Re: [dmarc-ietf] Comment on draft-ietf-dmarc-psd

[Brandon Long <[e-mail]>]

On Wed, Dec 11, 2019 at 7:45 AM Kurt Andersen (b) <[e-mail]> wrote:

> On Tue, Dec 10, 2019 at 2:13 PM Brandon Long <[e-mail]> wrote:
>
>>
>> On Mon, Dec 9, 2019 at 6:27 PM Kurt Andersen (b) <[e-mail]>
>> wrote:
>>
>>> On Mon, Dec 9, 2019 at 4:54 PM Scott Kitterman <[e-mail]>
>>> wrote:
>>>
>>>> On Monday, December 9, 2019 7:41:27 PM EST Brandon Long wrote:
>>>>
>>>> > I'm sure I probably missed this, but couldn't we avoid this question
>>>> by just mandating no reporting for non-existing organizational domains?  Is
>>>> that a non-starter?
>>>>
>>>> It's one of the use cases we are trying to cover.  I don't know if that
>>>> makes it a non-starter.
>>>>
>>>
>>> Unless I'm misunderstanding Brandon's suggestion, it seems like you
>>> (Brandon) are asking if doing no reporting on missing org domains solves
>>> the scalability problem. *Getting* reports for missing org domains is the
>>> main purpose of the PSD proposal so it would render the purpose moot.
>>>
>>
>> Hmm, I guess I don't see it that way.
>>
>> Preventing phishing attacks from nonexistent.gov.uk, insomuch as DMARC
>> can be used for such, seems way more important than the reporting.
>> Obviously, getting to p=reject without reporting is more challenging.  You
>> can certainly have policy without reporting.
>>
>
> While it is very true that receivers may implement validation and possibly
> enforcement without reporting, we could solve the use case of phishing from
> missing org-level domains by the same approach that we can solve it from
> any missing domain - just don't accept mail from such bogus sources. That
> does not help the overseers of a domain realm (org-1, aka LPSD) to tackle
> takedowns or public awareness campaigns against such abuse though.
>

I mean, that was also true for all DMARC, the point was the owner was
asking everyone to do that.  If you're saying we should have a different
system for trying to get everyone to not accept messages from non-existent
domains... ok, but I'm not sure where that would come from.

Maybe no one would be willing to go with np=reject without being able to
confirm there's no good mail doing that.  That seems more likely to be true
for existing large scale branded domains (which I guess gov.uk falls into),
whereas setting that policy for the newer branded domains (.google) and
multi-organizational (.bank) seems fine without reporting.

Brandon