Re: [dmarc-ietf] 5.5.4. Publish a DMARC Policy for the Author Domain - dmarcbis-06

[Scott Kitterman <[e-mail]>]

On Tuesday, April 5, 2022 3:57:30 AM EDT Alessandro Vesely wrote:
> On Mon 04/Apr/2022 19:31:36 +0200 John R Levine wrote:
> >>> If it's the original domain, yes.
> >> 
> >> We know that co.uk is not an Organizational Domain.  Asking what is the
> >> Organizational Domain of co.uk is an ill-posed question.
> > 
> > These are all in the PSL.  What are their organizational domains?
> 
> Scott took the time to define PSDs and PSOs in RFC 9091, restated in
> Sections 3.2.8 and 3.2.9 of the current draft.  Since the definitions of
> Organizational Domain (both the current 3.2.7 an my proposed change)
> require PSD + 1, a PSD has to be a proper subdomain of another PSD in order
> to admin an Organizational Domain itself.
> 
> > _dmarc.wa.gov.au TXT "v=DMARC1; p=none; fo=1:d;
> > rua=mailto:[e-mail],mailto:dmarc_records@wa.
> > gov.au;ruf=mailto:[e-mail],mailto:dmarc_recor
> > [e-mail]" wa.gov.au mail is handled by 10
> > inbound-smtp.us-west-2.amazonaws.com. wa.gov.au TXT "v=spf1
> > include:amazonses.com ~all"
> > 
> > _dmarc.gov.az TXT "v=DMARC1; p=reject; pct=100; fo=1; adkim=s; aspf=s;
> > rua=mailto:[e-mail]" gov.az mail is handled by 0 sea1.mail.gov.az.
> > gov.az mail is handled by 10 sea2.mail.gov.az.
> > gov.az TXT "v=spf1 redirect=_spfx.mail.gov.az"
> > 
> > _dmarc.gov.in TXT "v=DMARC1; p=quarantine; sp=none;
> > fo=1;rua=mailto:[e-mail];ruf=mailto:[e-mail]"
> > gov.in mail is handled by 5 mailgwgov.nic.in.
> > gov.in TXT "v=spf1 mx ip4:164.100.14.0/24 ip4:164.100.2.0/24
> > ip4:164.100.10.0/24 ip4:164.100.15.0/24 ip4:164.100.13.0/24 -all"
> > 
> > _dmarc.edu.kz TXT "v=DMARC1; p=none; rua=mailto:[e-mail]"
> > edu.kz mail is handled by 10 post.mail.kz.
> > edu.kz TXT "v=spf1 a mx ip4:88.204.157.164 ~all"
> > 
> > _dmarc.ac.me TXT "v=DMARC1; p=quarantine; adkim=r; aspf=r; fo=0; pct=100;
> > rua=mailto:[e-mail]" ac.me mail is handled by 10 mail.ac.me.
> > ac.me TXT "v=spf1 mx ip4:89.188.43.10 ip6:2a02:4280:0:200:89:188:43:10
> > -all"
> > 
> > _dmarc.nhs.uk TXT "v=DMARC1; p=reject; sp=none;adkim=s;aspf=s;fo=1;
> > rua=mailto:[e-mail],mailto:[e-mail]"
> > nhs.uk mail is handled by 50 mail.nhs.uk.
> > nhs.uk TXT "v=spf1 ip4:213.161.89.71 ip4:213.161.89.72 ip4:213.161.89.73
> > ip4:213.161.89.103 ip4:213.161.89.104 ip4:213.161.89.105 -all"
> > 
> > _dmarc.police.uk TXT
> > "v=DMARC1;p=none;sp=none;adkim=s;aspf=s;fo=1;rua=mailto:dmarc-rua@dmarc.s
> > ervice.gov.uk;ruf=mailto:[e-mail]" police.uk has no
> > MX record
> > police.uk TXT "v=spf1 -all"
> > 
> > _dmarc.k12.dc.us TXT "v=DMARC1; p=none;
> > rua=mailto:[e-mail];" k12.dc.us mail is handled by 10
> > dck12.mail.protection.outlook.com.
> All of the above admit no org domain.  I'd amend step 2 like so:
> 
> OLD
>     2.  If a valid DMARC record contains the psd= tag set to 'y' (psd=y),
>         the Organizational Domain is the domain one label below this one
>         in the DNS hierarchy, and the selection process is complete.
> 
> NEW
>     2.  If a valid DMARC record contains the psd= tag set to 'y' (psd=y),
>         the Organizational Domain is the previous domain of those selected,
>         if any.  In any case the selection process is complete.
> 
> 
> I note that only police.uk is registered at psddmarc.org.  It is also the
> only "pure" PSD, in the sense that they don't send mail themselves.
> 
> Scott, is that the reason why the others are not registered?
> 
> All them should amend their DMARC records adding psd=y.

The entities listed on the psddmarc.org registry requested to be there.  I 
think that once we've settled the questions around the psd tag the WG should 
ask for an early registration for the new tag.  I think that's the point where 
these entities should update their records.

Generally speaking, I think that a PSD can send mail and it should be covered 
by DMARC, so I disagree with the idea that a PSD can never also be an Org.

Scott K