Subject: [dmarc-ietf] 3.2.6 Rethinking the NP algorithm

From: Douglas Foster <[email-masked]>
Date: Mon, 20 Dec 2021 14:26:04 -0500

Goal:  block all unregistered subdomains of a parentdomain, particularly to
solve the PSD problem, but ideally to solve it with a generalized design:

SETUP:  The domain owner or PSD creates these DNS entries at any desired
DNS node:

·         DMARC record at _dmarc.parentdomain

·         type=CNAME, name="*.parentdomain", DATA=”reserved.parentdomain”

·         type=txt, name="reserved.parentdomain", DATA=”FromFlags v=1
scope=none”

Evaluator uses this process:

 Receives a message with domain: mail.sub2.sub1.parentdomain

Tree walk until a DMARC policy is found at _dmarc.parentdoma
Navigate down one level and query:   type=TXT, name=sub1.parentdomain

Query result of DATA=”FromFlags v=1 scope=none” means that the domain is
non-existent and should not be allowed for RFC5322.FROM addressing

Effect:   Any name which triggers the wildcard will be evaluated as
non-existent.   Because of the tree walk, the rule will affect the entire
subtree.

The same "FromFlags" txt record can be used without wildcards to explicitly
protect any single name.

Less DNS overhead than any alternative, and more precise.

I wish we could but the flag on the SPF record, instead of creating a new
one.

Doug Foster