Subject: [dbound] RDBD Questions

From: "Brotman, Alexander" <[email-masked]>
Date: Wed, 5 Jun 2019 14:36:26 +0000

Hello all,

Stephen and I were able to sit down and discuss the feedback that was received during IETF and via the mailing list.  Based on that conversation, we're planning to make the following changes but would be happy to get any feedback before/as we do that.

1) A couple of people wanted a method for disavowing a relationship, i.e. making a negative assertion.  We believe we can achieve this by defining another tag within the RDBD RR.
2) As part of adding negative assertions, we're proposing that we make it so that any place where you might list a single name today, you could alternatively point to an HTTPS URL that points at a file containing a list of names.  When doing the negative assertion, this'd allow for an easier method to list numerous entries.
3) We'll explicitly document that the RDBD record type envisages multi-valued responses just to make it clear that both positive and negative records can be found at the same location.
4) We're not sure if there is a preference for the DNSSEC-style RR value we used in the 01 draft, or for the DKIM-style value that was used in the 00 draft. (We will of course stick with a new RRTYPE and not go back to abusing TXT:-) The end result is the same, but the format of the record value may make more sense to some parties in one format or the other.  For the DKIM-style, this is a familiar format to many who have worked with SPF/DKIM/DMARC records.  On the other hand, the DNSSEC-style might be more familiar to those managing the DNS systems. We've not yet decided which we prefer ourselves, so feedback on this is most welcome.

Thank you again for your feedback.

--
Alex Brotman
Sr. Engineer, Anti-Abuse & Messaging Policy
Comcast