Re: [dmarc-ietf] Doing a tree walk rather than PSL lookup

[Jesse Thompson <[e-mail]>]

On 11/24/20 9:52 AM, todd.herr=[e-mail] wrote:
> On Tue, Nov 24, 2020 at 10:37 AM Dave Crocker <[e-mail] <mailto:[e-mail]>> wrote:
> 
>     Just to be clear, I'm not challenging the need.  Rather I'm just looking for text that explains the need.  And I'm not finding it...
> 
>     On 11/24/2020 7:28 AM, Todd Herr wrote:
>>     There are two reasons (at least) for needing the Organizational Domain, and they are discussed in RFC 7489:
>>
>>      1. DMARC also allows for the explicit or implicit expression of policy for sub-domains at the Organizational Domain level. This matters for those times when _dmarc.RFC5322.From.domain is non-existent and RFC5322.From.domain is a sub-domain of the Organizational Domain.
>>      2. The default mode for authenticated identifier alignment, relaxed, requires only that the Organizational Domains for both identifiers are the same, and so the Organizational Domain must be known in order for relaxed alignment to be ascertained.
>>
>     Except that I do not find either of these points provided in the document.
> 
> For point 1, this is from Section 6.6.3, Policy Discovery:
> 
>    1.  Mail Receivers MUST query the DNS for a DMARC TXT record at the
>        DNS domain matching the one found in the RFC5322 <https://tools.ietf.org/html/rfc5322>.From domain in
>        the message.  A possibly empty set of records is returned.
> 
>    2.  Records that do not start with a "v=" tag that identifies the
>        current version of DMARC are discarded.
> 
>    3.  If the set is now empty, the Mail Receiver MUST query the DNS for
>        a DMARC TXT record at the DNS domain matching the Organizational
>        Domain in place of the RFC5322 <https://tools.ietf.org/html/rfc5322>.From domain in the message (if
>        different).  This record can contain policy to be asserted for
>        subdomains of the Organizational Domain.  A possibly empty set of
>        records is returned.
> 
> 
> 
> For point 2, this is from Section 3.1.1, DKIM-Authenticated Identifiers:
> 
>    In relaxed mode, the Organizational Domains of both the [DKIM <https://tools.ietf.org/html/rfc7489#ref-DKIM>]-
>    authenticated signing domain (taken from the value of the "d=" tag in
>    the signature) and that of the RFC5322 <https://tools.ietf.org/html/rfc5322>.From domain must be equal if
>    the identifiers are to be considered aligned.  In strict mode, only
>    an exact match between both of the Fully Qualified Domain Names
>    (FQDNs) is considered to produce Identifier Alignment.

The end of Section 3.1 might need to be clarified:

"Relaxed mode can be used when the operator also wishes to affect message flows bearing subdomains of the verified domains."

* I assume that relaxed mode can be set in the DMARC policy of a subdomain even if the Organizational Domain doesn't have (or want) that in its policy

* The subdomains in this context are the subdomains of the Organizational Domain, rather than the subdomains of the domain that published the relaxed mode in its policy

So if acme.example publishes aspf=s adkim=s 
It does not prevent finance.acme.example from publishing aspf=r adkim=r
Which would align widgets.acme.example with finance.acme.example even if the intent was to only align delegated-esp.finance.acme.example with finance.foo.example

Suggested better wording:

"Relaxed mode is determined from the policy of the RFC5322.From domain or from the Organizational Domain policy if the RFC5322.From domain has no policy.  It can be used when the operator also wishes to affect message flows bearing subdomains of the Organizational Domain."

If "walking the tree" is viable, then perhaps it should be:

"Relaxed mode is determined from the policy of the RFC5322.From domain or from [something about walking the tree to determine the policy].  It can be used when the operator also wishes to affect message flows bearing subdomains of the domain that published the relaxed mode policy."

Jesse