Subject: [dmarc-ietf] Using CNAME records to DMARC templates causes issues

From: jbouwh <[email-masked]>
Date: Tue, 02 Mar 2021 08:49:27 +0100

Hi all,
I am new to this list, and will give a short introduction to myself.
I work for the Dutch government as an IT architect. One of my goals is 
improving mail security.
As Dutch government we commit to comply to SPF, DKIM, DMARC, DANE and 
IPv6 standards.
With this we are challenged to keep the technical environment 
manageable.
Some of our government IT partners use CNAME records to refer to DMARC 
templates, and we are planning to use the same technique. Using 
templates makes it more easy to maintain DNS records.

For private purposes I am running my own mail server using opendmarc 
together with postfix, amavis, spamassasin, opendkim and 
postfix-policyd-spf.
During testing mail policies that where published using a CNAME, I 
noticed opendmarc is not handling the published policies, but is acting 
as if no policy was published. To address this issue I have submitted an 
issue to the opendmarc project.

https://github.com/trusteddomainproject/OpenDMARC/issues/103

My questions are:
-	Is it a common practice to use CNAME DNS record to reference DMARC 
templates?
-	Is it a known issue opendmarc does not process the published policies 
when they are published using a CNAME? If this is caused due to a 
software bug, this could be a serious security issue.

Regards,
Jan

---

From: Tõnu Tammer <[email-masked]>
Date: Tue, 2 Mar 2021 10:13:13 +0200

Hi Jan,

We have noticed similar issue with CNAME that is used by some of the 
vendors. However, we have not fully concluded if this is the issue of 
software as RFC stipulates that TXT records should be used.

https://tools.ietf.org/html/rfc7489#section-6.1

KR,

Tonu
CERT-EE

On 02.03.2021 09:49, jbouwh wrote:
> With this we are challenged to keep the technical environment manageable.
> noticed opendmarc is not handling the published policies, but is 
> acting as if no policy was published. To address this issue I have 
> submitted an issue to the opendmarc project.
>
> -    Is it a common practice to use CNAME DNS record to reference 
> DMARC templates?
> -    Is it a known issue opendmarc does not process the published 
> policies when they are published using a CNAME? If this is caused due 
> to a software bug, this could be a serious security issue.
>
> Regards,
> Jan
>
> _______________________________________________
> dmarc mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/dmarc

---

From: Henning Krause <[email-masked]>
Date: Tue, 2 Mar 2021 10:38:15 +0000

Hi,

true, the RFC states nothing about CNAMEs. It would be great to have that feature, though. Not only would this make the handling with many domains easier, but it would also allow a domain owner to outsource the management of DMARC to a hosting provider.

Kind regards,
Henning

> -----Original Message-----
> From: dmarc [mailto:[email-masked]] On Behalf Of Tõnu Tammer
> Sent: Dienstag, 2. März 2021 09:13
> To: [email-masked]
> Subject: Re: [dmarc-ietf] Using CNAME records to DMARC templates causes
> issues
> 
> Hi Jan,
> 
> https://henningkrause-
> eu.cloud.nospamproxy.com/link?id=BAgAAABHZ9Ttc2FwX4YAAAAQ0QbPZM
> d8IglxIBHZeYT_CtxhFEYvYRHhRnnk6DY35fNGAvZWHzvf-sQp2-
> Z4HsyMK2rPPj5C0aQElSQEnqgX7oG0mxxCzUmIl5aK0Vo0LYfCwxfRpzRhbvTx
> R7Aq4olfez2_wwONaujm-aezcoVcUIgZKHsmTlj2iKcfJO0qgBhJ63lLIA2
> 
> KR,
> 
> Tonu
> CERT-EE
>

---

From: Tim Wicinski <[email-masked]>
Date: Tue, 2 Mar 2021 06:11:47 -0500

Using a CNAME at  _dmarc.example should not be a problem, as long as
the CNAME target is a TXT record.  The DNS resolver functions should
should handle this seamlessly. This does sound like a vendor software
problem.

I am aware of DKIM records being deployed using CNAMEs pointing to a TXT
record target.
Has anyone seen the above error condition when testing DKIM records?

This definitely sounds like an issue with the software.

Nobody should shy away from publishing DMARC records that are CNAMEs to
DMARC
TXT records elsewhere. Using this design should be strongly encouraged.

tim

---

From: Douglas Foster <[email-masked]>
Date: Tue, 2 Mar 2021 06:51:17 -0500

Because CNAME usage was not mentioned in the previous DMARC document,
existing implementations may not have tested this configuration.   For the
policy publishing organization, this increases the possibility that some
recipients may treat the mail as not protected by DMARC.     As with any
deployment issue, the publishing organization has no reliable way to know
if the deployment of DMARC implementations with full CNAME support is
"essentially complete".  This uncertainty may be acceptable for some
organizations, but may be an obstacle for others, depending on their
motivations for implementing DMARC.

On the implementation side, the use of CNAME will introduce the
possibility of referral errors, which may or may not require mentioning in
the DMARC specification, since such issues have probably been addressed in
core DNS documents.   The issues that come to mind are:
CNAME referrals to non-existent names
Nested CNAME referrals (what depth is allowed?)
CNAME referrals that produce loops or excessive nesting depth.

DF

---

From: jbouwh <[email-masked]>
Date: Tue, 02 Mar 2021 13:09:25 +0100

L.S.
I would suggest update the DMARC standard make explicit how CNAME can be 
used or not.
Beside of that, the opendmarc software should address this as a bug in 
some way. Their opendmarc-check tool shows the correct policy that fails 
from the opendmarc service when used on a CNAME-ed DMARC policy.
The usecase I have seen failing only was one CNAME level deep.
The failing mechanism in opendmarc for fetching the DMARC policy now 
seems to leed leads to a 'none' policy.

