Re: [dmarc-ietf] PSD Related Privacy Considerations For Aggregate Reporting Draft

[Emil Gustafsson <[e-mail]>]

Yes, I know that unrestricted TLDs would not publish a PSD record (and even
if they did I agree that we probably want to ignore it). I should have
modified the example to eliminate that confusion.

The question regarding sending reports for existing vs non-existing domain
to a PSO came up in a discussion with Scott et.al in December. The short
version is that we have some concerns about sending aggregate and failure
reports to PSOs for existing domains. But I don't think there will be a
problem to send reports for non-existing domains.

I agree that it might make sense to modify parts of the privacy
considerations regarding multi-organizations PSDs like .com. But for the
rest I think it is good to call out the considerations as different mailbox
providers may have different levels of comfortability when it comes to
sending reports to a PSO.

I agree it is convenient for a PSD (like .bank) to rely on DMARC reports to
detect when a customer is missing a DMARC record, but since there are
mailbox providers that do not send DMARC reports I think it would be better
for the PSD in that case to rely on a different approach to identify
non-compliant customers. However I think the non-existing domains reports
are important to detect spoofing/phishing attempts in .gov and .mil type of
organizations.

/E

On Tue, Jan 31, 2023 at 2:06 PM John R Levine <[e-mail]> wrote:

> > example, but what matters is really the existence of example.com as I
> think
> > the purpose is to not leak information to a PSO for a domain that do
> exist
> > without a DMARC record.
>
> The ENTIRE POINT of PSD records is to send reports about subdomains that
> exist but don't have their own DMARC records, so the PSD can tell the
> subdomain to fix it.
>
> The only domains that will ever publish a PSD record are ones like .BANK
> and .INSURANCE that have contracts with their registrants, or like .GOV
> that are effectively a single organization.
>
> There no chance whatsoever that .COM or any other unrestricted TLD will
> ever publish a PSD record.
>
> Now that I look at the privacy considerations, we need to rip out stuff
> about Multi-organization PSDs (e.g., ".com") that do not mandate DMARC
> usage because it makes no sense, and the bit about nonexistent only doubly
> makes no sense since it's impossible to implement.
>
> Regards,
> John Levine, [e-mail], Taughannock Networks, Trumansburg NY
> Please consider the environment before reading this e-mail. https://jl.ly
>