[dmarc-ietf] Are Evaluators motivated to switch to Tree Walk?

[Douglas Foster <[e-mail]>]

Let's talk through the selling process for the Tree Walk algorithm.





Who are our Stakeholders?



There are three main stakeholder groups for DMARC:   Senders,
Intermediaries, and Evaluators.    Senders and Intermediaries just want to
ensure their messages get delivered.   Evaluators have the much more
difficult job of ensuring that wanted messages get delivered and unwanted
messages get blocked.





Who has to make an effort to implement Tree Walk?



If we are to switch from "RFC7489 with PSL" to "DMARCbis with Tree Walk",
with no change in DMARC policy, then only Evaluators are involved in the
switchover.   Senders won't even know if the changeover has happened unless
we add something to the reporting definition.





Are Evaluators Dissatisfied with the PSL?



I accept that a small subset of Senders have been inconvenienced by
problems with the PSL, and they would like to see a change.   But they do
not have responsibility for the change.



Do we have evidence that Evaluators have significant dissatisfaction with
the PSL?      We need to know whether we are asking Evaluators to change
for their own good, or change for the good of others.    Charity is nice,
but it is not a strong motivator for what we are requesting.



The odd nature of the PSL leaves me skeptical that widespread
dissatisfaction exists among Evaluators.  It is not a DNS lookup, and
therefore everybody has their own list.   If an Evaluator finds a PSL
error, it will be a quick administrative move to disable a problem entry or
add a missing entry.  Of course, a master list of these edits needs to be
maintained so that it can be reapplied on each refresh, but the process is
essentially a one-time effort.   Even if the PSL website goes away forever,
the Evaluator has his personalized copy available for use, which can be
maintained locally, forever.  For PSL overrides to become a burning issue
with Evaluators, given all their other problems, the problems would need to
come at a pretty high rate, not less than multiple times per month.   Is
that really happening?   Do we have any information on this question?





But aren't Evaluators also Senders?



An argument can be made that most participants play a role as both Sender
and Receiver, so it is silly to treat Sender motivation and Evaluator as
two different things.    But the argument cuts both ways.



We are currently reluctant to ask Senders to add content to their DMARC
policies, because there are so many of them.   But we seem unconcerned
about asking Evaluators to redesign their filtering strategy, even though
there are equally many of them.    And most Senders will not be unhappy
with the PSL, just those who have been burned by mistakes.





Does Tree Walk free Evaluators from use of the PSL?



This question moves into the larger space of how DMARC should fit into an
overall filtering strategy.  A competent Evaluator has good reason to
continue using the PSL even if the Tree Walk is adopted.



Consider a message fitting these assumptions:

- The From domain address which contains several segments.

- The SMTP and Server identity analyses not been definitive, so that the
source filtering decision depends on the From name itself.  - The Tree Walk
finds no DMARC policies.

- A lookup on the domain name itself returns NXDOMAIN.


We have learned that legitimate messages will sometimes use non-existent
subdomains of their parent organization, so NXDOMAIN by itself is not
determinative.   The Evaluator will want to know if this is a PSD domain,
an organizational domain, or an organizational subdomain.  The he will want
to know if the organization exists.



What tests are available?


-  The TLD can be checked against the IANA list to see if it exists, but
this test becomes redundant if the next test is used


-  The PSD can be determined by checking the PSL, to see if the PSD exists
in the list.   If the From domain matches a PSD, the Evaluator will want to
consider whether he believes the PSD itself is being impersonated.


-  The PSD+1 can be queried to see if it produces NXDOMAIN


- The DMARC algorithm can be used to determine if the message produces PASS
with Strict Alignment, PASS with relaxed alignment, or FAIL because of no
alignment.   Imputing relaxed alignment for this situation will depend on a
PSL lookup.



Based on these tests, an Evaluator has good reason to continue maintaining
and using his copy of the PSL on a permanent basis.   Switching to the Tree
Walk does not reduce his administrative effort.


In sum, why should an Evaluator make the switch?


Doug