Re: [dmarc-ietf] Nonexistent Domain Policy was: Re: Working Group Last Call: draft-ietf-dmarc-psd

Scott Kitterman <sklist@kitterman.com> Sat, 20 July 2019 03:13 UTC

Return-Path: <sklist@kitterman.com>
X-Original-To: dmarc@ietfa.amsl.com
Delivered-To: dmarc@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id DEB4A12004E for <dmarc@ietfa.amsl.com>; Fri, 19 Jul 2019 20:13:30 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.001
X-Spam-Level:
X-Spam-Status: No, score=-2.001 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=neutral reason="invalid (unsupported algorithm ed25519-sha256)" header.d=kitterman.com header.b=QLA0Tx3t; dkim=pass (2048-bit key) header.d=kitterman.com header.b=OMYYq3Fx
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id jsYJlHHDiwa9 for <dmarc@ietfa.amsl.com>; Fri, 19 Jul 2019 20:13:29 -0700 (PDT)
Received: from interserver.kitterman.com (interserver.kitterman.com [64.20.48.66]) (using TLSv1.2 with cipher ADH-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 05D42120044 for <dmarc@ietf.org>; Fri, 19 Jul 2019 20:13:28 -0700 (PDT)
Received: from interserver.kitterman.com (interserver.kitterman.com [IPv6:2604:a00:6:1039:225:90ff:feaa:b169]) by interserver.kitterman.com (Postfix) with ESMTPS id E9ED6F80499 for <dmarc@ietf.org>; Fri, 19 Jul 2019 23:13:26 -0400 (EDT)
DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/simple; d=kitterman.com; i=@kitterman.com; q=dns/txt; s=201903e; t=1563592406; h=from : to : subject : date : message-id : in-reply-to : references : mime-version : content-transfer-encoding : content-type : from; bh=EbKa8CbMw2ueL8bEFmD2TOp0nCkXq6nG8nzV0K7Jhho=; b=QLA0Tx3tehS0OYUUVZQwdxtcNbHcu+vPOxtQi6ys4aeMmm/1KIqWuP2T omLP4bYZlAh/iY2BwNEzkJTwoE4DDA==
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kitterman.com; i=@kitterman.com; q=dns/txt; s=201903r; t=1563592406; h=from : to : subject : date : message-id : in-reply-to : references : mime-version : content-transfer-encoding : content-type : from; bh=EbKa8CbMw2ueL8bEFmD2TOp0nCkXq6nG8nzV0K7Jhho=; b=OMYYq3FxC0XWi4sNfASNQqEQzHwW8/8gqGRTBRj7KuXxDHixoCkCcaQg Ikpv9r8UQkhDDQHm5q0BRG/cbBcPvUA/P/4IssxM2FzaVFjebBiV/agtDg xkK+XkcO0YUCh1M/VrU6ct+8VLA/VLRXitAryVmOM6yMSAUddAB2n8/Ek6 YBbQwq/6V96pMAtiwYZVYcacZopbiw5WId9Sr70tG/AKzfb5AqOeJItgMb YTazPkKo5muZmkONs8oUZELMQ8ToHrTwgukRAUPLyMyt/4o6hbF4jndqlx cuG/5HLDwnjUF+V0WKXjY5jHKcZiBoFUJiXfN1WCKoQn8tAeA1h1Kg==
Received: from l5580.localnet (wsip-68-224-171-140.sd.sd.cox.net [68.224.171.140]) by interserver.kitterman.com (Postfix) with ESMTPSA id 9407FF80042 for <dmarc@ietf.org>; Fri, 19 Jul 2019 23:13:26 -0400 (EDT)
From: Scott Kitterman <sklist@kitterman.com>
To: "dmarc@ietf.org" <dmarc@ietf.org>
Date: Fri, 19 Jul 2019 23:13:25 -0400
Message-ID: <2002899.ZhquKih7Hz@l5580>
In-Reply-To: <CABuGu1rPUXTeeFL0YLEdZ80DV3tL6QVirrmf05eSE12=mZaE3w@mail.gmail.com>
References: <CAL0qLwbbz_UhBLsURg=eXhRBC2g9OghiN==T9Uq9pFuLtd=b7w@mail.gmail.com> <3280991.vD5HP6B0ME@l5580> <CABuGu1rPUXTeeFL0YLEdZ80DV3tL6QVirrmf05eSE12=mZaE3w@mail.gmail.com>
MIME-Version: 1.0
Content-Transfer-Encoding: 7Bit
Content-Type: text/plain; charset="us-ascii"
Archived-At: <https://mailarchive.ietf.org/arch/msg/dmarc/ONDVFmR5jYrCaeIT13ai_hfvtMo>
Subject: Re: [dmarc-ietf] Nonexistent Domain Policy was: Re: Working Group Last Call: draft-ietf-dmarc-psd
X-BeenThere: dmarc@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: "Domain-based Message Authentication, Reporting, and Compliance \(DMARC\)" <dmarc.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/dmarc>, <mailto:dmarc-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/dmarc/>
List-Post: <mailto:dmarc@ietf.org>
List-Help: <mailto:dmarc-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/dmarc>, <mailto:dmarc-request@ietf.org?subject=subscribe>
X-List-Received-Date: Sat, 20 Jul 2019 03:13:31 -0000

On Friday, July 19, 2019 11:30:01 AM EDT Kurt Andersen (b) wrote:
...
> > > I'm also concerned
> > > that a wildcard null MX record at the org level would end up having all
> > > subdomains "exist", but the policy that should be applied would be the
> > 
> > more
> > 
> > > restrictive "np" policy, not the (possibly) more permissive "sp" policy.
> > 
> > I think this is one of those "you must be this tall to ride on this ride"
> > situations.  DNS comes equipped with multiple footguns and you have to
> > know a
> > bit about what you're doing to make sure you get the effects you're after.
> 
> Perhaps a reminder in the text related to "np" that wildcards may cause
> undesired results and leave it as an exercise for the implementor to learn
> from that warning.

It seems like either too much or not enough.  This at least slightly concerns 
me because I don't want to warn about the implication of one DNS feature 
without being comprehensive.  DMARC deployment in any non-trivial organization 
is an inter-disciplinary task, even more so PSD DMARC.  I don't think we want 
to take on being a deployment guide, so I'd leave it out.

Let's see what others think.

Scott K