Subject: Re: [dmarc-ietf] DMARC PSD and non-existent subdomains

From: Richard C <[email-masked]>
Date: Mon, 10 Jun 2019 12:07:25 +0000

Thanks for the question, Seth.
What would be the best way to incorporate this requirement?
The simplest possible way to address this use case is just to make sure those existing but currently non-compliant domains just have a bare p=none record. Then they'll never fall back to the gov.uk<https://eur03.safelinks.protection.outlook.com/?url=http%3A%2F%2Fgov.uk&data=02%7C01%7CRichard.C%40ncsc.gov.uk%7C5e404b44633f4f62576c08d6e558b353%7C14aa5744ece1474ea2d734f46dda64a1%7C0%7C0%7C636948566460672014&sdata=ihf4soMa8kR%2BcGFwjiIwgy9iHDnrnKLkawsj0Zm9Mi4%3D&reserved=0> record. There's no risk to inadvertently breaking mail here.

Is it remotely realistic for you to offer this guidance? If you're already saying that p=reject is required, how painful is it to advertise that any domain without a DMARC record will get p=reject by default unless it explicitly puts p=none in?

I wish that publishing guidance resulted in swift adoption of it but unfortunately it’s not so simple. We already have guidance published requesting that organisations configure DMARC on their gov.uk domain (starting at ‘none’ and progressing to ‘reject’ as they gain confidence). The problem is we have ~3500 domains in use, many by smaller organisations with limited technical ability. Whilst we’ll continue to work towards helping them all deploy DMARC, realistically there will be a long tail to adoption, hence our interest in support for different policies for the existent and non-existent subdomains in DMARC PSD.

Presumably other PSDs that aren’t brand new will have this problem too? I’m interested to hear whether we’re on our own or not.

Richard
This information is exempt under the Freedom of Information Act 2000 (FOIA) and may be exempt under other UK information legislation. Refer any FOIA queries to [email-masked]

---

From: Scott Kitterman <[email-masked]>
Date: Mon, 10 Jun 2019 18:41:16 -0400

On Monday, June 10, 2019 8:07:25 AM EDT Richard C wrote:
> The simplest possible way to address this use case is just to make sure
> those existing but currently non-compliant domains just have a bare p=none
> record. Then they'll never fall back to the
> gov.uk<https://eur03.safelinks.protection.outlook.com/?url=http%3A%2F%2Fgov
> .uk&data=02%7C01%7CRichard.C%40ncsc.gov.uk%7C5e404b44633f4f62576c08d6e558b35
> 3%7C14aa5744ece1474ea2d734f46dda64a1%7C0%7C0%7C636948566460672014&sdata=ihf4
> soMa8kR%2BcGFwjiIwgy9iHDnrnKLkawsj0Zm9Mi4%3D&reserved=0> record. There's no
> risk to inadvertently breaking mail here.
 
> Is it remotely realistic for you to offer this guidance? If you're already
> saying that p=reject is required, how painful is it to advertise that any
> domain without a DMARC record will get p=reject by default unless it
> explicitly puts p=none in?
 
> I wish that publishing guidance resulted in swift adoption of it but
> unfortunately it’s not so simple. We already have guidance published
> requesting that organisations configure DMARC on their gov.uk domain
> (starting at ‘none’ and progressing to ‘reject’ as they gain confidence).
> The problem is we have ~3500 domains in use, many by smaller organisations
> with limited technical ability. Whilst we’ll continue to work towards
> helping them all deploy DMARC, realistically there will be a long tail to
> adoption, hence our interest in support for different policies for the
> existent and non-existent subdomains in DMARC PSD.
 
> Presumably other PSDs that aren’t brand new will have this problem too? I’m
> interested to hear whether we’re on our own or not.

As written, DMARC (RFC 7489) has the option to express different policy for 
subdomains (sp= tag).  Perhaps we could address this case in PSD DMARC by 
leveraging that feature.

PSD DMARC is the first time there is any DMARC related explicit guidance on 
non-existent sub-domains.  If we made it a rule that non-existent sub-domains 
use the domain level (p=) policy and existent sub-domains use the sub-domain 
policy (sp=) then I believe the affect you are after is achievable.

Assuming p=reject and sp=none at the PSD level, the result would be:

existing org domain (or sub) with DMARC record = use org policy
existing org domain (or sub) with no DMARC record = None policy
Non-existing org domain (or sub) with DMARC record = Reject policy
PSD domain = Reject policy

That would be a non-trivial increase in implementation complexity for 
receivers, so I think we need some discussion about if there is consensus to 
take this on.

Scott K

---

From: Alessandro Vesely <[email-masked]>
Date: Tue, 11 Jun 2019 17:38:03 +0200

> policy (sp=) then I believe the affect you are after is achievable.

Rather than altering p= and sp=, I'd add an np=, say, for non-existing domains:

* It certainly would gather more attention by implementers,

* Domain owners could monitor <policy_published> to check it.

* It allows the main domain to have a non-reject policy.

Best
Ale
--

---

From: Hector Santos <[email-masked]>
Date: Tue, 11 Jun 2019 12:54:25 -0400

> * It allows the main domain to have a non-reject policy.

+1. I like this.

In general, I want compatibility, but it seems, in my opinion, to be a 
lack of willingness to consider more tags.  Maybe it is a messenger 
problem, but we long had quite a number of extended ideas for a 
standard DKIM Policy protocol framework. The Domain Discovery Lookup 
Method is one of them and its directly and indirectly related to 3rd 
party policy concepts, one that is defined by some public suffix list 
where I am not familiar with, appears to had politics involved too, 
and off hand, it appears to have a trust factor.  Can I trust using 
this list? Where do I get this list? Is there are periodic update 
concept and so forth.

I will place my trust on the cogs with this, but at this point, I will 
note I am lost with the extended logic algorithm being proposed. 
Trying the fast read the draft specs does not help. Maybe Scott can 
describe it (extended Lookup method) in pseudo code.

-- 
HLS