Re: [dmarc-ietf] Nonexistent Domain Policy was: Re: Working Group Last Call: draft-ietf-dmarc-psd

["Chudow, Eric B CIV NSA DSAW (USA)" <[e-mail]>]

I recently joined this working group from the United States Department of Defense (DoD), which runs the .mil TLD. We appreciate all the work that has been done so far on DMARC and are currently investing significant efforts to implement DMARC broadly across DoD domains.  We value and support this PSD DMARC draft and experiment and see how it will complement the existing DMARC effort for us and many others by being able to broadly apply DMARC at TLDs and PSDs when subdomains are missing their own DMARC records and for non-existent subdomains, which are significant gaps today.



I agree with the suggestion below that the default policy for non-existent sub-domains should be the domain's policy if the "np" tag is absent, rather than defaulting to the "sp" tag's policy.



A few minor suggestions:



In section 4, "requiremetns" should be "requirements".

In section 4.1, there is an extra "be", so "This leakage could be potentially be utilized ..." should be "This leakage could potentially be utilized ...".

In appendix B, "faciliate" should be "facilitate".



Sincerely,

-Eric

________________________________

Eric Chudow

DoD Cybersecurity Mitigations



________________________________
From: Alessandro Vesely <[e-mail]>
Sent: Tue, 16 July 2019 14:53 UTC
To: [e-mail]
Subject: Re: [dmarc-ietf] Nonexistent Domain Policy was: Re: Working Group Last Call: draft-ietf-dmarc-psd


> Sorry for not contributing more to this thread - please don't take it as any indication of lack of interest. For UK NCSC specifically, I think we'd prefer NXDOMAIN rather than NODATA, given it's more constrained and this is an experiment. My view would be that if we've published a name under gov.uk, even with no valid (in the eyes of the receiver) associated records, then *someone* is responsible for it and we can go find and educate them. They may even believe they have a valid reason for doing so that may outweigh any email authentication concerns. But there's a conversation to be had. If there's no published name, then there's no-one responsible, so it should default to the top-level policy.

I agree that np should default to p.  The original wording for sp is also simpler than''If absent, the policy specified by the "sp" (if present) and then the "p" tag, if not, MUST be applied for non-existent subdomains.''  (BTW, mind that "sp" instead of "np" in the new tag's definition.)