Re: [dmarc-ietf] Working group next steps

[Ian Levy <[e-mail]>]

The existing defences aren’t 100% even before the evil kludge we’ve put up for non existent subdomains, which certainly is not working everywhere. The PSD draft, when implemented, will help scale existing defences to make evolution of criminal behaviour harder and do it in a standardised way so that it’s more likely to be consistently implemented.  That’s worth us collectively doing some work and me taking some risk to help early testing.

Nothing is 100% in security. Except possibly the existence of a preponderance of marketing hype :-).

Ta.

I.

—
Dr Ian Levy
Technical Director
National Cyber Security Centre
[e-mail]

(I work stupid hours and weird times – that doesn’t mean you have to. If this arrives outside your normal working hours, don’t feel compelled to respond immediately!)
________________________________
From: dmarc <[e-mail]> on behalf of Douglas E. Foster <[e-mail]>
Sent: Sunday, March 31, 2019 7:31 pm
To: Scott Kitterman; IETF DMARC WG; Ian Levy
Subject: Re: [dmarc-ietf] Working group next steps

Certainly not.

You cannot drop existing defenses until the new standard is 100% deployed on the Internet, which means probably never.    Your experimental implementation will need to prioritize the new test over the SPF test, to prove that it is working and to show that it is good at intercepting any subdomains that have been newly imagined by the attackers

To speed up the deployment process for existing or new standards, IETF would meed to embrace the idea of defining required features of a spam filter.

Doug Fosterd

________________________________
From: "Ian Levy" <ian.levy=[e-mail]>
Sent: Sunday, March 31, 2019 6:18 AM
To: "Scott Kitterman" <[e-mail]>, "IETF DMARC WG" <[e-mail]>
Subject: Re: [dmarc-ietf] Working group next steps

>> I’ll also offer gov.uk as an experimental ground (within reason!).

> Excellent. I've listed it in the experimental registry at psddmarc.org..
> Since you already had a live DMARC record for that domain, people can experiment with this now.

I guess at some point we'll have to stop generating SPF and DMARC records for the non-existent subdomains of gov.uk so we can test the new stuff properly. When we're at that point, let me know.

Ta.

I.

--
Dr Ian Levy
Technical Director
National Cyber Security Centre
[e-mail]

Staff Officer : Kate Atkins, [e-mail]

(I work stupid hours and weird times – that doesn’t mean you have to. If this arrives outside your normal working hours, don’t feel compelled to respond immediately!)


This information is exempt under the Freedom of Information Act 2000 (FOIA) and may be exempt under other UK information legislation. Refer any FOIA queries to [e-mail]
_______________________________________________
dmarc mailing list
[e-mail]
https://www.ietf.org/mailman/listinfo/dmarc

This information is exempt under the Freedom of Information Act 2000 (FOIA) and may be exempt under other UK information legislation. Refer any FOIA queries to [e-mail]