Re: [dmarc-ietf] DMARCbis WGLC Issue 136 - DMARC Records Can Be CNAMEs

[Scott Kitterman <[e-mail]>]

On March 14, 2024 8:18:31 PM UTC, Todd Herr <todd.herr=[e-mail]> wrote:
>Colleagues,
>
>There was a discussion among M3AAWG members on March 13 that centered on
>the question of whether DMARC records can be published in DNS as CNAMEs,
>e.g.,
>
>_dmarc.example.com IN CNAME _dmarc.example.org
>
>_dmarc.example.org IN TXT "v=DMARC1; p=reject; rua=
>mailto:[e-mail] <[e-mail]>;"
>
>Section 3.6.2 of RFC 1034 seems to indicate that it is permissible to
>publish DMARC records in this fashion, and describes the following scenario
>using an CNAME record and an A record:
>
>For example, suppose a name server was processing a query with for USC-
>
>ISIC.ARPA, asking for type A information, and had the following resource
>
>records:
>
>USC-ISIC.ARPA   IN      CNAME   C.ISI.EDU
>
>C.ISI.EDU       IN      A       10.0.0.52
>
>Both of these RRs would be returned in the response to the type A query,
>
>while a type CNAME or * query should return just the CNAME.
>
>I recommend adding a paragraph to DMARCbis, section 5.1 DMARC Policy Record
>at the end of that section that reads:
>
>Per RFC 1034 section 3.6.2, a DMARC record MAY be published as a CNAME
>record, so long as the corresponding canonical name ultimately resolves to
>a TXT record so as to ensure that queries of type TXT return a DNS RR in
>the expected format.
>
>Issue 136 has been opened for this.
>

I think this is correct.  I think it's obviously enough correct that I'm surprised anyone was confused.

Do we know what the theory was that led people to think otherwise?

Seems to me we don't really need this, but maybe there's a reason.

Scott K