Subject: [dmarc-ietf] DMARC PSD and non-existent subdomains

From: Richard C <[email-masked]>
Date: Thu, 30 May 2019 16:06:18 +0000

Hello

At the National Cyber Security Centre in the UK we're supportive of the PSD DMARC initiative. However, we currently have one problem that would hamper its applicability to our use case: We essentially have the need to express different subdomain policies to existing and non-existing domains. In our case for the gov.uk PSD we'd like to be able to set a 'reject' policy for non-existent subdomains to prevent delivery of email from them whilst not interfering with authentication of email for the legitimate subdomains.

Why? Well, whilst we have a programme of work to get domain owners under gov.uk to implement DMARC and other standards, it will take some of them time, and we don't want to inadvertently break mail delivery for the organisations that have e.g. implemented SPF but not DMARC. But on the flipside, we also know that non-existent domains under gov.uk are being spoofed for phishing, so we want to publish a policy of 'reject' on those and receive reporting about them.

What would be the best way to incorporate this requirement?

Thanks in advance

Richard Crowther, NCSC

This information is exempt under the Freedom of Information Act 2000 (FOIA) and may be exempt under other UK information legislation. Refer any FOIA queries to [email-masked]

---

From: Seth Blank <[email-masked]>
Date: Thu, 30 May 2019 16:43:28 -0700

> What would be the best way to incorporate this requirement?

The simplest possible way to address this use case is just to make sure
those existing but currently non-compliant domains just have a bare p=none
record. Then they'll never fall back to the gov.uk record. There's no risk
to inadvertently breaking mail here.

It it remotely realistic for you to offer this guidance? If you're already
saying that p=reject is required, how painful is it to advertise that any
domain without a DMARC record will get p=reject by default unless it
explicitly puts p=none in?

Seth