Re: [dmarc-ietf] Nonexistent Domain Policy was: Re: Working Group Last Call: draft-ietf-dmarc-psd

Tim Wicinski <tjw.ietf@gmail.com> Wed, 17 July 2019 12:29 UTC

Return-Path: <tjw.ietf@gmail.com>
X-Original-To: dmarc@ietfa.amsl.com
Delivered-To: dmarc@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 998CA1200C3 for <dmarc@ietfa.amsl.com>; Wed, 17 Jul 2019 05:29:31 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.997
X-Spam-Level:
X-Spam-Status: No, score=-1.997 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id AozRw1bY23Ec for <dmarc@ietfa.amsl.com>; Wed, 17 Jul 2019 05:29:29 -0700 (PDT)
Received: from mail-oi1-x22f.google.com (mail-oi1-x22f.google.com [IPv6:2607:f8b0:4864:20::22f]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 09AD912008F for <dmarc@ietf.org>; Wed, 17 Jul 2019 05:29:29 -0700 (PDT)
Received: by mail-oi1-x22f.google.com with SMTP id w196so18318098oie.7 for <dmarc@ietf.org>; Wed, 17 Jul 2019 05:29:29 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=7CYpLR0bXOvnFQXVmZoaCkOjDfqRjiOrHJLAynjWMmw=; b=aLqbVR0AK9JDQ0jjoJZiqZbL9hLfBHgsPyiY8ZocQnX/FekeQd/6Q9WtwiNuE0h35a cr1d0AbVGaTH+Og/c+v43MHyM+IWwPWX+mKNxTh3jiIXaYTwNY+gpyZmtppA5dy0Mc/q LjzNXgFxsNo4LXf3t+wREc9CA0b40lF8Sn8Nu6qXPkjy3VFDlmQQW1kEzoOmnpOnyHF9 tFSBF1PonIyFYrXhL944tRWBmWqHf2ssxbW+emP7CkeOrlmxpKjYxdF4gPaUXsUHHFIt SDX24LiZZO1TAvgHZB02hEhq8tOklOGk5zP/BVbmJ+hx2PP93dai57U0vFMzhBhma8oB rI3w==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=7CYpLR0bXOvnFQXVmZoaCkOjDfqRjiOrHJLAynjWMmw=; b=RHvNDs6humzJZ7uCWS1b/PWc0QPhKjZ2O20VwY0MrZYshGtmSwpO9gJPhFz79Jl1vA 0tUwUq1oUcUlSvdwR1LRz1aHYw9cI5Czg2dGfD6ka2Is8xizStrd4mgis1y1ZmztVN/j eqfUG3k2AdmlnuxV8cSGRzUZUzIBVtE4pzxbb+mLmusCO5J+f17ngoN9pp/Oq9RNtk79 +cMuK39XPnxk3IBYaL1FjRl3vvXtFFmJNFLYnfbcP3vDuK1Cj4p5/7snySz5GKSeePcl 2ubWbbj6G/ymd5QwmZiph7N1FCA7VPE4WDCXAPf4HkuE+uGjLjyz6BGyW6QZRbiumb2+ ZiVg==
X-Gm-Message-State: APjAAAVtQ5huU5tZEAtPiCsHBuzDRTGoXIinaRTf3qbXo7H5/qFtfa+3 PdI89Tj6IAFtSfXzuQ0J4c0arUlROiAdfhERDhI3TkgF
X-Google-Smtp-Source: APXvYqxPRIL8RBQqkiJtkx7TTvumKLgGt6nWyOGek5bYaF8iEjRFlW0gYXHLy7L2e9jEfeQIgmi+VDNTYSnpxSkwnC0=
X-Received: by 2002:aca:b406:: with SMTP id d6mr19325794oif.173.1563366568423; Wed, 17 Jul 2019 05:29:28 -0700 (PDT)
MIME-Version: 1.0
References: <CAL0qLwbbz_UhBLsURg=eXhRBC2g9OghiN==T9Uq9pFuLtd=b7w@mail.gmail.com> <1808303.aIhlromXIS@l5580> <CAD2i3WN42v0RHzu+2=+_mjX5kmxw6B-0F3-=bY-bTEsJM1qLvA@mail.gmail.com> <1692123.ljdY5SVR4M@l5580> <CAD2i3WPGWe8Z3av1Jua6sazsoStc7VTOLBve7psVo=K4VGTgig@mail.gmail.com> <D42C419C-F02E-4B5A-BB10-E8D49000349B@kitterman.com>
In-Reply-To: <D42C419C-F02E-4B5A-BB10-E8D49000349B@kitterman.com>
From: Tim Wicinski <tjw.ietf@gmail.com>
Date: Wed, 17 Jul 2019 08:29:17 -0400
Message-ID: <CADyWQ+Eo-Q8FhApWaVXk5MQrEMabn0bK0i-1w-qFiJFYjGYQ0g@mail.gmail.com>
To: Scott Kitterman <sklist@kitterman.com>
Cc: IETF DMARC WG <dmarc@ietf.org>
Content-Type: multipart/alternative; boundary="000000000000f6f585058ddfa4bd"
Archived-At: <https://mailarchive.ietf.org/arch/msg/dmarc/1nsV2sFxxnowN0Nw7wL7kzKYvYY>
Subject: Re: [dmarc-ietf] Nonexistent Domain Policy was: Re: Working Group Last Call: draft-ietf-dmarc-psd
X-BeenThere: dmarc@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: "Domain-based Message Authentication, Reporting, and Compliance \(DMARC\)" <dmarc.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/dmarc>, <mailto:dmarc-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/dmarc/>
List-Post: <mailto:dmarc@ietf.org>
List-Help: <mailto:dmarc-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/dmarc>, <mailto:dmarc-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 17 Jul 2019 12:29:32 -0000

