Re: [Gen-art] [dmarc-ietf] Genart last call review of draft-ietf-dmarc-psd-08

["Kurt Andersen (b)" <[e-mail]>]

On Thu, Apr 9, 2020 at 1:36 PM Murray S. Kucherawy <[e-mail]>
wrote:

>
> That seems like it paints a much clearer picture, which is what Dale was
> after.  A great start!
>
> On Thu, Apr 9, 2020 at 12:54 PM Todd Herr <[e-mail]> wrote:
>
>> Having reviewed the comments, I'm wondering if perhaps the following
>> draft rewrite of the Abstract section might be a first step to address many
>> of the points raised?
>>
>> *AbstractDMARC (Domain-based Message Authentication, Reporting, and
>> Conformance) is a scalable mechanism by which a mail-originating
>> organization can express domain-level policies and preferences for message
>> validation, disposition, and reporting, that a mail-receiving organization
>> can use to improve mail handling.  *
>>
>> *The original design of DMARC applies only to domains that are registered
>> with a domain name registrar (called “Organizational Domains” in RFC 7489)
>> and nodes in the tree below Organizational Domains. Organizational Domains
>> are themselves nodes in the tree below domain names reserved for
>> registration, with the latter commonly referred to as “Top Level Domains”
>> (TLDs) (e.g., ‘.com’, ‘.co.uk <http://co..uk>’, etc.), although in this
>> document they will be referred to as Public Suffix Domains (PSDs).*
>>
>> *Since its deployment in 2015, use of DMARC has shown a clear need for
>> the ability to express policy for PSDs. This document describes an
>> extension to DMARC to enable DMARC functionality for PSDs.*
>>
>> *RFC 7489 describes an algorithm for a mail-receiving organization to use
>> in determining the Organizational Domain of an inbound mail message, and
>> this algorithm recommends the use of a “public suffix list” (PSL), with the
>> most common one maintained by the Mozilla Foundation and made public at
>> <http://publicsuffix.org/ <http://publicsuffix.org/>>. Use of such a PSL by
>> a mail-receiving organization will be required in order to discover and
>> apply any DMARC policy declared by a PSD.*
>>
>> *This document also seeks to address implementations that consider a
>> domain on a public Suffix list to be ineligible for DMARC*
>>
>
I have two concerns with the proposed abstract:

   1. ".co.uk" is not a TLD. TLDs are single label domains - there are
   ccTLDs and gTLDs.
   2. The invocation of the PSL compounds the issue that was raised by Dave
   Crocker. How DMARC (RFC 7489) determines the organizational domain is
   orthogonal to this proposal which simply calls for a conditional additional
   check at the "org - 1" level. I recommend striking the penultimate
   paragraph in the proposal.

--Kurt