[dmarc-ietf] Bridging the gap

[Douglas Foster <[e-mail]>]

I have done a lot of thinking about the current confrontation and how to
bridge it.

The problem seems rooted in our different attitudes toward the PSL.   If
one assumes that the Tree Walk must displace the PSL completely and
quickly, then it becomes necessary to “make do” with incomplete information
about organizational boundaries, even though this introduces unwanted risk
to evaluators.   I believe that the assumption is unnecessary, because the
Tree Walk and the PSL can coexist without harm.  We simply specify that the
Tree Walk algorithm MUST be used when organizational boundary information
is known to be complete and certain, as indicated by specific policy tags,
while the PSL MAY be used when boundary information is uncertain or
incomplete.

The “Must-use-Tree-Walk” indicator provides the domain owner with a remedy
to correct PSL errors, as well as a strategy for avoiding them.    The MUST
indicator also means that DMARCbis-compliant implementations MUST implement
the Tree Walk algorithm, ensuring that the new algorithm becomes deployed
with critical mass.

The “MUST-use-Tree-Walk” assertion is accomplished with a DMARC policy tag
on the organizational domain record, supplemented by DMARC policy tags to
indicate the boundaries of any contained sub-organizations.     Some
processing guidelines will need to be provided to ensure that the
Must-use-Tree-Walk indicator is always found when it is present.

 Doug