Re: [dmarc-ietf] WGLC review of draft-ietf-dmarc-dmarcbis-30

[Alessandro Vesely <[e-mail]>]

On Sun 31/Mar/2024 18:43:53 +0200 Scott Kitterman wrote:
> On March 31, 2024 3:20:41 PM UTC, Jim Fenton <[e-mail]> wrote:
>>On 30 Mar 2024, at 17:22, John R. Levine wrote:
>>
>>
>>>> Mine wasn’t a good example. There are a few public suffixes that have more than 5 labels. Presumably that means there are registered domains that are 6 levels down, and my reading of the tree walk is that a policy published there would never be seen. But who knows if they’re actually sending email.
>>>
>>> There aren't any in the PSL.  That's where the limit of 5 came from. We've had people say there are deeper ones; if there are it wouldn't be hard to bump up the limit from 5 to whatever.
>>
>>Might be worth bumping up. Examples:
>>
>>execute-api.cn-north-1.amazonaws.com.cn
>>cn-northwest-1.eb.amazonaws.com.cn
>>
>>(Amazon seems to have most of the really long ones)
> 
> My recollection is that we concluded these types of PSL entries weren't relevant for DMARC.  In any case, since Amazon controls everything below .com.cn in these examples, if they were so inclined, they can put a psd=y record wherever they need to.
> 
> This is not a good example for raising the threshold.  If anything, it's an example of why getting away from the PSL is a good idea.


Yes, there are entries with 6 labels on the PSL.

$ sed -rn '/^[^/]/s/[^.]//gp' < public_suffix_list.dat| sort| uniq -c| sort -rn
    5100 .
    2459 ..
    1449
     449 ...
     208 ....
       7 .....
       1 ......

$ grep -E '^[^/.]([.][^.]+){6}' < public_suffix_list.dat
*.001.test.code-builder-stg.platform.salesforce.com

I'd leave "5" in the spec, but somewhere suggest that implementations make this parametric, as label trends might change in the future.


Best
Ale
--