Re: [dmarc-ietf] Summary comments on draft-ietf-dmarc-psd

[John Levine <[e-mail]>]

In article <CAL0qLwZwz+R52ydEgn7Qpu8t4=[e-mail]> you write:
>> Consider: From [e-mail]...bogus.bogus.example.com
>>
>Yeah, I'm familiar with the nature of the attack.   But based on what
>amounts to the hallway track, it feels like the perspective of the DNS
>community these days is that the currently deployed DNS infrastructure
>could easily deal with such an attack, ...

The DNS crowd is finally admitting to themselves that Sturgeon's Law
applies to the DNS, too, and a little more crud will be lost in the
large amoung ot noise.  I gather than people are implementing RFC 8020
which makes this attack less effective.

>The issue PSD is attempting to address is mail sent as a nonexistent
>subdomain.  For example, irs.gov doesn't have a subdomain called
>auditors.irs.gov, so irrespective of any irs.gov DMARC policy, I could send
>email as [e-mail] without limitation. ...

I have less sympathy for that argument.  I do a hard reject of any
mail with a nonexistent bounce address which I don't think is unusual.

PSD as I understand it is to address the same issue the organizational
domain does, but a level up, in a group of organizations that have
some administrative connection.  The issue is people who publish A and
MX records without covering DMARC records.  They're not supposed to do
that but they do, and PSD is one way of figuring out who needs to fix what.

R's,
John
-- 
Regards,
John Levine, [e-mail], Primary Perpetrator of "The Internet for Dummies",
Please consider the environment before reading this e-mail. https://jl.ly