Re: [dmarc-ietf] 5.5.4. Publish a DMARC Policy for the Author Domain - dmarcbis-06

[Alessandro Vesely <[e-mail]>]

On Mon 04/Apr/2022 19:31:36 +0200 John R Levine wrote:
>>> If it's the original domain, yes.
>>
>> We know that co.uk is not an Organizational Domain.  Asking what is the 
>> Organizational Domain of co.uk is an ill-posed question.
> 
> These are all in the PSL.  What are their organizational domains?


Scott took the time to define PSDs and PSOs in RFC 9091, restated in Sections 
3.2.8 and 3.2.9 of the current draft.  Since the definitions of Organizational 
Domain (both the current 3.2.7 an my proposed change) require PSD + 1, a PSD 
has to be a proper subdomain of another PSD in order to admin an Organizational 
Domain itself.


> _dmarc.wa.gov.au TXT "v=DMARC1; p=none; fo=1:d; rua=mailto:[e-mail],mailto:[e-mail];ruf=mailto:[e-mail],mailto:[e-mail]"
> wa.gov.au mail is handled by 10 inbound-smtp.us-west-2.amazonaws.com.
> wa.gov.au TXT "v=spf1 include:amazonses.com ~all"
> 
> _dmarc.gov.az TXT "v=DMARC1; p=reject; pct=100; fo=1; adkim=s; aspf=s; rua=mailto:[e-mail]"
> gov.az mail is handled by 0 sea1.mail.gov.az.
> gov.az mail is handled by 10 sea2.mail.gov.az.
> gov.az TXT "v=spf1 redirect=_spfx.mail.gov.az"
> 
> _dmarc.gov.in TXT "v=DMARC1; p=quarantine; sp=none; fo=1;rua=mailto:[e-mail];ruf=mailto:[e-mail]"
> gov.in mail is handled by 5 mailgwgov.nic.in.
> gov.in TXT "v=spf1 mx ip4:164.100.14.0/24 ip4:164.100.2.0/24 ip4:164.100.10.0/24 ip4:164.100.15.0/24 ip4:164.100.13.0/24 -all"
> 
> _dmarc.edu.kz TXT "v=DMARC1; p=none; rua=mailto:[e-mail]"
> edu.kz mail is handled by 10 post.mail.kz.
> edu.kz TXT "v=spf1 a mx ip4:88.204.157.164 ~all"
> 
> _dmarc.ac.me TXT "v=DMARC1; p=quarantine; adkim=r; aspf=r; fo=0; pct=100; rua=mailto:[e-mail]"
> ac.me mail is handled by 10 mail.ac.me.
> ac.me TXT "v=spf1 mx ip4:89.188.43.10 ip6:2a02:4280:0:200:89:188:43:10 -all"
> 
> _dmarc.nhs.uk TXT "v=DMARC1; p=reject; sp=none;adkim=s;aspf=s;fo=1; rua=mailto:[e-mail],mailto:[e-mail]"
> nhs.uk mail is handled by 50 mail.nhs.uk.
> nhs.uk TXT "v=spf1 ip4:213.161.89.71 ip4:213.161.89.72 ip4:213.161.89.73 ip4:213.161.89.103 ip4:213.161.89.104 ip4:213.161.89.105 -all"
> 
> _dmarc.police.uk TXT "v=DMARC1;p=none;sp=none;adkim=s;aspf=s;fo=1;rua=mailto:[e-mail];ruf=mailto:[e-mail]"
> police.uk has no MX record
> police.uk TXT "v=spf1 -all"
> 
> _dmarc.k12.dc.us TXT "v=DMARC1; p=none; rua=mailto:[e-mail];"
> k12.dc.us mail is handled by 10 dck12.mail.protection.outlook.com.


All of the above admit no org domain.  I'd amend step 2 like so:

OLD
    2.  If a valid DMARC record contains the psd= tag set to 'y' (psd=y),
        the Organizational Domain is the domain one label below this one
        in the DNS hierarchy, and the selection process is complete.

NEW
    2.  If a valid DMARC record contains the psd= tag set to 'y' (psd=y),
        the Organizational Domain is the previous domain of those selected,
        if any.  In any case the selection process is complete.


I note that only police.uk is registered at psddmarc.org.  It is also the only 
"pure" PSD, in the sense that they don't send mail themselves.

Scott, is that the reason why the others are not registered?

All them should amend their DMARC records adding psd=y.


Best
Ale
--