Re: [dmarc-ietf] Comment on draft-ietf-dmarc-psd

["Chudow, Eric B CIV NSA DSAW (USA)" <[e-mail]>]

On Tuesday, February 04, 2020 3:44 PM Scott Kitterman wrote:
> As designed, the experiment is self-contained: For senders, it only affects
> PSDs that have been listed as participants. For receivers, it only affects
> receivers that choose to deploy code to do the additional check related to 
> PSD DMARC. As far as I can determine, there is zero impact on anyone else.

On Wednesday, February 05, 2020 5:59 AM Craig Schwartz wrote:
> Second, I have consulted with my technical advisors and our conclusion is
> that the risks to deployed infrastructure if this experiment becomes 
> permanent are negligible.

As both Craig and Scott pointed out, this experiment will only impact senders 
and receivers who opt-in to participating and has minimal risks to deployed 
infrastructure, so there shouldn’t be an issue there. For scalability, it may 
or may not scale as is, but the experiment has limited risk and should provide 
data on scalability or other issues, and so would be a good experiment to 
provide input into making DMARC better. 

On Wednesday, February 05, 2020 5:59 AM Craig Schwartz wrote:
> Finally, if the DMARC working group is successful in updating DMARC not to 
> use the PSL, then PSD DMARC would naturally evolve to use that solution (PSD
> is currently defined relative to org domain, so if the method for finding org
> domain changes, PSD DMARC will use it without any change needed).  As a 
> result, to the extent the use of lists like the PSL is a problem, PSD DMARC 
> is already ready to take advantage of whatever solution the IETF develops.

For the question related to the PSL and determining the Organizational Domain, 
I think Scott, Kurt, and Craig established this is not an issue for this 
experiment since that issue lies with DMARC itself and so it does not need to 
be addressed in PSD DMARC or for this experiment to proceed. 

On Tuesday, February 4, 2020 3:49 PM Andrew Kennedy wrote:
> One has to wonder if delaying or impeding advancement of this I-D, because
> of an external dependency that appears unlikely to be resolved in a timely
> fashion, is making the perfect the enemy of the good.  

On Monday, February 3, 2020 2:52 PM Ian Levy wrote:
> Experiments will give us data that helps us make better solutions in the 
> future. If those solutions look like the current draft then great. If they
> don’t then we’ll be changing them based on data and experience. 

Lastly, I agree with Ian, Andrew, and others that making everything perfect 
now is the enemy of the good and we should move ahead with the experiment to 
get better data to make better solutions. I think that PSD DMARC will be 
valuable and should proceed.

Thanks,
-Eric

________________________
Eric Chudow
DoD Cybersecurity Mitigations