Re: [dmarc-ietf] Rolling out the experiment

Ian Levy <ian.levy@ncsc.gov.uk> Mon, 01 April 2019 07:03 UTC

Return-Path: <ian.levy@ncsc.gov.uk>
X-Original-To: dmarc@ietfa.amsl.com
Delivered-To: dmarc@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 13D94120046 for <dmarc@ietfa.amsl.com>; Mon, 1 Apr 2019 00:03:41 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2
X-Spam-Level:
X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=ncsc.gov.uk
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ECAF8sHdf_xZ for <dmarc@ietfa.amsl.com>; Mon, 1 Apr 2019 00:03:37 -0700 (PDT)
Received: from GBR01-LO2-obe.outbound.protection.outlook.com (mail-eopbgr100093.outbound.protection.outlook.com [40.107.10.93]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 2A5C212003F for <dmarc@ietf.org>; Mon, 1 Apr 2019 00:03:36 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ncsc.gov.uk; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=VVAnl45hLuOMExW6WsyQx1yIPHVWkHhfRGFHzZhi6Sc=; b=o8TEhMBMjdGZ4XDuMHg/KZvSPGbrE65ZaFXk/svdaTOhXECjZl7wxj+TmXR1pnVEzHT3RcWOen0UtfHeeZjOqoCARbkKlplzI0+4T33MaUESeZrOxL+Vgq2tX/wShkOlWxi0KJgUp+BgD/orfXy7lpNqv3tSNgLll7zJzPK8tgc=
Received: from LO2P123MB2285.GBRP123.PROD.OUTLOOK.COM (20.176.157.151) by LO2P123MB2239.GBRP123.PROD.OUTLOOK.COM (20.176.155.78) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.1750.17; Mon, 1 Apr 2019 07:03:34 +0000
Received: from LO2P123MB2285.GBRP123.PROD.OUTLOOK.COM ([fe80::41ac:f60c:6d07:7769]) by LO2P123MB2285.GBRP123.PROD.OUTLOOK.COM ([fe80::41ac:f60c:6d07:7769%6]) with mapi id 15.20.1750.017; Mon, 1 Apr 2019 07:03:34 +0000
From: Ian Levy <ian.levy@ncsc.gov.uk>
To: "fosterd@bayviewphysicians.com" <fosterd@bayviewphysicians.com>, "dmarc@ietf.org" <dmarc@ietf.org>
Thread-Topic: [dmarc-ietf] Rolling out the experiment
Thread-Index: AQHU6AXGp1msw+YGWU2SSBu312qmTKYm35Kg
Date: Mon, 1 Apr 2019 07:03:34 +0000
Message-ID: <LO2P123MB228545562601B6B06D230B8CC9550@LO2P123MB2285.GBRP123.PROD.OUTLOOK.COM>
References: <e1098e14b0b54c79b9f6191eb4afa2fd@bayviewphysicians.com>
In-Reply-To: <e1098e14b0b54c79b9f6191eb4afa2fd@bayviewphysicians.com>
Accept-Language: en-GB, en-US
Content-Language: en-US
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
authentication-results: spf=none (sender IP is ) smtp.mailfrom=ian.levy@ncsc.gov.uk;
x-originating-ip: [51.141.34.27]
x-ms-publictraffictype: Email
x-ms-office365-filtering-correlation-id: f72631d3-4543-4c48-b80e-08d6b67027f0
x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(8989299)(5600139)(711020)(4605104)(4534185)(7168020)(4627221)(201703031133081)(201702281549075)(8990200)(2017052603328)(7153060)(7193020); SRVR:LO2P123MB2239;
x-ms-traffictypediagnostic: LO2P123MB2239:
