Re: [dmarc-ietf] Draft DMARC working group charter

[Dave Crocker <[e-mail]>]

On 7/2/2014 9:46 PM, Pete Resnick wrote:
> On 7/1/14 11:00 AM, Dave Crocker wrote:
>> I've looked over the small amount of mail posted about the draft charter
>> and do not see any changes mandated.
>>    
> 
> Nothing mandated, but here are some changes that I think clarify and/or
> simplify. You can find a diff here:

I think Pete's changes mostly improve the text in terms of clarity
and/or conciseness.


Commenting on only a few items:


>> The working group will seek to preserve interoperability with the
>> installed base of DMARC systems, and will provide careful justification
>> for any non-interoperability.
> 
> I think we can strike the word "careful". It doesn't add anything.

I put that word in intentionally.

The requirement being imposed here is a bit unusual, since it is
intended to make the wg fully document its reasons for creating changes
that break backward compatibility.  The word 'careful' is meant to
elicit thoughtful and thorough language for the justification.

In other words, it is meant to bias things against something like text
that just says "the wg reached consensus" and instead solicit "here are
the reasons...".


> "     2. Reviewing and improving the base DMARC specification"
> 
>> The base specification relies on the ability of an email receiver to
>> determine the organizational domain responsible for sending mail. An
>> organizational domain is the basic domain name obtained through a public
>> registry, such as example.com or example.co.uk. While the common
>> practice is to use a "public suffix" list to determine organizational
>> domain, it is widely recognized that this solution will not scale, and
>> that the current list often is inaccurate. The task of defining a
>> standard mechanism for identifying organizational domain is out of scope
>> for this working group. However the working group can consider extending
>> the base DMARC specification to accommodate such a standard, should it
>> be developed during the life of this working group.
>>    
> 
> I think we can strike the second sentence. Other than reducing this
> being marked as spam ;-), I don't think it adds anything. I have no
> better understanding of what an organizational domain is from those two
> examples. (So is my organizational domain "qti.qualcomm.com" or
> "qualcomm.com"? Is it more like example.com or example.co.uk, or is it
> something different?) I think the most we're going to be able to say is
> that an organizational domain is the domain that represents the top
> level of the organization, which doesn't help much.

A sentence defining organizational domain is essential.

The term does not have wide, common use.  Yet it refers to a core
construct for DMARC.  So the charter should both use the term and
provide a basic definition for it.

Here's my (latest) suggestion for the paragraph, with each sentence
separated:

   The base specification relies on the ability of an email receiver to
   determine the organizational domain responsible for sending mail.

   An organizational domain is the 'base' name that is allocated from a
   public registry, such as ".com" or ".co.uk".

   Existing mechanisms for discerning the organizational domain have
   long-standing problems and there is community interest in a better
   solution.

   The task of developing that solution is out of scope for this
   working group.

   However the working group will provide input to any development
   effort for a standardized organizational domain mechanism.




>>     References
>>     ----------
>>
>> DMARC - http://dmarc.org
>> SPF - RFC7208
>> DKIM - RFC6376
>> Internet Message Format - RFC5322
>> OAR / Original Authentication Results - draft-kucherawy-original-authres
>> Using DMARC -  draft-crocker-dmarc-bcp-03

And we need to add:

   Delegating DKIM Signing Authority - draft-kucherawy-dkim-delegate-01

   Third-Party Authorization Label - draft-otis-tpa-label-04


d/
-- 
Dave Crocker
Brandenburg InternetWorking
bbiw.net