Subject: [dmarc-ietf] PSD Flag

From: Scott Kitterman <[email-masked]>
Date: Sat, 04 Dec 2021 23:27:57 -0500

I think the addition of the PSD flag to support organizational domain 
determination is a good change.  I have some quibbles about the exact 
definition though:

>   psd:  A flag indicating whether the domain is a PSD. (plain-text;
> 	      OPTIONAL; default is 'n').  Possible values are:
>
> 	      y:  Domains on the PSL that publish DMARC policy records SHOULD
> 	         include this tag with a value of 'y' to indicate that the
> 	         domain is a PSD.  This information will be used during policy
> 	         discovery to determine how to apply any DMARC policy records
> 	         that are discovered during the tree walk.
> 		 	      
> 	      n:  The default, indicating that the DMARC policy record is
> 	         published for a domain that is not a PSD.

Why does this need a value at all?  Why can't the flag just be psd?

>   psd:  A flag indicating whether the domain is a PSD. (plain-text;
> 	      OPTIONAL;).  Presence of this flag indicates that the domain
> 	        is a PSD and that this DMARC record MUST NOT be considered
> 	        for determining organizational domain.

This would require a change to the second paragraph of Section 4.6 to go with 
it:

>	   For any email message, the Organizational Domain of the RFC5322.From	   
> 	   domain is determined by performing a DNS Tree Walk as described in
> 	   Section 4.5.  The target of the search is a valid DMARC record that
> 	   contains a psd tag with a value of 'y'.  Once such a record has been
> 	   found, the Organizational Domain for the DNS domain matching the one
> 	   found in the RFC5322.From domain can be declared to be the target
> 	   domain queried for in the step just prior to the query that found the
> 	   PSD domain.

All that's needed is to strike "with a value of 'y'" from the second sentence.

I think this is simpler and clearer.

Scott K

---

From: Todd Herr <[email-masked]>
Date: Mon, 6 Dec 2021 08:10:02 -0500

On Sat, Dec 4, 2021 at 11:28 PM Scott Kitterman <[email-masked]>
wrote:

> [snip]
I don't disagree that it's simpler and clearer. However, expressing it as
psd=(y|n) was chosen to be consistent with the expression of every other
tag currently defined for DMARC records, all of which "follow the
extensible "tag-value" syntax for DNS-based key records defined in DKIM" as
declared in section 5.3, General Record Format.

This doesn't mean we can't break new ground here, but doing so would
require rewriting the beginning of section 5.3, as well.

-- 

*Todd Herr * | Technical Director, Standards and Ecosystem
*e:* [email-masked]
*m:* 703.220.4153

This email and all data transmitted with it contains confidential and/or
proprietary information intended solely for the use of individual(s)
authorized to receive it. If you are not an intended and authorized
recipient you are hereby notified of any use, disclosure, copying or
distribution of the information included in this transmission is prohibited
and may be unlawful. Please immediately notify the sender by replying to
this email and then delete it from your system.

---

From: Scott Kitterman <[email-masked]>
Date: Mon, 06 Dec 2021 13:57:00 +0000

>require rewriting the beginning of section 5.3, as well.

Unless there's a valid reason for someone to publish PSD=no, I don't think it should exist and I can't think of a reason.  If you give people a knob, someone will turn it [if we leave it in, I guarantee you there will be things written about how essential it is to have psd=no in your DMARC record].

Good point about section 5.3.  The ABNF would need changing too.  I can provide a patch for the change if you would like.

Scott K

---

From: Tim Wicinski <[email-masked]>
Date: Mon, 6 Dec 2021 17:23:37 -0500

On Mon, Dec 6, 2021 at 8:57 AM Scott Kitterman <[email-masked]> wrote:

>
>
> Unless there's a valid reason for someone to publish PSD=no, I don't think
> it should exist and I can't think of a reason.  If you give people a knob,
> someone will turn it [if we leave it in, I guarantee you there will be
> things written about how essential it is to have psd=no in your DMARC
> record].
>
>
What Scott says here. It can not be said enough.  People will attempt
anything and everything.  Make it simple, and precise.

---

From: Alessandro Vesely <[email-masked]>
Date: Wed, 8 Dec 2021 13:07:45 +0100

On Mon 06/Dec/2021 23:23:37 +0100 Tim Wicinski wrote:
> On Mon, Dec 6, 2021 at 8:57 AM Scott Kitterman <[email-masked] 
> <mailto:[email-masked]>> wrote:
> 
> 
>     things written about how essential it is to have psd=no in your DMARC record].
> 
> 
> What Scott says here. It can not be said enough.  People will attempt anything 
> and everything.  Make it simple, and precise.

Then the same holds for t=.  Apart from the fact that there's nothing ambiguous 
in saying psd=no, a handy rule for boolean tags would be that they default to 
"no", but if they appear without value in a record, the assumed value is "yes".

Best
Ale
--