x-microsoft-antispam-prvs: <LO2P123MB22394B930A261D0C209751B9C9550@LO2P123MB2239.GBRP123.PROD.OUTLOOK.COM>
x-forefront-prvs: 0994F5E0C5
x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(346002)(396003)(39840400004)(136003)(366004)(376002)(189003)(199004)(71190400001)(8676002)(14444005)(81156014)(71200400001)(446003)(66066001)(256004)(6116002)(9686003)(476003)(790700001)(6246003)(102836004)(3846002)(2906002)(76176011)(33656002)(44832011)(11346002)(6436002)(26005)(229853002)(478600001)(486006)(2501003)(7696005)(6306002)(236005)(25786009)(99286004)(55236004)(53546011)(6506007)(55016002)(53936002)(86362001)(74482002)(54896002)(105586002)(5660300002)(52536014)(68736007)(966005)(97736004)(110136005)(106356001)(75922002)(74316002)(7736002)(316002)(14454004)(8936002)(81166006)(66574012)(186003); DIR:OUT; SFP:1102; SCL:1; SRVR:LO2P123MB2239; H:LO2P123MB2285.GBRP123.PROD.OUTLOOK.COM; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; MX:1; A:1;
received-spf: None (protection.outlook.com: ncsc.gov.uk does not designate permitted sender hosts)
x-ms-exchange-senderadcheck: 1
x-microsoft-antispam-message-info: hUQeuz9Fl8EbE1KWyyaWkb1POg6GuT4kcMpVFJyw05olF5D6ZF6EZTe7uRNJJsPKx347Q89WjOomv/Gb5JOwYa1hR1WCi1DaUMoWO6pGCreI3TSNuU5C4WsiP4iAMxhzTLXKnBj4lYPfcPnJxuItAOw4YfxR7XYduzHY7tOM5asxn6xySZdrSQNDQsw4JbLqBntgMoU/BiEv9EUBu4C1ji/oI3nKLzNioMrrjU+psL/IhVkSikqQYl9lRG1x6KKAdS0uAx0cBu5Dn1F6XozyhukhHu4Z4+atSLyBStB/azQVNikdy7Wg0ZQK+E2PAszmO7g2kuTie0TK+0nYCjIT0q1nhqx1BCq/w8/4uDmjiiZ8/pIHbVPisOTgvKMcrDfqbP3fozVK4yvwfjQZry3iaHdoaA4YlODWrZvnUCB6SQg=
Content-Type: multipart/alternative; boundary="_000_LO2P123MB228545562601B6B06D230B8CC9550LO2P123MB2285GBRP_"
MIME-Version: 1.0
X-OriginatorOrg: ncsc.gov.uk
X-MS-Exchange-CrossTenant-Network-Message-Id: f72631d3-4543-4c48-b80e-08d6b67027f0
X-MS-Exchange-CrossTenant-originalarrivaltime: 01 Apr 2019 07:03:34.0862 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: 14aa5744-ece1-474e-a2d7-34f46dda64a1
X-MS-Exchange-CrossTenant-mailboxtype: HOSTED
X-MS-Exchange-Transport-CrossTenantHeadersStamped: LO2P123MB2239
Archived-At: <https://mailarchive.ietf.org/arch/msg/dmarc/3_jBk9KoF-Gk4TXcYrXonItUoM0>
Subject: Re: [dmarc-ietf] Rolling out the experiment
X-BeenThere: dmarc@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: "Domain-based Message Authentication, Reporting, and Compliance \(DMARC\)" <dmarc.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/dmarc>, <mailto:dmarc-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/dmarc/>
List-Post: <mailto:dmarc@ietf.org>
List-Help: <mailto:dmarc-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/dmarc>, <mailto:dmarc-request@ietf.org?subject=subscribe>
X-List-Received-Date: Mon, 01 Apr 2019 07:03:41 -0000

