[dmarc-ietf] Performance and reliability concerns

[Douglas Foster <[e-mail]>]

I am concerned that the Tree Walk will have poorer performance and poorer
reliability than implementations based on RFC 7489

The boundary between organizational domains and their registries is very
stable, which is why it is highly suitable for a static reference like a
locally-implemented PSL.   Database lookups are fast and reliable.

The Tree Walk calls for the organizational domain to be recomputed on every
message, for every identifier of interest.  This means that the volume of
DNS queries will increase, although the percentage increase will be highly
dependent upon the optimizations built into a Tree Walk implementation.
 Overall, any Tree Walk implementation is expected to be a net increase in
workload to both the evaluation server and the DNS environment.

These extra DNS queries also hurt reliability.   A walk result is uncertain
if any query along the path produces a timeout error.   When a path result
becomes uncertain, the overall DMARC result may become uncertain.  This
risk exists in PSL implementations, since the evaluator still needs to
retrieve DMARC policy, SPF policy, and DKIM keys, but the Tree Walk is at
greater risk because it performs so many more DNS queries, and these extra
queries will be adding to any congestion that may be causing timeout
results.

The magnitude of this concern depends on the frequency of DNS Timeout
problems.   Upon reviewing my DMARC aggregate reports and my own data, I
was surprised that both sources indicate TempError results occur at a much
higher rate than my expectations.

One way to minimize this problem risk is to store error-free results in a
cache structure outside of DNS.  The already-existing PSL database provides
a starting point for this cache.   Once a cache is available, the Tree Walk
process can be moved offline, and used as a tool for validating and
updating the PSL, while continuing to use the fast and reliable PSL
database for real-time queries.  This addresses both the performance
problem and the consistency problem.

For those who don’t implement something similar, I expect them to be
frustrated when they discover that the extra overhead required by the Tree
Walk is coupled with reduced consistency of computed DMARC results.


Doug