Re: [dmarc-ietf] Nonexistent Domain Policy was: Re: Working Group Last Call: draft-ietf-dmarc-psd

["Kurt Andersen (b)" <[e-mail]>]

On Thu, Jul 18, 2019 at 10:42 PM Scott Kitterman <[e-mail]>
wrote:

> On Thursday, July 18, 2019 11:42:36 AM EDT Kurt Andersen (b) wrote:
> > On Wed, Jul 17, 2019 at 7:35 PM Scott Kitterman <[e-mail]>
> >
> > Most MTAs will also follow CNAMEs. Should they be included (along with
> > other things like DNAME records) within the scope of existence? I'm a
> > little concerned that we are making a special definition of
> "non-existence"
> > which differs from the standard DNS concepts of NODATA and NXDOMAIN
> without
> > having a correspondingly special name.
>
> OK.  I wish you'd jumped in earlier when we were discussing that exact
> topic.
>
> https://mailarchive.ietf.org/arch/msg/dmarc/44sVJzvPkXkdT7Np-0ANr9Wm2Zc
>
> If we want to take another run at this and put it in more standard DNS
> terminology, then maybe:
>
> .... a domain for which there is an NXDOMAIN or NODATA response for A,
> AAAA,
> and MX records.
>
> I think that cures John's concern with my last proposal and addresses
> yours as
> well (the response to a CNAME/DNAME is not NODATA/NXDOMAIN, so they are
> correctly followed).
>

Yes - I think that will fix my concerns (and John's too).


> > I'm also concerned
> > that a wildcard null MX record at the org level would end up having all
> > subdomains "exist", but the policy that should be applied would be the
> more
> > restrictive "np" policy, not the (possibly) more permissive "sp" policy.
>
> I think this is one of those "you must be this tall to ride on this ride"
> situations.  DNS comes equipped with multiple footguns and you have to
> know a
> bit about what you're doing to make sure you get the effects you're after.
>

Perhaps a reminder in the text related to "np" that wildcards may cause
undesired results and leave it as an exercise for the implementor to learn
from that warning.

--Kurt