> If we need some real world examples of this, got a few here: According to my measurements, 14M domain names out of 280M active domains have a CNAME at _dmarc. 871,245 has a valid DMARC record. Part of them, 7609 are a 1M top popular domain (tranco)
For those without DMARC records (I haven't digged a lot, just on the fly stats) it's either an "SPF" CNAME or wildcard TXT records Olivier De: "Mark Alley" <mark.alley=40tekmarc....@dmarc.ietf.org> À: "dmarc" <dmarc@ietf.org> Envoyé: Jeudi 14 Mars 2024 21:28:11 Objet: Re: [dmarc-ietf] DMARCbis WGLC Issue 136 - DMARC Records Can Be CNAMEs If we need some real world examples of this, got a few here: _dmarc.oit.alabama.gov _dmarc.tjx.com _dmarc.walmart.com _dmarc.novanta.com - Mark Alley On 3/14/2024 3:18 PM, Todd Herr wrote: Colleagues, There was a discussion among M3AAWG members on March 13 that centered on the question of whether DMARC records can be published in DNS as CNAMEs, e.g., BQ_BEGIN _ [ http://dmarc.example.com/ | dmarc.example.com ] IN CNAME _ [ http://dmarc.example.org/ | dmarc.example.org ] _ [ http://dmarc.example.org/ | dmarc.example.org ] IN TXT "v=DMARC1; p=reject; rua= [ mailto:dmarc-repo...@example.org | mailto:dmarc-repo...@example.org ] ;" Section 3.6.2 of RFC 1034 seems to indicate that it is permissible to publish DMARC records in this fashion, and describes the following scenario using an CNAME record and an A record: BQ_BEGIN For example, suppose a name server was processing a query with for USC- ISIC.ARPA, asking for type A information, and had the following resource records: USC-ISIC.ARPA IN CNAME [ http://c.isi.edu/ | C.ISI.EDU ] [ http://c.isi.edu/ | C.ISI.EDU ] IN A 10.0.0.52 Both of these RRs would be returned in the response to the type A query, while a type CNAME or * query should return just the CNAME. BQ_END I recommend adding a paragraph to DMARCbis, section 5.1 DMARC Policy Record at the end of that section that reads: BQ_BEGIN Per RFC 1034 section 3.6.2, a DMARC record MAY be published as a CNAME record, so long as the corresponding canonical name ultimately resolves to a TXT record so as to ensure that queries of type TXT return a DNS RR in the expected format. BQ_END Issue 136 has been opened for this. -- Todd Herr | Technical Director, Standards & Ecosystem Email: [ mailto:todd.h...@valimail.com | todd.h...@valimail.com ] Phone: 703-220-4153 This email and all data transmitted with it contains confidential and/or proprietary information intended solely for the use of individual(s) authorized to receive it. If you are not an intended and authorized recipient you are hereby notified of any use, disclosure, copying or distribution of the information included in this transmission is prohibited and may be unlawful. Please immediately notify the sender by replying to this email and then delete it from your system. _______________________________________________ dmarc mailing list [ mailto:dmarc@ietf.org | dmarc@ietf.org ] [ https://www.ietf.org/mailman/listinfo/dmarc | https://www.ietf.org/mailman/listinfo/dmarc ] BQ_END _______________________________________________ dmarc mailing list dmarc@ietf.org https://www.ietf.org/mailman/listinfo/dmarc
_______________________________________________ dmarc mailing list dmarc@ietf.org https://www.ietf.org/mailman/listinfo/dmarc
