Re: [dmarc-ietf] Comment on draft-ietf-dmarc-psd

[Ian Levy <[e-mail]>]

> Perhaps because I don't get so much mail from gov.uk

Ale,
We can fix that for you if you want :-). 

Seriously, if you want to try some volume testing, let me know off-list and we'll try to sort something out. 

Ta.

I.

--
Dr Ian Levy
Technical Director
National Cyber Security Centre
[e-mail]

Staff Officer : Kate Atkins, [e-mail]
Pronouns : he/him

(I work stupid hours and weird times – that doesn’t mean you have to. If this arrives outside your normal working hours, don’t feel compelled to respond immediately!)

-----Original Message-----
From: dmarc <[e-mail]> On Behalf Of Alessandro Vesely
Sent: 04 December 2019 10:40
To: IETF DMARC WG <[e-mail]>
Subject: Re: [dmarc-ietf] Comment on draft-ietf-dmarc-psd

On Wed 04/Dec/2019 08:42:09 +0100 Murray S. Kucherawy wrote:
> On Mon, Nov 11, 2019 at 2:21 PM Dave Crocker <[e-mail] 
> <mailto:[e-mail]>> wrote:
>
>>> * add text to the PSD draft making it clear that what it's describing is
>>>   an experiment whose outcome will be taken only as feedback to the
>>>   revision of the standard (i.e., this is not intended to be the final form
>>>   of anything), and it is not intended to be deployed outside of the
>>>   experiment's participants;
>>
>>  Forgive me, but while everyone involved in this has extensive 
>> experience  and is trying to solve a real and serious issue, this is 
>> an astonishingly  naive view.
>
> I don't think it's based entirely on naivety.  I think there's a 
> healthy dose of feeling that the experiment as it's currently designed 
> couldn't possibly scale to "the entire domain namespace" and/or "all 
> servers on the Internet", so in that sense from where I sit there's a 
> built in safeguard against this becoming a permanent wart.


After installing the DKIM/DMARC filter that implements PSD, I can say that the impact is unnoticeable.  I didn't carry out precise measurements, I just didn't notice any delay.  Perhaps because I don't get so much mail from gov.uk, but I don't think I could reliably measure a positive delay even if I were a strict correspondent of Boris.


> Rather, it's primed as a possibly useful data collection exercise.

Kurt also talked about reporting some findings.  I'm embarrassed, I have no idea what I, as a receiver, should report.  What data should I, and other receivers collect?

IMHO, the experiment should be conceived as having it run by as many receivers as possible, so as to have a noticeable effect on senders.  They can collect aggregate reports and make a comparison.


Best
Ale
--


















_______________________________________________
dmarc mailing list
[e-mail]
https://eur03.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.ietf.org%2Fmailman%2Flistinfo%2Fdmarc&amp;data=02%7C01%7Cian.levy%40ncsc.gov.uk%7C969a778d73d4449d0d5708d778a64df4%7C14aa5744ece1474ea2d734f46dda64a1%7C0%7C0%7C637110527988698509&amp;sdata=IUFTCWhr1rc6I7vWMTk26NpayRjxXsnV4qqAU%2BmoOPg%3D&amp;reserved=0
This information is exempt under the Freedom of Information Act 2000 (FOIA) and may be exempt under other UK information legislation. Refer any FOIA queries to [e-mail]. All material is UK Crown Copyright ©