Thanks for the update Scott, and your wording on the 'np' tag in the
Appendix works.

I just want to call out your statement:

I think changing existing defined behavior for non-participants in an
experiment is not appropriate.  It's even more unacceptable in a case like
this where we absolutely don't need it to achieve the desired behavior
within the experiment.

I agree very strongly on this, and this is the right way to view this.
While we all are confident that the 'np' tag will be a wild success,
there is the case this is not true, and we need to not upset current
working behavior.

Tim

(probably chair'ing a little here)

On Wed, Jul 17, 2019 at 2:27 AM Scott Kitterman <sklist@kitterman.com>;
wrote:

>
>
> On July 17, 2019 5:54:41 AM UTC, Seth Blank <seth@sethblank.com>; wrote:
> >On Tue, Jul 16, 2019 at 10:40 PM Scott Kitterman <sklist@kitterman.com>;
> >wrote:
> >
> >> Yes, the point of 'np' is to allow for a stricter sub-domain policy,
> >but
> >> that's to support early deployment of strict PSD level policies
> >without
> >> breaking org domains that are still deploying/have not deployed
> >DMARC.
> >>
> >
> >I absolutely agree with this.
> >
> >
> >> Case:
> >>
> >> PSO mandates all orgs deploy DMARC, but that's not done yet.  PSO
> >wants to
> >> deploy PSD DMARC for reject at the PSD level and for non-existent
> >domains,
> >> but
> >> leave non-DMARC deployed existing domains at none.  PSO publishes
> >these
> >> policieis for the PSD:
> >>
> >> p=reject, sp=none, np=reject
> >>
> >
> >Ah, I see what you're saying here. I honestly couldn't understand why
> >you
> >were talking about sp=none at all within a PSD context. I thought the
> >solution to this scenario was to do as the PSO p=none; np=reject. I
> >actually like p=reject; sp=none; better here, because that lets the PSD
> >lock itself down as a sending domain. But to me, this also makes it
> >clear
> >that np= should use the p= not the sp= as its default.
>
> See if you still feel that way after considering backward compatibility ...
>
> >That said, I feel less strongly about this now, and can see merit in
> >inheritance from either side (or from a hard default of none, for that
> >matter, although I'd strongly argue against that personally...).
> >
> >
> >> Having 'np' fall back to 'p' doesn't actually solve the problem you
> >claim
> >> to
> >> be solving since it only affects non-implementers.
> >>
> >
> >This I don't understand. The results you outlined are exactly what I
> >think
> >should happen.
>
> I think we agree on the goal, the difference is only about implementation
> details and impact on non-particpants in the experiment.
> >
> >> I believe that's the exact requested case and the changeset I've
> >provided
> >> supports that without creating a situation where every implementer of
> >the
> >> experiment suddenly starts processing existing DMARC records
> >differently
> >> (which
> >> I think would be very bad).
> >>
> >
> >I don't think I properly understand what you're saying. Can you clarify
> >this point?
>
> Keep in mind that senders do send from what we call non-existent domains
> for reasons that seem good and sufficient to them.  Let's take that as a
> fact, whether it makes sense to us or not.
>
> Sender (who knows nothing of our experiment) has published a DMARC record
> that includes:
>
> p=reject, sp=none
>
> When a DMARC compliant receiver receives mail from a subdomain of that
> organization domain, the policy to apply is none.
>
> If our experiment has 'np' fall back to 'sp', then the non-particpant gets
> the same result.  An experiment participating receiver would use 'sp'
> directly (none) for an existing sub-domain and also use 'sp' (none - 'np'
> fallback) for a non-existing sub-domain.
>
> If our experiment has 'np' fall back to 'p', then the non-particpant gets
> a different result.  An experiment participating receiver would use 'sp'
> directly (none) for an existing sub-domain and also use 'p' (reject - 'p'
> fallback) for a non-existing sub-domain.
>
> Keep in mind, this isn't just about receiver processing.  The policy
> applied is also in the aggregate reports.
>
> I think changing existing defined behavior for non-participants in an
> experiment is not appropriate.  It's even more unacceptable in a case like
> this where we absolutely don't need it to achieve the desired behavior
> within the experiment.
>
> Scott K
>
> _______________________________________________
> dmarc mailing list
> dmarc@ietf.org
> https://www.ietf.org/mailman/listinfo/dmarc
>