Re: [dmarc-ietf] Comment on draft-ietf-dmarc-psd

[Scott Kitterman <[e-mail]>]

On Tuesday, February 4, 2020 4:26:30 PM EST Murray S. Kucherawy wrote:
> On Tue, Feb 4, 2020 at 1:20 PM Scott Kitterman <[e-mail]> wrote:
> > I agree on DMARCbis.  I don't think advancing this draft has a significant
> > effect on that.  Worst case, if DMARCbis is done before we can reach any
> > conclusions about PSD DMARC, then we publish DMARCbis without PSD DMARC in
> > it.
> 
> I think we've always been assuming that PSD DMARC would be input to
> DMARCbis, so we were planning to start the latter but not close it until
> the former was completed.  This is the first time I've seen a different
> suggestion.

I think DMARCbis will take long enough that that is how things will work out, 
but if there's working group consensus to eventually proceed without it 
because it's not ready, that may well be a reasonable course of action.  
Proceeding with DMARC PSD doesn't tie the working group's hands.  I agree 
that's been the plan, but if the situation changes (and DMARCbis is ready, but 
PSD DMARC isn't ready to be included) then we can change it.

It does occur to me that a more relaxed approach to the question of if PSD 
DMARC will be included in the working group DMARCbis deliverable would be much 
easier to sustain if there was a stable reference for it (i.e. we publish the 
draft).

> I'd love to hear more opinions about ordering of the work here.  This seems
> like an ideal time to review and update our milestones.

I think it's not predictable when DMARCbis will be mostly complete and it's 
also hard to predict how long it will take to resolve the open questions in 
the experiment.  They can run in parallel for some period of time and we can 
make a decision when there's one to make.  There's none needed now.

> > I don't see anything about PSD DMARC being inherently on the critical path
> > for
> > DMARCbis.  I suspect the current major obstacle to DMARCbis is that the
> > question of how to take the PSL out of the equation is unsolved, despite
> > one
> > IETF WG that was supposed to be dedicated to the question.
> > 
> > I don't think not publishing PSD DMARC helps move DMARCbis forward, so I
> > think
> > it's a false choice.
> 
> I think what Dave proposed about PSL separation from DMARC is entirely
> appropriate and pragmatic, and in fact probably easy enough: DMARC is
> changed so that it says the organizational domain is determined using some
> process [currently] external to DMARC, and then a second document explains
> how that process is accomplished using the PSL (and/or PSD, depending on
> when the experiment result comes in).  That's a fairly simple edit overall,
> and is actually probably minor and non-controversial compared to some of
> the other surgery that I believe is in the queue.

That's exactly the approach PSD DMARC takes about organizational domain, so 
I'm even more confused how that's problematic for PSD DMARC but doing the 
exact same thing solves the problem for DMARC?

I also don't see how that actually helps.  It seems to be something along the 
lines of claiming DMARC no longer relies on the PSL, but telling people to pay 
no attention to the man behind the curtain [1].

Scott K

> Seth, our illustrious WG secretary, has been compiling that list, and
> perhaps can give us some idea where it stands?
> 
> -MSK

[1] https://www.shmoop.com/quotes/pay-no-attention-man-behind-the-curtain.html