RFC 9091 — PSD DMARC (superseded)

Experimental Domain-Based Message Authentication, Reporting, and Conformance (DMARC) Extension for Public Suffix Domains

Obsolete. Superseded by RFC 9989.
Status
Experimental
Published
2021

RFC 9091 is obsolete — its work was folded into RFC 9989 as the psd tag.

It solved a narrow but real problem: what protects a domain that has never published a DMARC record and never will, because nobody has registered it?

The problem it addressed

DMARC is published by domain owners. That leaves a gap at the top: an attacker can send as finance@some-unregistered-name.gov.example and there is no owner to publish a policy, because there is no owner.

RFC 9091 let the operator of a public suffix — a registry, or the manager of a government or academic namespace — publish a DMARC record covering names beneath it that have none of their own. One record from the registry protects every unregistered name in the zone.

Why it was experimental

The mechanism grants one party the ability to set policy for domains it does not own. That is a significant delegation of authority, and the experiment existed to find out whether receivers would honour it and whether it caused harm.

The answer was broadly positive, which is why the capability survived. But the mechanics changed: RFC 9091 relied on the same Organizational Domain lookup that RFC 7489 defined and RFC 9989 replaced with a DNS tree walk.

What to do about it

Nothing, unless you operate a public suffix. If you do, publish against RFC 9989 using the psd tag rather than implementing this document.

The page exists because RFC 9091 appears in a lot of DMARC writing from the early 2020s, and it is no longer the document to follow.

Who this ever applied to

Very few operators: registries, and the managers of namespaces like .gov or a country’s academic domain. If you run an ordinary domain, PSD DMARC never applied to you and the psd tag in RFC 9989 does not either — publishing psd=y on a domain that is not a public suffix is simply wrong.

It can, however, affect you as a recipient of policy: if your domain sits beneath a public suffix whose operator publishes one, a policy may apply to names in your zone that you did not publish yourself.

Read it: rfc-editor.org/rfc/rfc9091