Subject: [dmarc-ietf] LC feedback on draft-ietf-dmarc-psd-04

From: "Kurt Andersen (b)" <[email-masked]>
Date: Fri, 12 Jul 2019 15:35:31 -0700

Please note that I did not review Tim's comments in detail so some of the
following points may have been covered by him previously.

*Page 2 contains the following paragraph:*

   This memo provides a simple extension to DMARC [RFC7489
<https://tools.ietf.org/html/rfc7489>] to allow
   operators of Public Suffix Domains (PSDs) to express policy for
   groups of subdomains, extends the DMARC [RFC7489
<https://tools.ietf.org/html/rfc7489>] policy query
   functionality to detect and process such a policy, describes receiver
   feedback for such policies, and provides controls to mitigate
   potential privacy considerations associated with this extension.

This extension does not really allow PSDs to express policy for
"groups of subdomains" unless you take the perspective that "all or
none" are groups. Perhaps altering the language to say "...to express
policy that would apply to subdomains..."?

*The very end of section 1 says:*

   DMARC [RFC7489 <https://tools.ietf.org/html/rfc7489>], by design,
does not support usage by PSOs.  For PSDs
   that require use of DMARC [RFC7489
<https://tools.ietf.org/html/rfc7489>], an extension of DMARC
reporting
   and enforcement capability is needed for PSO to effectively manage
   and monitor implementation of PSD requirements.

I still fail to see how this proposal is necessary (or, potentially
even useful) for the PSO to perform enforcement of their policies. I'd
recommend either deleting the entire paragraph or refocusing the
second sentence around the brand protective role that this proposal
brings for abuse of non-existent subdomains below the PSD.

*Section 2.2* "PSD DMARC includes all public domains..." --> suggest
"PSD DMARC applies to all public domains..."

*Section 2.6* "...that a receiver is willing to accept" seems like it
opens up a wide area if one applies considerations like
DNSSEC/DANE/MTA-STS/etc. There is a separate conversation on this
topic so I'll defer to that thread.

*Section 3* should include the new "np" keyword as an update to the DMARC spec.

*Section 3.5* This call-out makes it seem like information about
non-existent domains is not desirable and useful for org-level DMARC.
Can we modify the language to remove that implication? Perhaps "...is
desirable and useful, just as it is for org-level DMARC operators."

*Section 4* Neglects the privacy implications of broken "receiver is
willing to accept" conditions that may lead to additional leakage.
Also in the third bullet point, "it's feedback" should not have an
apostrophe.

--Kurt

---

From: Scott Kitterman <[email-masked]>
Date: Fri, 12 Jul 2019 22:05:38 -0400

> following points may have been covered by him previously.

Thanks.  I'd forgotten about that set of comments.  I think they mostly relate 
to the understandability of the front matter, so I'll discuss that further in 
that thread.

> policy that would apply to subdomains..."?

I think Tim's suggestions address this concern.

> brings for abuse of non-existent subdomains below the PSD.

I think it can be deleted.

> "PSD DMARC applies to all public domains..."

Seems fine.

> desirable and useful, just as it is for org-level DMARC operators."

There was a desire to say something specific about wanting data on non-existent 
domains.  I agree with your point.  What would you suggest saying to make the 
point that it's definitely desirable at the PSD level without implying it's not 
otherwise?

> Also in the third bullet point, "it's feedback" should not have an

Typo is fixed in git.

Isn't it always true that if local policy prohibits accepting certain DNS 
data, things will work out differently?  Does this need to be called out?

Scott K

---

From: Scott Kitterman <[email-masked]>
Date: Fri, 26 Jul 2019 16:27:35 -0400

> policy that would apply to subdomains..."?

I think the changes I just pushed in response to Tim's comments address this.

> brings for abuse of non-existent subdomains below the PSD.

Agreed.  Deleted.

> "PSD DMARC applies to all public domains..."

Incorporated.

> topic so I'll defer to that thread.

This went away due to that discussion.

> *Section 3* should include the new "np" keyword as an update to the DMARC

Added based on the no existent domain sub-thread.

> desirable and useful, just as it is for org-level DMARC operators."

Incorporated.

> Also in the third bullet point, "it's feedback" should not have an

OBE, related text is removed.  Typo got fixed somewhere along the way.

Thanks,

Scott K