Subject: [dmarc-ietf] How does PSD for DMARC affect tree walk issue?

From: "Doug Foster" <[email-masked]>
Date: Thu, 19 Nov 2020 17:14:47 -0500

PSD for DMARC specifies moving up one additional layer of the DNS tree to
look for the PSD policy, but it has the effect of adding DMARC policies to
all levels of participating public suffixes.    How do we judge whether this
workload will be acceptable or not if widely implemented?

I ask because it seems to be moving us closer to the performance
implications of a scope-limited tree walk.

Doug Foster

---

From: "Chudow, Eric B CIV NSA DSAW (USA)" <[email-masked]>
Date: Thu, 19 Nov 2020 22:34:30 +0000

For domains and organizational domains that have DMARC policies, then there is no difference.  For ones that don't, there is only one extra check and I think that often it will be cached to minimize the actual lookups needed in practice.

Thanks,

Eric Chudow
DoD Cybersecurity Mitigations

From: Doug Foster <[email-masked]> 
Sent: Thursday, November 19, 2020 5:15 PM
To: 'IETF DMARC WG' <[email-masked]>
Subject: [dmarc-ietf] How does PSD for DMARC affect tree walk issue?

PSD for DMARC specifies moving up one additional layer of the DNS tree to look for the PSD policy, but it has the effect of adding DMARC policies to all levels of participating public suffixes.    How do we judge whether this workload will be acceptable or not if widely implemented?

I ask because it seems to be moving us closer to the performance implications of a scope-limited tree walk.

Doug Foster