Subject: [dmarc-ietf] Exception management

From: Douglas Foster <[email-masked]>
Date: Fri, 25 Mar 2022 06:51:30 -0400

Exception management is straightforward when using the PSL.   The system
administrator simply maintains an errata file that is used to add entries
to, or remove entries from the downloaded PSL file.   If the PSL does not
list "onmicrosoft.com", but I want it treated as a registrar, I simply
insert that name into the local data structure which represents my copy of
the PSL.

But how does the system administrator apply corrections to the Tree Walk?
 I am having trouble envisioning any suitable solution.   The partial ideas
in my head seem unsustainably complex to develop, administer, and query.

Doug Foster

---

From: "Murray S. Kucherawy" <[email-masked]>
Date: Fri, 25 Mar 2022 07:39:44 -0700

> in my head seem unsustainably complex to develop, administer, and query.

Were I implementing such a thing, I'd probably have a list of overrides
that map names to DMARC records.  For every name in the tree walk I'm going
to try, I'd check that list first for an override, and use that if one is
found.

Such a list would not be likely to change often, if I even need it, so I
would not need to load it from disk very often, and could just keep it
cached.

-MSK

---

From: "John Levine" <[email-masked]>
Date: 25 Mar 2022 11:21:58 -0400

>to try, I'd check that list first for an override, and use that if one is

As we all know, some organizations have an unfortunate habit of publishing
DMARC policies that don't match their sending policies because "it's more
secure."

If you have a set of override DMARC records, you can use them to fix
broken policies with p= and broken authority boundaries with psd=, using
one simple hack.

R's,
John