Subject: [dmarc-ietf] Amazon Comments to DMARC Extension to PSD

From: "Flaim, Bobby" <[email-masked]>
Date: Wed, 17 Jul 2019 22:23:11 +0000

Amazon supports this draft and effort .

This current DMARC extension (IETF DMARC PSD) draft<https://datatracker.ietf.org/doc/draft-ietf-dmarc-psd/> would make it easier for our direct customers (registrants) to setup a common DMARC policy for all their subdomains. With this extension they can set up the policy in one place, such as the SLD level (second level domain) and it will apply to any subdomain they create.  However, since feedback leakage can happen due to the nature of the IETF DMARC PSD solution, the following proposed alternative could be employed to address this issue.

Is the DEMARC defined for dog.animals.com<http://dog.animals.com>?

a.      Yes: then use it

b.      No: then look for DMARC on animals.com<http://animals.com>

Proposed Default Alternative:
a.      Is the DEMARC defined for dog.animals.com<http://dog.animals.com>?

a.      Yes: Then use it

b.      No: Is using the PSD DMARC explicitly permitted by the dog.animals.com<http://dog.animals.com> owner in some TXT record (means “delegated explicitly to the PSD”)?
1.      Yes: then look for DMARC onanimals.com<http://animals.com>
1.      No: terminate

The alternative proposal requires the registrant to explicitly set up the default.

---

From: Scott Kitterman <[email-masked]>
Date: Wed, 17 Jul 2019 23:50:21 +0000

On July 17, 2019 10:23:11 PM UTC, "Flaim, Bobby" <flaim=[email-masked]> wrote:
>This current DMARC extension (IETF DMARC PSD)
>draft<https://datatracker.ietf.org/doc/draft-ietf-dmarc-psd/> would
>make it easier for our direct customers (registrants) to setup a common
>DMARC policy for all their subdomains. With this extension they can set
>up the policy in one place, such as the SLD level (second level domain)
>and it will apply to any subdomain they create.  However, since
>feedback leakage can happen due to the nature of the IETF DMARC PSD
>solution, the following proposed alternative could be employed to
>address this issue.
>
>b.      No: Is using the PSD DMARC explicitly permitted by the
>dog.animals.com<http://dog.animals.com> owner in some TXT record (means
>“delegated explicitly to the PSD”)?

How would that work for non-existent domains?

Appendix B describes options to address the issues.  I like that your suggestion doesn't leave it in the hands of the PSO to self assert if PSD DMARC is appropriate, but I wonder why dog.animals.com doesn't just publish a DMARC record?

Scott K

---

From: Dotzero <[email-masked]>
Date: Wed, 17 Jul 2019 20:10:20 -0400

On Wed, Jul 17, 2019 at 7:51 PM Scott Kitterman <[email-masked]>
wrote:

> Appendix B describes options to address the issues.  I like that your
> suggestion doesn't leave it in the hands of the PSO to self assert if PSD
> DMARC is appropriate, but I wonder why dog.animals.com doesn't just
> publish a DMARC record?
>
> Scott K
>
>
I have to wonder if the Amazon example is the general rule or the
exception? For example, .bank requires all domains to have P=reject. In
their case they wouldn't want the (sub) domain to be able to override the
.bank policy. I'm not sure that enabling a (sub) domain to disable the
DMARC policy up the tree is a good idea. As Scott points out, all the (sub)
domain has to do is publish their own DMARC record/policy and then it
simply becomes a contractual issue.

Michael Hammer

---

From: "John Levine" <[email-masked]>
Date: 18 Jul 2019 05:28:22 -0000

In article <[email-masked]>,
Flaim, Bobby <[email-masked]> wrote:
>-=-=-=-=-=-
>This current DMARC extension (IETF DMARC PSD) draft<https://datatracker.ietf.org/doc/draft-ietf-dmarc-psd/> would make it
>easier for our direct customers (registrants) to setup a common DMARC policy for all their subdomains.

It looks like you may be misunderstanding what PSD is.  

If someone registers, say, pickle.deal, right now they can put an sp=
tag in the record at _dmarc.pickle.deal which sets the policy for
<anything>.pickle.deal.  That's the way that organizational domains
work.

PSD lets you publish _dmarc.deal and have that apply by default to the whole TLD,
<anything>.deal and <any>.<thing>.deal and so forth.

R's,
John
-- 
Regards,
John Levine, [email-masked], Primary Perpetrator of "The Internet for Dummies",
Please consider the environment before reading this e-mail. https://jl.ly