Re: [dmarc-ietf] DMARCbis WGLC Issue 136 - DMARC Records Can Be CNAMEs

[OLIVIER HUREAU <[e-mail]>]

> If we need some real world examples of this, got a few here: 

According to my measurements, 14M domain names out of 280M active domains have a CNAME at _dmarc. 
871,245 has a valid DMARC record. Part of them, 7609 are a 1M top popular domain (tranco) 

For those without DMARC records (I haven't digged a lot, just on the fly stats) it's either an "SPF" CNAME or wildcard TXT records 

Olivier 

De: "Mark Alley" <mark.alley=[e-mail]> 
À: "dmarc" <[e-mail]> 
Envoyé: Jeudi 14 Mars 2024 21:28:11 
Objet: Re: [dmarc-ietf] DMARCbis WGLC Issue 136 - DMARC Records Can Be CNAMEs 



If we need some real world examples of this, got a few here: 

_dmarc.oit.alabama.gov 

_dmarc.tjx.com 

_dmarc.walmart.com 

_dmarc.novanta.com 
- Mark Alley 
On 3/14/2024 3:18 PM, Todd Herr wrote: 



Colleagues, 

There was a discussion among M3AAWG members on March 13 that centered on the question of whether DMARC records can be published in DNS as CNAMEs, e.g., 


BQ_BEGIN



_ [ http://dmarc.example.com/ | dmarc.example.com ] IN CNAME _ [ http://dmarc.example.org/ | dmarc.example.org ] 


_ [ http://dmarc.example.org/ | dmarc.example.org ] IN TXT "v=DMARC1; p=reject; rua= [ mailto:[e-mail] | mailto:[e-mail] ] ;" 





Section 3.6.2 of RFC 1034 seems to indicate that it is permissible to publish DMARC records in this fashion, and describes the following scenario using an CNAME record and an A record: 

BQ_BEGIN



For example, suppose a name server was processing a query with for USC- 


ISIC.ARPA, asking for type A information, and had the following resource 


records: 
USC-ISIC.ARPA   IN      CNAME [ http://c.isi.edu/ | C.ISI.EDU ] 
[ http://c.isi.edu/ | C.ISI.EDU ] IN      A       10.0.0.52 


Both of these RRs would be returned in the response to the type A query, 


while a type CNAME or * query should return just the CNAME. 

BQ_END



I recommend adding a paragraph to DMARCbis, section 5.1 DMARC Policy Record at the end of that section that reads: 

BQ_BEGIN



Per RFC 1034 section 3.6.2, a DMARC record MAY be published as a CNAME record, so long as the corresponding canonical name ultimately resolves to a TXT record so as to ensure that queries of type TXT return a DNS RR in the expected format. 

BQ_END

Issue 136 has been opened for this. 

-- 


Todd Herr | Technical Director, Standards & Ecosystem 
Email: [ mailto:[e-mail] | [e-mail] ] 
Phone: [phone] 


This email and all data transmitted with it contains confidential and/or proprietary information intended solely for the use of individual(s) authorized to receive it. If you are not an intended and authorized recipient you are hereby notified of any use, disclosure, copying or distribution of the information included in this transmission is prohibited and may be unlawful. Please immediately notify the sender by replying to this email and then delete it from your system. 

_______________________________________________
dmarc mailing list [ mailto:[e-mail] | [e-mail] ] [ https://www.ietf.org/mailman/listinfo/dmarc | https://www.ietf.org/mailman/listinfo/dmarc ] 

BQ_END

_______________________________________________ 
dmarc mailing list 
[e-mail] 
https://www.ietf.org/mailman/listinfo/dmarc