  *   SPF and ASDP polices can still be published for non-existent domains

Sure, but I can't predict what non-existent subdomains criminals are going to use next. Should I publish a set of TXT records for dougfoster.gov.uk uniquely? Given we've no way of predicting that, we're responding to any query for TXT records  for any undelegated gov.uk subdomain with an SPF and DMARC record. Regardless of how we intend to detect non-existent subdomains (for some value of non-existent), we'll need to stop responding with those default records on gov.uk to do something approaching real world testing of PSD-DMARC.

Ta.

I.

--
Dr Ian Levy
Technical Director
National Cyber Security Centre
ian@ncsc.gov.uk<mailto:ian@ncsc.gov.uk>

Staff Officer : Kate Atkins, kate.a@ncsc.gov.uk<mailto:kate.a@ncsc.gov.uk>

(I work stupid hours and weird times - that doesn't mean you have to. If this arrives outside your normal working hours, don't feel compelled to respond immediately!)

From: dmarc <dmarc-bounces@ietf.org> On Behalf Of Douglas E. Foster
Sent: 31 March 2019 22:07
To: dmarc@ietf.org
Subject: [dmarc-ietf] Rolling out the experiment

Based on my reading of your draft, the testing process for non-existent domains is as follows:

  1.  Any DMARC policies for non-existent domains must be removed, so that the recipient system can look upward to the PSD DMARC.
  2.  SPF and ASDP polices can still be published for non-existent domains, because a domain is non-existent only when it lacks A, AAAA, and MX records.  SPF and ADSP are TXT records, so they do not affect the evaluation.  What I do not understand is how a device determines that a particular domain has no A, AAAA, or MX records.
  3.  Assuming that #2 iis valid, the test can proceed with no loss of current protections.  SPF and ADSP policies can be used to block a fraudulent message from a non-existent domain.   The behavior varies by device capability.
     *   A non-DMARC device would stop after blocking the message because of SPF or ADSP policy violation.
     *   An organization-DMARC device would look for a DMARC policy and fail, so no feedback would be sent.  It would still block the message based on SPF and DMARC policy violations.
     *   A PSD-DMARC device could block the message by either of two methods:
        *   It detects the domain as non-existent, and looks immediately for a PSD-DMARC policy.
        *   It blocks the message based on SPF or DMARC, then looks for feedback instructions, following the tree upward until it finds a PSD DMARC policy with feedback instructions.
SPF is widely deployed, so dropping SPF policies will affect recipients not participating in the test.    That is why I am alarmed..

I do not understand why that should be necessary, but I suppose that the answer hangs on the mechanism for detecting non-existent domains in a manner compliant with section 2.6

Doug Foster




________________________________
From: "Ian Levy" <ian.levy@ncsc.gov.uk>
Sent: Sunday, March 31, 2019 3:07 PM
To: "fosterd@bayviewphysicians.com" <fosterd@bayviewphysicians.com>om>, "ScottKitterman" <sklist@kitterman.com>om>, "IETF DMARC WG" <dmarc@ietf.org>rg>, "Ian Levy" <ian.levy=40ncsc.gov.uk@dmarc.ietf.org>
Subject: Re: [dmarc-ietf] Working group next steps

The existing defences aren't 100% even before the evil kludge we've put up for non existent subdomains, which certainly is not working everywhere. The PSD draft, when implemented, will help scale existing defences to make evolution of criminal behaviour harder and do it in a standardised way so that it's more likely to be consistently implemented.  That's worth us collectively doing some work and me taking some risk to help early testing.

Nothing is 100% in security. Except possibly the existence of a preponderance of marketing hype :-).

Ta.

I.

-
Dr Ian Levy
Technical Director
National Cyber Security Centre
ian@ncsc.gov.uk

(I work stupid hours and weird times - that doesn't mean you have to. If this arrives outside your normal working hours, don't feel compelled to respond immediately!)
________________________________
From: dmarc <dmarc-bounces@ietf.org> on behalf of Douglas E. Foster <fosterd@bayviewphysicians.com>
Sent: Sunday, March 31, 2019 7:31 pm
To: Scott Kitterman; IETF DMARC WG; Ian Levy
Subject: Re: [dmarc-ietf] Working group next steps

Certainly not.

You cannot drop existing defenses until the new standard is 100% deployed on the Internet, which means probably never.    Your experimental implementation will need to prioritize the new test over the SPF test, to prove that it is working and to show that it is good at intercepting any subdomains that have been newly imagined by the attackers

To speed up the deployment process for existing or new standards, IETF would meed to embrace the idea of defining required features of a spam filter.

Doug Fosterd

________________________________
From: "Ian Levy" <ian.levy=40ncsc.gov.uk@dmarc.ietf.org>
Sent: Sunday, March 31, 2019 6:18 AM
To: "Scott Kitterman" <sklist@kitterman.com>om>, "IETF DMARC WG" <dmarc@ietf.org>
Subject: Re: [dmarc-ietf] Working group next steps

>> I'll also offer gov.uk as an experimental ground (within reason!).

> Excellent. I've listed it in the experimental registry at psddmarc.org...
> Since you already had a live DMARC record for that domain, people can experiment with this now.

I guess at some point we'll have to stop generating SPF and DMARC records for the non-existent subdomains of gov.uk so we can test the new stuff properly. When we're at that point, let me know.

Ta.

I.

--
Dr Ian Levy
Technical Director
National Cyber Security Centre
ian@ncsc.gov.uk

Staff Officer : Kate Atkins, kate.a@ncsc.gov.uk

(I work stupid hours and weird times - that doesn't mean you have to. If this arrives outside your normal working hours, don't feel compelled to respond immediately!)


This information is exempt under the Freedom of Information Act 2000 (FOIA) and may be exempt under other UK information legislation. Refer any FOIA queries to ncscinfoleg@ncsc.gov.uk
_______________________________________________
dmarc mailing list
dmarc@ietf.org
https://www.ietf.org/mailman/listinfo/dmarc

This information is exempt under the Freedom of Information Act 2000 (FOIA) and may be exempt under other UK information legislation. Refer any FOIA queries to ncscinfoleg@ncsc.gov.uk
This information is exempt under the Freedom of Information Act 2000 (FOIA) and may be exempt under other UK information legislation. Refer any FOIA queries to ncscinfoleg@ncsc.gov.uk