IETF Logo Mail Archive

[dmarc-ietf] Re: Compatibility of "np" tag with RFC 9824 (Compact Denial of Existence in DNSSEC)

Alessandro Vesely <vesely@tana.it> Wed, 10 June 2026 10:19 UTC

Return-Path: <vesely@tana.it>
X-Original-To: dmarc@mail2.ietf.org
Delivered-To: dmarc@mail2.ietf.org
Received: from localhost (localhost [127.0.0.1]) by mail2.ietf.org (Postfix) with ESMTP id ED7EBFE99B15 for <dmarc@mail2.ietf.org>; Wed, 10 Jun 2026 03:19:40 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=ietf.org; s=ietf1; t=1781086780; bh=XphnfZOhJWe+yH1q0N7KS/QOHvw2vxEooCeOBwSpG2E=; h=Date:Subject:To:References:From:In-Reply-To; b=L9AyvGmSmRFriyMFKZkp/nsP0ZG6PoYd/cCpg2x95JlRN0dcF3r0gnCC6Fcdd5m2Q 1bCsLMWvghKIHZ3s+pRGd5LUKZD8qPRxbtyyGIE5yjROnJGsVc/gx6dQaiASLB3m5v wJcxChM570xqKU1krIn5FGFYPlnuhec8oS7LGNjo=
X-Virus-Scanned: amavisd-new at ietf.org
X-Spam-Flag: NO
X-Spam-Score: -2.099
X-Spam-Level:
X-Spam-Status: No, score=-2.099 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_VALIDITY_CERTIFIED_BLOCKED=0.001, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Authentication-Results: mail2.ietf.org (amavisd-new); dkim=pass (1152-bit key) header.d=tana.it
Received: from mail2.ietf.org ([166.84.6.31]) by localhost (mail2.ietf.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id DyBA1KSNRqmv for <dmarc@mail2.ietf.org>; Wed, 10 Jun 2026 03:19:39 -0700 (PDT)
Received: from wmail.tana.it (wmail.tana.it [94.198.96.74]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange ECDHE (P-256) server-signature ECDSA (P-256) server-digest SHA256) (No client certificate requested) by mail2.ietf.org (Postfix) with ESMTPS id E4C54FE99B07 for <dmarc@ietf.org>; Wed, 10 Jun 2026 03:19:38 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=tana.it; s=delta; t=1781086777; bh=MOJsAF2sQQoDGSLW4VRzJFnXlaMQAqPgO+Eftv3q7Pw=; h=Date:Subject:To:References:From:In-Reply-To; b=BkkmnUQOrN0uOYTYDs/4Qj+7SzEhq+ntZyK0Kt0Bdly+6cYheGKkY1nxzU66iwwus bT6EhLRWYLuSDGp+Vf9PRAWse9IRiRb9NSB/tD1GfoDtcMawnYs+X5EliQ4E8YfqFV aVga7omryAP/0PNmus2MvNG4bahUyK0lNS2rHne4jZsaHECO5ujaJMxXRf+LC
Original-Subject: Re: [dmarc-ietf] Re: Compatibility of "np" tag with RFC 9824 (Compact Denial of Existence in DNSSEC)
Author: Alessandro Vesely <vesely@tana.it>
Received: from [172.25.197.87] (pcale.tana [::ffff:172.25.197.87]) (AUTH: CRAM-MD5 uXDGrn@SYT0/k, TLS: TLS1.3,128bits,ECDHE_RSA_AES_128_GCM_SHA256) by wmail.tana.it with ESMTPSA id 00000000005DC07B.000000006A293A39.0000451D; Wed, 10 Jun 2026 12:19:37 +0200
Message-ID: <5dcb706f-40d6-4294-9bec-89d1132e1ae3@tana.it>
Date: Wed, 10 Jun 2026 12:18:28 +0200
MIME-Version: 1.0
User-Agent: Mozilla Thunderbird
To: dmarc@ietf.org
References: <1b793e75-1409-4344-bf3b-0f59bacb2591@dmarcwise.io> <CAK2M3FCv+imtUnFOcLyKhssGXE41mgLv0heDWVwuFqtgBXdDew@mail.gmail.com> <e061c544-9403-45f2-873f-2e394a26a8d6@dmarcwise.io> <CAK2M3FAGv5cEY-dNw2S27gcHgSYT7npwgQVfxqGm4F7XYr4RSA@mail.gmail.com> <28bd1401-48a8-455a-9c04-7a3e893cf911@dmarcwise.io>
Authentication-Results: tana.it; auth=pass (details omitted)
From: Alessandro Vesely <vesely@tana.it>
Content-Language: en-US, it-IT
In-Reply-To: <28bd1401-48a8-455a-9c04-7a3e893cf911@dmarcwise.io>
Content-Type: text/plain; charset="UTF-8"; format="flowed"
Content-Transfer-Encoding: 7bit
Message-ID-Hash: 22JWGUXSUAOOHCVZLCTTYEXD33PUGQEP
X-Message-ID-Hash: 22JWGUXSUAOOHCVZLCTTYEXD33PUGQEP
X-MailFrom: vesely@tana.it
X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; header-match-dmarc.ietf.org-0; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header
X-Mailman-Version: 3.3.9rc6
Precedence: list
Subject: [dmarc-ietf] Re: Compatibility of "np" tag with RFC 9824 (Compact Denial of Existence in DNSSEC)
List-Id: "Domain-based Message Authentication, Reporting, and Compliance (DMARC)" <dmarc.ietf.org>
Archived-At: <https://mailarchive.ietf.org/arch/msg/dmarc/tuUh50taVqDzmHJ0KQ6rz7g45D4>
List-Archive: <https://mailarchive.ietf.org/arch/browse/dmarc>
List-Help: <mailto:dmarc-request@ietf.org?subject=help>
List-Owner: <mailto:dmarc-owner@ietf.org>
List-Post: <mailto:dmarc@ietf.org>
List-Subscribe: <mailto:dmarc-join@ietf.org>
List-Unsubscribe: <mailto:dmarc-leave@ietf.org>

On Tue 09/Jun/2026 21:06:03 +0200 Matteo Contrini wrote:
> That's how it works. For example:
> 
> - "dig developers.cloudflare.com MX +dnssec" shows that the NXNAME bit is not set because the domain exists.
> - "dig doesnotexist.cloudflare.com MX +dnssec" shows that the NXNAME bit is set because the domain does not exist.


IMHO, it's reasonable to add an errata to signal RFC 9824's existence and its 
effects on "np".  DMARC libraries may want to add the  Compact Answers OK (CO) 
flag to their queries, if the DNS library they use doesn't add it for them. 
That way, they'll get NXDOMAIN for non-existing domains.


Best
Ale
--

v2.46.0 | Report a Bug | By Email | System Status