DMARC at IETF 112

Note well

Barry introduced the Note Well and code of conduct

Barry summarized the agenda: 1 hour meeting in a 2 hour timeslot.

Todd Herr presenting

Discussion seems to be moving from the 2-query method to a DNS tree walk

Alessandro: 2 methods is better than one

Murray: glad tree walk is surviving this time

John Levine: Disagree with Alessandro, two methods are NOT better

Seth: not convinced by argument about current implementation using PSL.

Alessandro: Using the PSL is precise. Could use tree walk, but that might involve more lookups or something unexpected like a CNAME.

Barry: consensus seems to be tht the tree walk works and don’t need the backup.

Murray: Any interesting side effects of use of tree walk at scale?

Tim Hollebeek: Use of CAA seems to demonstrate that this would be OK at scale. PSL is impossible to ever get right; unmanageable at scale.

(proposed text changes): limited to 5 lookups.

Jim: 5 seems like a generous number of lookups

Alessandro: Should have 5-label limit as a parameter

Seth Blank and John Levine via Jabber: 5 was chosen to cover deepest suffixes in the PSL.

Various people noted possible interoperability issues if the depth is uncertain. But of course implementations may decide to do something different.

Jim: Will PSL ever get deeper?

JohnL: PSL maintainers are pushing back against deeper entries.

Seth: Should definition of org domain lookup be in a different document?

Jim: Some schools, etc. e.g. .k12.ma.us are also rather deep, not just hosting providers

Ale: We can suggest how to do discovery, but it’s the semantics not the method that are compelling

Seth: Need to consider what’s in scope with the WG charter (operational experience etc)

Barry: we have rough consensus on limiting tree walk to 5, will confirm on mailing list.

Identifying organizational domains

Todd: Tree walk requires change. No consensus yet on incliding flag in _dmarc records identifying PSD domains

Indirect email flows

Ale: Have a draft https://datatracker.ietf.org/doc/html/draft-vesely-dmarc-mlm-transform on recognizing original DKIM signature after transformation by intermediaries. Is there WG interest in it?

JohnL and Ned have read the draft.

Ned: (no audio)

JohnL: This is an idea that has been around for a while, and not useful.

Ale: It does work sometimes, so is a partial solution

JohnL: That’s not a strong path to interoperability.

Ned via Jabber: while I wish it were otherwise, I don’t think this covers enough of the mutations to provide sufficient benefit given the costs. I really wish this weren’t true.

Conclusion

Meeting adjourned 16:56 GMT

Expand allBack to topGo to bottom