Re: [dmarc-ietf] Nonexistent Domain Policy was: Re: Working Group Last Call: draft-ietf-dmarc-psd

[Scott Kitterman <[e-mail]>]

On Friday, July 12, 2019 3:13:48 PM EDT John Levine wrote:
> In article <CAD2i3WNigYz8vk-
FwFCgy0y=[e-mail]> you write:
> >-=-=-=-=-=-
> >
> >On Fri, Jul 12, 2019 at 10:55 AM Kurt Andersen (b) <[e-mail]> 
wrote:
> >> I am much more concerned with adding another tag that can only be used in
> >> a PSD-DMARC record. I would be much more open to make a "normative"
> >> change
> >> to the DMARC tag list (RFC 7489 section 11.4) to define np for any DMARC
> >> record, than to make this a special case for PSD-DMARC records.
> >
> >I am also concerned with adding any new policy-related tags, due to the
> >confusion they create that limits adoption. However, a very clear case for
> >an NXDOMAIN policy has been made by UK NCSC for .gov.uk, and both .gov and
> >.mil have stated they also want this behavior. Others have shared similar
> >opinions privately.
> 
> How do they feel about NODATA, which is not the same as NXDOMAIN?

Although Seth said NXDOMAIN, he didn't really mean that DNS rcode.

Here's the definition we have in the draft now:

> 2.6.  Non-existent Domains
> 
>    For DMARC [RFC7489] purposes, a non-existent domain is a domain name
>    that publishes none of A, AAAA, or MX records that the receiver is
>    willing to accept.  This is a broader definition than that in
>    NXDOMAIN [RFC8020].

That's what I was expecting this new tag to apply to (and I think matches 
their expectation, but they can speak for themselves).

Another way to say what's in 2.6 now might be:

... a domain for which there is a NODATA response for A, AAAA, and MX records.

We could then drop the second sentence and swap the informative RFC 8020 
reference for a normative reference to RFC 2308.  The RFC 8020 updates to 2308 
don't seem germane to this issue.

I think that's equivalent to what's in 2.6 now, but states it more clearly in 
actionable DNS terminology.

Comments?

Scott K