Re: [dmarc-ietf] Nonexistent Domain Policy was: Re: Working Group Last Call: draft-ietf-dmarc-psd

2019-07-19 Thread John Levine
In article you write: >Most MTAs will also follow CNAMEs. Should they be included (along with >other things like DNAME records) within the scope of existence? I'm a >little concerned that we are making a special definition of "non-existence" >which differs from the standard DNS concepts of

Re: [dmarc-ietf] Nonexistent Domain Policy was: Re: Working Group Last Call: draft-ietf-dmarc-psd

2019-07-19 Thread Scott Kitterman
On Wednesday, July 17, 2019 1:07:05 AM EDT Scott Kitterman wrote: > On Saturday, July 13, 2019 3:34:51 PM EDT Scott Kitterman wrote: > > On Friday, July 12, 2019 2:28:39 PM EDT Scott Kitterman wrote: > > > On Friday, July 12, 2019 1:54:57 PM EDT Kurt Andersen (b) wrote: > > > > On Fri, Jul 12,

Re: [dmarc-ietf] Nonexistent Domain Policy was: Re: Working Group Last Call: draft-ietf-dmarc-psd

2019-07-19 Thread Scott Kitterman
On Friday, July 19, 2019 11:33:38 AM EDT Kurt Andersen (b) wrote: > On Fri, Jul 19, 2019 at 8:30 AM Kurt Andersen (b) wrote: > > On Thu, Jul 18, 2019 at 10:42 PM Scott Kitterman > > > > wrote: > >> If we want to take another run at this and put it in more standard DNS > >> terminology, then

Re: [dmarc-ietf] Nonexistent Domain Policy was: Re: Working Group Last Call: draft-ietf-dmarc-psd

2019-07-19 Thread Scott Kitterman
On Wednesday, July 17, 2019 10:01:01 AM EDT Chudow, Eric B CIV NSA DSAW (USA) wrote: ... > For the current wording, I think the “if not” is unclear in the “If absent, > the policy specified by the "sp" (if present) and then the "p" tag, if not, > MUST be applied for non-existent subdomains.”

Re: [dmarc-ietf] Nonexistent Domain Policy was: Re: Working Group Last Call: draft-ietf-dmarc-psd

2019-07-19 Thread Tim Wicinski
An experimental draft isn't the best place for a deployment guide. an operational document that discusses deployment among other things is a different story On Fri, Jul 19, 2019 at 11:13 PM Scott Kitterman wrote: > On Friday, July 19, 2019 11:30:01 AM EDT Kurt Andersen (b) wrote: > > > >

Re: [dmarc-ietf] Nonexistent Domain Policy was: Re: Working Group Last Call: draft-ietf-dmarc-psd

2019-07-19 Thread Scott Kitterman
On Friday, July 19, 2019 8:04:20 AM EDT Dotzero wrote: > I've been following the discussion but haven't contributed anything until > this point. Comment below. > > On Fri, Jul 19, 2019 at 3:29 AM Ian Levy > 40ncsc.gov...@dmarc.ietf.org> wrote: > > > I think this is one of those "you must be

Re: [dmarc-ietf] Nonexistent Domain Policy was: Re: Working Group Last Call: draft-ietf-dmarc-psd

2019-07-19 Thread Scott Kitterman
On Friday, July 19, 2019 11:30:01 AM EDT Kurt Andersen (b) wrote: > > > I'm also concerned > > > that a wildcard null MX record at the org level would end up having all > > > subdomains "exist", but the policy that should be applied would be the > > > > more > > > > > restrictive "np"

Re: [dmarc-ietf] Nonexistent Domain Policy was: Re: Working Group Last Call: draft-ietf-dmarc-psd

2019-07-19 Thread Kurt Andersen (b)
On Fri, Jul 19, 2019 at 8:30 AM Kurt Andersen (b) wrote: > On Thu, Jul 18, 2019 at 10:42 PM Scott Kitterman > wrote: > >> >> If we want to take another run at this and put it in more standard DNS >> terminology, then maybe: >> >> a domain for which there is an NXDOMAIN or NODATA response

Re: [dmarc-ietf] Nonexistent Domain Policy was: Re: Working Group Last Call: draft-ietf-dmarc-psd

2019-07-19 Thread Kurt Andersen (b)
On Thu, Jul 18, 2019 at 10:42 PM Scott Kitterman wrote: > On Thursday, July 18, 2019 11:42:36 AM EDT Kurt Andersen (b) wrote: > > On Wed, Jul 17, 2019 at 7:35 PM Scott Kitterman > > > > Most MTAs will also follow CNAMEs. Should they be included (along with > > other things like DNAME records)

Re: [dmarc-ietf] Nonexistent Domain Policy was: Re: Working Group Last Call: draft-ietf-dmarc-psd

2019-07-19 Thread Dotzero
I've been following the discussion but haven't contributed anything until this point. Comment below. On Fri, Jul 19, 2019 at 3:29 AM Ian Levy wrote: > > I think this is one of those "you must be this tall to ride on this ride" > > situations. DNS comes equipped with multiple footguns and you

Re: [dmarc-ietf] Nonexistent Domain Policy was: Re: Working Group Last Call: draft-ietf-dmarc-psd

2019-07-19 Thread Ian Levy
> I think this is one of those "you must be this tall to ride on this ride" > situations. DNS comes equipped with multiple footguns and you have to know a > bit about what you're doing to make sure you get the effects you're after. This. DMARC today allows people to disconnect their outgoing