Regards, Jan

Douglas Foster schreef op 2021-03-02 12:51:
> existing implementations may not have tested this configuration.   For
> the policy publishing organization, this increases the possibility
> that some recipients may treat the mail as not protected by DMARC.
> As with any deployment issue, the publishing organization has no
> reliable way to know if the deployment of DMARC implementations with
> full CNAME support is "essentially complete".  This uncertainty may be
> acceptable for some organizations, but may be an obstacle for others,
> depending on their motivations for implementing DMARC.
> 
> possibility of referral errors, which may or may not require
> mentioning in the DMARC specification, since such issues have probably
> been addressed in core DNS documents.   The issues that come to mind
> are:
>> I am aware of DKIM records being deployed using CNAMEs pointing to a
>> TXT record target.
>> Nobody should shy away from publishing DMARC records that are CNAMEs
>> to DMARC
>> tim _______________________________________________
>> dmarc mailing list
>> [email-masked]

---

From: Tõnu Tammer <[email-masked]>
Date: Tue, 2 Mar 2021 15:46:55 +0200

Current RFC does not mention CNAME and while, in theory, it should work, 
we have seen that it does not always do so. Therefore, I would also 
support explicitly mentioning CNAME in the RFC.

It is true that people can make mistakes but people already make typos 
and other mistakes but having CNAME added to RFC would help in case of 
some service providers are managing the DMARC via CNAME.

Tõnu
CERT-EE

On 02.03.2021 14:09, jbouwh wrote:
> L.S.
> I would suggest update the DMARC standard make explicit how CNAME can 
> be used or not.
> some way. Their opendmarc-check tool shows the correct policy that 
> fails from the opendmarc service when used on a CNAME-ed DMARC policy.

-- 
Tõnu Tammer
CERT-EE juht / Executive Director of CERT-EE
Riigi Infosüsteemi Amet / Estonian Information System Authority

Email: [email-masked]
Mobile: +372 53 284 054
Web: https://cert.ee

PGP:0x77A8997 / 9477 6B86 6A1E 849B C456  46D6 9CA8 9E41 77A8 997B

---

From: Seth Blank <[email-masked]>
Date: Tue, 2 Mar 2021 06:15:03 -0800

I’ve seen CNAME for DMARC deployed frequently and without issue.

This should be completely transparent to most implementations, as whether
the record is TXT or CNAME, the same answer should be retrieved from DNS.

Let’s not conflate implementation issues with problems in the spec,
although I agree the spec should make it clear that CNAME is usable here.

I’ll poke the opendmarc bug on a different list.

Seth, with multiple hats

-- 

*Seth Blank* | VP, Product
*e:* [email-masked]
*p:* 415.273.8818

`

This email and all data transmitted with it contains confidential and/or
proprietary information intended solely for the use of individual(s)
authorized to receive it. If you are not an intended and authorized
recipient you are hereby notified of any use, disclosure, copying or
distribution of the information included in this transmission is prohibited
and may be unlawful. Please immediately notify the sender by replying to
this email and then delete it from your system.

---

From: "Murray S. Kucherawy" <[email-masked]>
Date: Wed, 3 Mar 2021 09:28:25 -0800

> CNAME referrals that produce loops or excessive nesting depth.

I don't understand why we need to say anything special about CNAMEs here.
They are processed by the resolver as they would be for any other
application.

If there's a bug in opendmarc, that's a different question that has nothing
to do with the output of the working group.

-MSK

---

From: Tim Wicinski <[email-masked]>
Date: Wed, 3 Mar 2021 13:00:42 -0500

I have to overly agree with Murray here.

Where there should be discussions around using CNAMEs for DMARC records
would be in
a DMARC best practice document.

I spent some time yesterday digging through all the DKIM RFCs, and there is
no place
where there are discussions about using CNAMEs (Except in passing in
RFC5016).
And the use of using CNAMEs for DKIM TXT records is not just widely used,
but is
consider a best practice by M3AAWG:
https://www.m3aawg.org/sites/default/files/m3aawg-dkim-key-rotation-bp-2019-03.pdf

As for those few folks who have seen DNS issues around using CNAMEs, I
really want to
hear from you off list.  Tracking down esoteric DNS error operational
behavior is
something I am slightly obsessive about.   "I'm from the DNS, and I'm here
to help"

thanks
tim

On Wed, Mar 3, 2021 at 12:28 PM Murray S. Kucherawy <[email-masked]>
wrote:

> If there's a bug in opendmarc, that's a different question that has
> nothing to do with the output of the working group.
>
> -MSK
>

---

From: "John Levine" <[email-masked]>
Date: 3 Mar 2021 13:15:04 -0500

In article <CADyWQ+HY_3qT6zb1Gr4tQYVZcpDSQ=[email-masked]> you write:

>As for those few folks who have seen DNS issues around using CNAMEs, I really want to
>hear from you off list.  Tracking down esoteric DNS error operational behavior is
>something I am slightly obsessive about.   "I'm from the DNS, and I'm here to help"

Yup.  I am thinking back to the 1990s when qmail put in a hack that used ANY queries
to cirumvent a CNAME big in some version of bind, and it took us a decade to get rid
of it.

CNAMEs work fine, and if they appear not to, your DNS library is 99.9% likely to be the problem.

-- 
Regards,
John Levine, [email-masked], Primary Perpetrator of "The Internet for Dummies",
Please consider the environment before reading this e-mail. https://jl.ly