________________
> dmarc mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/dmarc
>


-- 

Seth Blank | Chief Technology Officer
Email: [e-mail]


This email and all data transmitted with it contains confidential and/or
proprietary information intended solely for the use of individual(s)
authorized to receive it. If you are not an intended and authorized
recipient you are hereby notified of any use, disclosure, copying or
distribution of the information included in this transmission is prohibited
and may be unlawful. Please immediately notify the sender by replying to
this email and then delete it from your system.