Re: [dmarc-ietf] PSD Related Privacy Considerations For Aggregate Reporting Draft

[Todd Herr <[e-mail]>]

On Wed, Feb 1, 2023 at 7:14 PM Douglas Foster <
[e-mail]> wrote:

>
> What does matter is that the NP policy should only apply when the
> organization domain is non-existent.   Existing domains have the right to
> send using a non-existent subdomain.
>

I disagree with both statements here.

A policy record containing an 'np' tag cannot exist in the DNS at
_dmarc.domain without the name 'domain' existing in the DNS, so I can't
even really parse your first statement. Can you clarify what you mean here,
please?

Beyond that, the np tag is currently defined (correctly, in my opinion)
thusly:

Indicates the message handling preference of the Domain Owner or PSO for
mail using non-existent subdomains of the domain queried. It applies only
to non-existent subdomains of the domain queried and not to either existing
subdomains or the domain itself.


As for the claim that existing domains have the right to send using a
non-existent subdomain, while such sending practices are outside the scope
of DMARC, those domains should have no expectation that such mail will be
accepted, on the grounds that the RFC5322.From domain being non-existent
means that the message cannot be replied to, and is therefore not worthy of
acceptance.

-- 

*Todd Herr * | Technical Director, Standards and Ecosystem
*e:* [e-mail]
*m:* 703.220.4153

This email and all data transmitted with it contains confidential and/or
proprietary information intended solely for the use of individual(s)
authorized to receive it. If you are not an intended and authorized
recipient you are hereby notified of any use, disclosure, copying or
distribution of the information included in this transmission is prohibited
and may be unlawful. Please immediately notify the sender by replying to
this email and then delete it from your system.