No, that's not what RFC 9989 says. The psd=y/n tags are expected to be rare. In
the
usual case where the tree walk doesn't find either, the Organizational domain is
the highest level in the tree that has a _dmarc record, which in nearly every
case will produce the same result as the former PSL check. You can publish psd=n
to say "this is an org domain" or psd=y to say "the org domain is one level down
from here", but again, those will be rare.
See section 4.10 and particularly 4.10.2 of RFC 9989.
I was imprecise here, and I apologize.
My use of the word "requires" is overloaded there and doesn't mean any kind of actual
RFC-2119 "must" requirement, just that that would be what would stop an upward search in
cases where one does actually happen (i.e. where no author domain DMARC record is present), per my
reading of how the tree walk operates (steps 5-7).
The listed example even includes polling for _dmarc.com TXT in cases where the
search occurs. Some TLD's already have this style of record. Others may never.
Sure, but my point was that the psd tag is exotic and most people can
safely forget about them and need no changes to the DMARC records they
have now.
Here's all the DMARC records in top-level domains now. The ones for BANK,
INSURANCE, GOV, MIL. and (surprisingly) NHK are real, the rest are due to
wildcards. I'm kind of surprised to see the NHK one since I don't think
they went through the ICANN process.
_dmarc.BANK descriptive text "v=DMARC1; p=reject; sp=none; np=reject; psd=y;
rua=mailto:[email protected],mailto:[email protected]";
_dmarc.FM descriptive text "bio=95866ffa72b905b06f2ac03e95657df9d17c4f47"
_dmarc.FM descriptive text "v=spf1 ip6:fddb:0cf4:a3cf::/48 -all"
_dmarc.GOV descriptive text "v=DMARC1; p=reject; sp=none; np=reject;
rua=mailto:[email protected]; psd=y"
_dmarc.INSURANCE descriptive text "v=DMARC1; p=reject; sp=none; np=reject; psd=y;
rua=mailto:[email protected],mailto:[email protected]";
_dmarc.MERCK descriptive text "Your DNS configuration needs immediate attention see
https://icann.org/namecollision";
_dmarc.MIL descriptive text "v=DMARC1; p=reject; sp=none; np=reject;
rua=mailto:[email protected]; psd=y"
_dmarc.NHK is an alias for
_dmarc.47xe6gr5j90mwndy--nhk.hosteddmarc.dmarc-dns.com.
_dmarc.47xe6gr5j90mwndy--nhk.hosteddmarc.dmarc-dns.com descriptive text "v=DMARC1;
p=reject; rua=mailto:[email protected],mailto:[email protected];
ruf=mailto:[email protected],mailto:[email protected]; fo=1; t=n;"
_dmarc.WS descriptive text "v=spf1 ip6:fdd0:951e:ede7::/48 -all"
_dmarc.XN--NGBRX descriptive text "Your DNS configuration needs immediate attention
see https://icann.org/namecollision";
R's,
John
_______________________________________________
mailop mailing list
[email protected]
https://list.mailop.org/listinfo/mailop
