Re: [dmarc-ietf] Nonexistent Domain Policy was: Re: Working Group Last Call: draft-ietf-dmarc-psd

Scott Kitterman <sklist@kitterman.com> Fri, 12 July 2019 20:34 UTC

Return-Path: <sklist@kitterman.com>
X-Original-To: dmarc@ietfa.amsl.com
Delivered-To: dmarc@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3345312030D for <dmarc@ietfa.amsl.com>; Fri, 12 Jul 2019 13:34:55 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2
X-Spam-Level:
X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=neutral reason="invalid (unsupported algorithm ed25519-sha256)" header.d=kitterman.com header.b=Hxh37CUh; dkim=pass (2048-bit key) header.d=kitterman.com header.b=An9tGk4N
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id UV_Azvq2lpGj for <dmarc@ietfa.amsl.com>; Fri, 12 Jul 2019 13:34:53 -0700 (PDT)
Received: from interserver.kitterman.com (interserver.kitterman.com [64.20.48.66]) (using TLSv1.2 with cipher ADH-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3F37F1202E0 for <dmarc@ietf.org>; Fri, 12 Jul 2019 13:34:53 -0700 (PDT)
Received: from interserver.kitterman.com (interserver.kitterman.com [64.20.48.66]) by interserver.kitterman.com (Postfix) with ESMTPS id E030AF8071F for <dmarc@ietf.org>; Fri, 12 Jul 2019 16:34:21 -0400 (EDT)
DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/simple; d=kitterman.com; i=@kitterman.com; q=dns/txt; s=201903e; t=1562963661; h=from : to : subject : date : message-id : in-reply-to : references : mime-version : content-transfer-encoding : content-type : from; bh=CDi5iy96yOEHfPTfL4fFUDEVhBc/27vt1f93uSI9Ff4=; b=Hxh37CUhIiGbgKIzRO/Qooj8GGmp4HJsLT7BWZkgBFEJvmc1nCOHyj/5 JnvNEuFLl0sWna1JxynSxKeWSqSSBw==
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kitterman.com; i=@kitterman.com; q=dns/txt; s=201903r; t=1562963661; h=from : to : subject : date : message-id : in-reply-to : references : mime-version : content-transfer-encoding : content-type : from; bh=CDi5iy96yOEHfPTfL4fFUDEVhBc/27vt1f93uSI9Ff4=; b=An9tGk4NN9k+ncnI0WInfsA8/6yfF2PNzz5zasjWhkibNVFqtjJ3cYUU 4p6s/pF6M0k/KkL/V5jXWYc8pppbM7aLFYPk/raIC2sCEGALSYeJISmIgG BriVU0BfbQRTKTBCm6en8HdKMbacXP+LSa0bZtLnuG00/V4WafFdse+L9d ZhYnscJmx3REqACU1wxqS4kzYN3I6o0Qc4/HZEQqDyTFtmZMUtDUvBKqSH jCpDpLozZ1DEeexjG3FEyhrL27/7ovaC2M6Mda/jtn3GtmTnbz9l65nQTX KHzUebUXbNJuAurDKn5+OsEMBhGoRKEfc+asyxziemGBH6rDYXxKYg==
Received: from l5580.localnet (static-72-81-252-22.bltmmd.fios.verizon.net [72.81.252.22]) by interserver.kitterman.com (Postfix) with ESMTPSA id 99389F80607 for <dmarc@ietf.org>; Fri, 12 Jul 2019 16:34:21 -0400 (EDT)
From: Scott Kitterman <sklist@kitterman.com>
To: dmarc@ietf.org
Date: Fri, 12 Jul 2019 16:34:20 -0400
Message-ID: <2902055.CzhLQO0xIX@l5580>
In-Reply-To: <20190712191348.B10D94A0F89@ary.local>
References: <20190712191348.B10D94A0F89@ary.local>
MIME-Version: 1.0
Content-Transfer-Encoding: 7Bit
Content-Type: text/plain; charset="us-ascii"
Archived-At: <https://mailarchive.ietf.org/arch/msg/dmarc/MITglVVKT_JJxHpmTU9JnSYCJa0>
Subject: Re: [dmarc-ietf] Nonexistent Domain Policy was: Re: Working Group Last Call: draft-ietf-dmarc-psd
X-BeenThere: dmarc@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: "Domain-based Message Authentication, Reporting, and Compliance \(DMARC\)" <dmarc.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/dmarc>, <mailto:dmarc-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/dmarc/>
List-Post: <mailto:dmarc@ietf.org>
List-Help: <mailto:dmarc-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/dmarc>, <mailto:dmarc-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 12 Jul 2019 20:34:55 -0000

On Friday, July 12, 2019 3:13:48 PM EDT John Levine wrote:
> In article <CAD2i3WNigYz8vk-
FwFCgy0y=HJep_m9ncwj7wpTqrTMUhq0qLA@mail.gmail.com>; you write:
> >-=-=-=-=-=-
> >
> >On Fri, Jul 12, 2019 at 10:55 AM Kurt Andersen (b) <kboth@drkurt.com>; 
wrote:
> >> I am much more concerned with adding another tag that can only be used in
> >> a PSD-DMARC record. I would be much more open to make a "normative"
> >> change
> >> to the DMARC tag list (RFC 7489 section 11.4) to define np for any DMARC
> >> record, than to make this a special case for PSD-DMARC records.
> >
> >I am also concerned with adding any new policy-related tags, due to the
> >confusion they create that limits adoption. However, a very clear case for
> >an NXDOMAIN policy has been made by UK NCSC for .gov.uk, and both .gov and
> >.mil have stated they also want this behavior. Others have shared similar
> >opinions privately.
> 
> How do they feel about NODATA, which is not the same as NXDOMAIN?

Although Seth said NXDOMAIN, he didn't really mean that DNS rcode.

Here's the definition we have in the draft now:

> 2.6.  Non-existent Domains
> 
>    For DMARC [RFC7489] purposes, a non-existent domain is a domain name
>    that publishes none of A, AAAA, or MX records that the receiver is
>    willing to accept.  This is a broader definition than that in
>    NXDOMAIN [RFC8020].

That's what I was expecting this new tag to apply to (and I think matches 
their expectation, but they can speak for themselves).

Another way to say what's in 2.6 now might be:

... a domain for which there is a NODATA response for A, AAAA, and MX records.

We could then drop the second sentence and swap the informative RFC 8020 
reference for a normative reference to RFC 2308.  The RFC 8020 updates to 2308 
don't seem germane to this issue.

I think that's equivalent to what's in 2.6 now, but states it more clearly in 
actionable DNS terminology.

Comments?

Scott K