Re: [dmarc-ietf] I-D Action: draft-ietf-dmarc-dmarcbis-07.txt

[Douglas Foster <[e-mail]>]

Scott asked for my list, so it is attached.   I walked up the tree from the
private registries, then did a DNS lookup for a DMARC entry.
 Consequently, the list shows the domains with DMARC policies, at whatever
level, rather than the PSL entry itself.

Doug


On Tue, Apr 19, 2022 at 12:00 AM Scott Kitterman <[e-mail]>
wrote:

> On Monday, April 18, 2022 10:14:37 PM EDT Douglas Foster wrote:
> > Concern 1
> > Of the several thousand private registry domains listed in the PSL, 45
> have
> > DMARC policies at or above the registry point.   40 of these 45 specify
> > relaxed alignment for both DKIM and SPF.  Upon activation of the tree
> walk,
> > these policies will be treated as organizational domains to any private
> > registry clients that have not published their own psd=y policy.
>  Because
> > of relaxed alignment, these private registry clients will be able to
> > impersonate their siblings and parents and produce a DMARC result of
> PASS.
>
> Please provide your list of ones you think might be problematic.
>
> > Concern 2
> > Since the longest current PSL entry has 5 segments, the longest
> > organizational domain is 6 segments.   The "jump to 5" logic needs to be
> > changed to "jump to 6".
>
> What PSL entries that are 5 long are you worried about?  When we looked at
> this before, 5 seemed sufficient.  Changing the number, now, isn't a big
> deal.
>
> > Concern 3
> > The "psd=u" language is inconsistent.  Which is true?
> > "This token indicates that this policy is not an organizational domain,,
> > the organizational domain is above this point"
> > or
> > "This token indicates no usable information, proceed with the heuristic
> to
> > determine if this policy is the organizational domain"
>
> It should be the latter.  If we're inconsistent, please propose corrected
> text.
>
> Scott K
>
> > Doug Foster
> >
> > On Sun, Apr 17, 2022 at 4:54 PM Scott Kitterman <[e-mail]>
> >
> > wrote:
> > > I've finished going through this and also updated authheaders [1] to
> > > match.  It
> > > now has a script called dmarc-policy-find which you can used to
> determine
> > > the
> > > DMARC policy to be applied for a domain.  You can use RFC 7489, RFC
> 7489 +
> > > RFC
> > > 9091, and DMARCbis-07.
> > >
> > > It does currently cheat and assume psd=y is in the records for domains
> on
> > > the
> > > PSD DMARC registry list, since no one has actually published that yet.
> > >
> > > Scott K
> > >
> > > [1] https://github.com/ValiMail/authentication-headers (also on pypi)
> > >
> > > On Wednesday, April 6, 2022 12:27:04 PM EDT Scott Kitterman wrote:
> > > > I believe it does.
> > > >
> > > > Thanks,
> > > >
> > > > Scott K
> > > >
> > > > On April 6, 2022 2:53:59 PM UTC, Todd Herr
> > >
> > > <todd.herr=[e-mail]> wrote:
> > > > >I believe this rev has the proposed text that was submitted in
> various
> > > > >messages in the thread titled "*5.5.4. Publish a DMARC Policy for
> the
> > > > >Author Domain - dmarcbis-06"*
> > > > >
> > > > >On Wed, Apr 6, 2022 at 10:51 AM <[e-mail]> wrote:
> > > > >> A New Internet-Draft is available from the on-line Internet-Drafts
> > > > >> directories.
> > > > >> This draft is a work item of the Domain-based Message
> Authentication,
> > > > >> Reporting & Conformance WG of the IETF.
> > > > >>
> > > > >>         Title           : Domain-based Message Authentication,
> > >
> > > Reporting,
> > >
> > > > >> and Conformance (DMARC)
> > > > >>
> > > > >>         Authors         : Todd M. Herr
> > > > >>
> > > > >>                           John Levine
> > > > >>
> > > > >>         Filename        : draft-ietf-dmarc-dmarcbis-07.txt
> > > > >>         Pages           : 62
> > > > >>         Date            : 2022-04-06
> > > > >>
> > > > >> Abstract:
> > > > >>    This document describes the Domain-based Message
> Authentication,
> > > > >>    Reporting, and Conformance (DMARC) protocol.
> > > > >>
> > > > >>    DMARC permits the owner of an email author's domain name to
> enable
> > > > >>    verification of the domain's use, to indicate the Domain
> Owner's
> > > > >>    or
> > > > >>    Public Suffix Operator's message handling preference regarding
> > >
> > > failed
> > >
> > > > >>    verification, and to request reports about use of the domain
> name.
> > > > >>    Mail receiving organizations can use this information when
> > >
> > > evaluating
> > >
> > > > >>    handling choices for incoming mail.
> > > > >>
> > > > >>    This document obsoletes RFC 7489.
> > > > >>
> > > > >> The IETF datatracker status page for this draft is:
> > > > >> https://datatracker.ietf.org/doc/draft-ietf-dmarc-dmarcbis/
> > > > >>
> > > > >> There is also an HTML version available at:
> > > > >> https://www.ietf.org/archive/id/draft-ietf-dmarc-dmarcbis-07.html
> > > > >>
> > > > >> A diff from the previous version is available at:
> > > > >> https://www.ietf.org/rfcdiff?url2=draft-ietf-dmarc-dmarcbis-07
> > > > >>
> > > > >> Internet-Drafts are also available by rsync at rsync.ietf.org:
> > > > >> :internet-drafts
> > > > >>
> > > > >> _______________________________________________
> > > > >> dmarc mailing list
> > > > >> [e-mail]
> > > > >> https://www.ietf.org/mailman/listinfo/dmarc
> > > >
> > > > _______________________________________________
> > > > dmarc mailing list
> > > > [e-mail]
> > > > https://www.ietf.org/mailman/listinfo/dmarc
> > >
> > > _______________________________________________
> > > dmarc mailing list
> > > [e-mail]
> > > https://www.ietf.org/mailman/listinfo/dmarc
>
>
>
>
> _______________________________________________
> dmarc mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/dmarc
>