Subject: [dmarc-ietf] Data Query: Non-existent subdomains

From: Douglas Foster <[email-masked]>
Date: Thu, 3 Mar 2022 07:07:59 -0500

I am looking for data about a particular type of non-existent domain.

The PSD spec addresses the problem of non-existent organizations.
Evaluators could extend that initiative by using the PSL to check for any
non-existent organization domain, without limiting the test to DMARC
participating registrars.

What about non-existent subdomains of existent organizations?    We
certainly could define a special test for this situation, but would it be
useful?

Can someone produce evidence of a spammer using an RFC53322.FROM address
for a non-existent subdomain of a registered domain, on at least one
message?    It would be interesting to also know the DMARC policy that
applied to the message, if available.

Doug Foster

---

From: Douglas Foster <[email-masked]>
Date: Mon, 14 Mar 2022 21:54:21 -0400

I asked this question because I have concluded that NP is only meaningful
for registrar policy records, to identify unregistered organizations.

For subdomains of registered organizations, SP=reject protects both
existent and non-existent domains.  This means that a NP policy would only
be relevant when sp=none and np=reject.    However, we can assume that a
malicious impersonator will make an intelligent choice among his options,
based on what he perceives as most likely to succeed.   That order of
priority would reasonably be:   organization, mail-sending subdomain,
non-mail but existent subdomain, and finally, non-existent subdomain.

At the same time, it is difficult to assume that any
theoretical expectation will remain valid across many spammers and billions
of messages.   In my limited study, I only see non-existent subdomains used
for legitimate mail.   Since no one has submitted evidence to the contrary,
I feel emboldened that my theory may indeed be correct.   If non-existent
subdomains of legitimate organizations are being impersonated on a scale
worthy of checking every message, I would expect that we could find
evidence of it.

Google and Microsoft have not weighed in, however.  I wish they would,

Doug

---

From: Alessandro Vesely <[email-masked]>
Date: Tue, 15 Mar 2022 13:10:23 +0100

On Tue 15/Mar/2022 02:54:21 +0100 Douglas Foster wrote:
> 
> For subdomains of registered organizations, SP=reject protects both existent 
> and non-existent domains.  This means that a NP policy would only be relevant 
> when sp=none and np=reject.

While that's true, someone may want to set, for example, sp=quarantine; np=reject;

While some organizations may use non-existing domains in From:, I wouldn't 
consider that to be a good practice.  Some other organizations may instead want 
to reject messages exhibiting a non-existent author domain, irrespective of 
authentication.  That was ADSP's nxdomain feature.

DMARC only allows to force non-existent domains into a policy.  At a first 
look, it would seem that an organization which wants to disown messages with 
non-existent author domain should be able to do it.  Unless their SPF record is 
wrong or their DKIM keys are stolen, it is enough to avoid to send messages 
with such From: lines.

> [...]
> 
> At the same time, it is difficult to assume that any theoretical expectation 
> will remain valid across many spammers and billions of messages.   In my 
> limited study, I only see non-existent subdomains used for legitimate mail.  
>   Since no one has submitted evidence to the contrary, I feel emboldened that 
> my theory may indeed be correct.   If non-existent subdomains of legitimate 
> organizations are being impersonated on a scale worthy of checking every 
> message, I would expect that we could find evidence of it.

What would be the advantage of impersonating a non-existent domain?

Anyway, it should be clear to the readers of RFC 9091 that np=reject implies 
that mail from t4x.gov.example is going to be accepted if it passes SPF or 
DKIM.  Or is there room for misunderstanding?

Best
Ale
--

---

From: Todd Herr <[email-masked]>
Date: Tue, 15 Mar 2022 10:52:06 -0400

> Google and Microsoft have not weighed in, however.  I wish they would,
Were I still in email operations, I would have little to no use for the np
tag, because a non-existent RFC5322.From domain would be reason to reject
the message, full stop, with no need to find a DMARC policy record
associated with it.

