Subject: [dmarc-ietf] Minutes from IETF 112

From: Barry Leiba <[email-masked]>
Date: Wed, 17 Nov 2021 09:39:40 -0500

Minutes from the DMARC session at IETF 112 are posted on the meeting
materials page:
https://datatracker.ietf.org/meeting/112/session/dmarc

Direct link to the minutes:
https://datatracker.ietf.org/meeting/112/materials/minutes-112-dmarc.html

Corrections are welcome.

Barry

---

From: Douglas Foster <[email-masked]>
Date: Thu, 18 Nov 2021 08:10:45 -0500

Consensus on Tree Walk?

A comment in the minutes suggested that consensus was forming around Tree
Walk for Policy Discovery.   I do not have that impression.  Instead, the
"strongly favor" and "strongly oppose" voices seem about equal, with the
balance determined by those who, like myself, are tepidly in favor.

Does Tree Walk eliminate the PSL?

I am concerned that support for Tree Walk is driven by antipathy to the
PSL, rather than for the functional capabilities that Tree Walk provides.
The PSL is needed for alignment, which is essential to the determination of
the PASS or FAIL result.  Eliminating use of the PSL for policy discovery
is trivial unless it is also replaced for alignment.    We have discussed
three options for alignment:

·         The publicsuffix.org list which has conspicuous limitations.

·         Downward-only alignment, which has been rejected as incompatible
with current practice.

·         DNS flags, a topic which was apparently not pursued during the
meeting.

Do Complex Organizations want policy flexibility?

Granular DMARC policies can be achieved under DMARCv1 by using many policy
records with p=<value>.   Tree walk simplifies that process by allowing
intermediate subtrees to be configured using sp=<value> policies.    We
need input from complex organizations to indicate whether this capability
is something that they would value and use.

Do we want to provide a sub-tree alignment option?

Suppose that “security.example.edu” does not want any other part of “
example.edu” to be sending emails on their behalf, so they want to limit
alignment to their sub-tree only.   This approach becomes feasible if (a)
we use tree walk and (b) we implement a clause which indicates “top of tree
for alignment purposes”.    I suspect that this would have some appeal to
parts of some universities and other complex organizations, but again we
would need those organizations to affirm that it would be useful.

Doug Foster

On Wed, Nov 17, 2021 at 9:40 AM Barry Leiba <[email-masked]> wrote:

> _______________________________________________
> dmarc mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/dmarc
>

---

From: Todd Herr <[email-masked]>
Date: Thu, 18 Nov 2021 09:07:50 -0500

> would need those organizations to affirm that it would be useful.
It seems to me that DMARC already provides the ability for
security.example.edu to ensure that no other part of example.edu can send
mail on their behalf. To accomplish this, security.example.edu can today:

   - Publish an SPF record listing only hosts under its direct control, a
   record which ends with "-all"
   - Ensure that only hosts under its control can DKIM sign messages using "
   security.example.edu" as the signing domain, by making sure that its
   private DKIM signing key is only deployed to hosts under its control
   - Publish a DMARC policy record that includes the following three tags
   and values:
      - p=reject
      - adkim=s
      - aspf=s

-- 

*Todd Herr * | Technical Director, Standards and Ecosystem
*e:* [email-masked]
*m:* 703.220.4153

This email and all data transmitted with it contains confidential and/or
proprietary information intended solely for the use of individual(s)
authorized to receive it. If you are not an intended and authorized
recipient you are hereby notified of any use, disclosure, copying or
distribution of the information included in this transmission is prohibited
and may be unlawful. Please immediately notify the sender by replying to
this email and then delete it from your system.

---

From: "John Levine" <[email-masked]>
Date: 18 Nov 2021 14:44:01 -0500

>   - Publish a DMARC policy record that includes the following three tags

Agreed.  That would work fine.

An sp=reject in both security.example.edu and its org domain would also be a good idea.

R's,
John

---

From: Douglas Foster <[email-masked]>
Date: Thu, 18 Nov 2021 15:50:39 -0500

Don't the alignment rules allow any DKIM signature for the organization to
validate any FROM address for the organization -- up, down, or sideways?

To use the sideways example, this means that an RFC 5322.From address of "
[email-masked]"  can be validated for DMARC:
- by SPF PASS on an RFC5321.MailFrom address of "[email-masked]",
or
- by a verified DKIM signature issued by d=Humanities.Example.Edu using a
public key published in the Humanities sub-tree.

That, at least, is my understanding.

Doug

On Thu, Nov 18, 2021 at 9:08 AM Todd Herr <[email-masked]> wrote:

>    - Ensure that only hosts under its control can DKIM sign messages
>    using "security.example.edu" as the signing domain, by making sure
>    that its private DKIM signing key is only deployed to hosts under its
>    control

---

From: Dotzero <[email-masked]>
Date: Thu, 18 Nov 2021 16:22:55 -0500

On Thu, Nov 18, 2021 at 3:51 PM Douglas Foster <
[email-masked]> wrote:

> - by SPF PASS on an RFC5321.MailFrom address of "
> [email-masked]", or

Your understanding is incorrect. Please review what the adkim and aspf tags
do. In the strict mode the domain must be an exact match. In the relaxed
mode it must either be an exact match or match the parent domain. In no
case will "sister" subdomains produce a pass.

Michael Hammer

---

From: Jesse Thompson <[email-masked]>
Date: Tue, 30 Nov 2021 20:40:17 +0000

> An sp=reject in both security.example.edu and its org domain would also be a good idea.

(Sorry, AWOL due to new employment, only tertiary involved in matters relevant to this discussion these days. Also haven't read this list for about a year.) 

Here's my best recollection of the issue:

p=(quarantine|reject) isn't the real issue for example.edu; just tell departments to use their sub.example.edu domains (localized control/branding makes people happy, more or less.) [1]  p=(quarantine|reject) for sub.example.edu isn't really an issue either; just a microcosm.

The problem is when there are departments with lots of systems all sending from hostname.sub.example.edu. So, sub.example.edu needs time to reconcile (or doesn't care to), wants to publish sp=none for sub.example.edu; but can't because the org domain's sp policy is the only one that matters, since there is no tree walk from hostname.sub.example.edu to sub.example.edu. Meanwhile, example.edu can't move beyond sp=none.

Also, the lack of control down the tree means that example.edu would never be able to use aspf=r, which is restricting a useful feature from organizations that could probably benefit the most from the flexibility it provides. I don't think that inability to use adkim=r is as much of an issue since individual CNAME records are easy to create under example.edu. This if off topic in my mind, but it was mentioned above.

Jesse

[1] most complex institutions probably aren't so willing to hand out subdomains like candy