[dmarc-ietf] Problem with multiple policies, different alignment

[Douglas Foster <[e-mail]>]

I have been building a DMARC implementation, starting with a simple
function:
TreeWalk(domain) which returns:

   - Policy found or not found indicator
   - Policy Domain
   - Organizational Domain
   - Policy record

My thought was that the Tree Walk result was independent of the domain
identifier being checked, but this is not true.

Assume these DMARC policies:

   - example.com aspf:r adkim:r
   - sub1.example.com aspf:s akim:s


When the message contains:

   - From: [e-mail]
   - DKIM: d=example.com

Strict alignment on the From domain makes the organizational domain
unimportant, so the PSL lookup or Tree Walk are not necessary.   The
organizational domain used for reporting purposes is sub1.example.com.
The DKIM signature is not aligned.

But when the message contains the reverse, the logic gets complicated:

   - From: [e-mail]
   - DKIM: d=sub1.example.com

If we apply the same Tree Walk to this message, we have a problem.   The
>From domain Tree Walk returns "example.com" as the organizational domain,
and the Tree Walk of the DKIM domain returns "sub1.example.com" as the
organizational domain because of strict alignment.   So the result appears
to be unaligned.

Consequently, the Tree Walk needs to be sensitive to the identifier being
checked.     If the identifier is not the From address, the Tree Walk is
only interested in the existence of a policy and the PSL tags, and the
special case related to strict alignment needs to be bypassed.

I don't think this case was covered in previous discussions.

Doug Foster