I always believed that if a message couldn't be replied to, it wasn't worth
accepting, and so non-existent domains in either RFC5321.From or
RFC5322.From were met with 5xx replies.
-- 

*Todd Herr * | Technical Director, Standards and Ecosystem
*e:* [email-masked]
*m:* 703.220.4153

This email and all data transmitted with it contains confidential and/or
proprietary information intended solely for the use of individual(s)
authorized to receive it. If you are not an intended and authorized
recipient you are hereby notified of any use, disclosure, copying or
distribution of the information included in this transmission is prohibited
and may be unlawful. Please immediately notify the sender by replying to
this email and then delete it from your system.

---

From: Scott Kitterman <[email-masked]>
Date: Tue, 15 Mar 2022 21:18:18 -0400

On Tuesday, March 15, 2022 8:10:23 AM EDT Alessandro Vesely wrote:
> > existent and non-existent domains.  This means that a NP policy would
> > only be relevant when sp=none and np=reject.
> 

Yes, I think that's exactly where it might be useful.  np=reject should be 
safe from a false positive perspective.  p= and sp= are much less so.

Scott K

---

From: Douglas Foster <[email-masked]>
Date: Tue, 15 Mar 2022 22:10:03 -0400

I started from the assumption that we would want to generalize NP into
organizations.   But after spending a lot of time on the subject for the
last 15 months, I am convinced that it is not needed.

Assume that a university or other organization wishes to use a "none"
policy to permit mailing lists and other legitimate impersonators.   The
best practice for this situation is to use domain-specific DMARC policies,
with p=none, for each domain that is used in a From address.  Then use
sp=reject (or quarantine) on the organization record.   This protects the
organization much better than NP ever could, and it eliminates any
arguments over the definition of non-existent.

On the one hand, I am arguing that the test is a waste of effort for the
evaluator, as the likelihood of finding a true positive is low while the
likelihood of false positives is high.   On the other hand, I am asserting
that it is a redundant and inferior for those organizations that do wish to
inhibit impersonation of non-mail and non-existent subdomains.

Doug

On Tue, Mar 15, 2022 at 8:10 AM Alessandro Vesely <[email-masked]> wrote:

> existent
> theoretical expectation
> _______________________________________________
> dmarc mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/dmarc
>

---

From: Douglas Foster <[email-masked]>
Date: Tue, 15 Mar 2022 22:16:58 -0400

Perhaps you can connect with a current client or former colleague who is
doing mail operations.   I am looking for at least one example of an
illegitimate message that uses a non-existent subdomain in the From
address.

To be clear, I am talking about messages where MAILFROM and FROM are not
aligned, because the message is sent by an email service provider.
 Aligned messages depend on the SPF result, and we all agree that it makes
sense to block when SPF=NXDOMAIN.

Doug

On Tue, Mar 15, 2022 at 10:53 AM Todd Herr <todd.herr=
[email-masked]> wrote:

> I always believed that if a message couldn't be replied to, it wasn't
> worth accepting, and so non-existent domains in either RFC5321.From or

---

From: Alessandro Vesely <[email-masked]>
Date: Thu, 17 Mar 2022 11:03:02 +0100

On Wed 16/Mar/2022 03:10:03 +0100 Douglas Foster wrote:
> organizations.   But after spending a lot of time on the subject for the last 
> 15 months, I am convinced that it is not needed.
> 
> Assume that a university or other organization wishes to use a "none" policy to 
> permit mailing lists and other legitimate impersonators.   The best practice 
> for this situation is to use domain-specific DMARC policies, with p=none, for 
> each domain that is used in a From address.  Then use sp=reject (or quarantine) 
> on the organization record.   This protects the organization much better than 
> NP ever could, and it eliminates any arguments over the definition of non-existent.

I agree that setting np= makes much more of a difference at a PSD than at 
regular organizations.  Still, a uniform specification of what filters have to 
do when they find that tag is simpler than otherwise.

> likelihood of false positives is high.   On the other hand, I am asserting that 
> it is a redundant and inferior for those organizations that do wish to 

Checking domain existence is useful anyway.  In my implementation it is part of 
the lookup call itself —if _dmarc.example.com exists, use the record; otherwise 
check if example.com exists at all.  Options to reject nxdomain are quite 
popular.  According to DMARC, one must still check that no aligned 
authentications hold, but the intended meaning is loud and clear.

Best
Ale
--