Subject: [dmarc-ietf] Tree Walk + CNAME

From: "Brotman, Alex" <[email-masked]>
Date: Wed, 30 Mar 2022 12:49:18 +0000

>From section 4.6:

To illustrate, for a message with the arbitrary RFC5322.From domain
   of "a.b.c.d.e.mail.example.com", a full DNS Tree Walk would require
   the following five queries, in order to locate the policy or
   Organizational Domain:

   *  _dmarc.a.b.c.d.e.mail.example.com

   *  _dmarc.e.mail.example.com

   *  _dmarc.mail.example.com

   *  _dmarc.example.com

   *  _dmarc.com

What should the evaluator do if one of these results in a CNAME that either:

        a) points outside of the tree
        b) results in a loop pointing at a previously evaluated record

--
Alex Brotman
Sr. Engineer, Anti-Abuse & Messaging Policy
Comcast

---

From: Tim Wicinski <[email-masked]>
Date: Wed, 30 Mar 2022 09:28:42 -0400

>         a) points outside of the tree

I would say "Follow the CNAME" - consider LargeCo which points many DMARC
records
of domains in their portfolio to a record in their main domain.  Or
outsourced DMARC
to third party.

CNAME loops are usually detected in resolvers, but loops should return no
record found

tim

> _______________________________________________
> dmarc mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/dmarc
>

---

From: "John Levine" <[email-masked]>
Date: 30 Mar 2022 13:06:25 -0400

It appears that Tim Wicinski  <[email-masked]> said:
>outsourced DMARC to third party.
>

Agreed.  There is no need to treat CNAMEs here any differently than they
are treated anywhere else.

Like Tim, I can easily see practical uses for a CNAME pointing at a
shared DMARC record.

R's,
John