[Bug 1931029] [NEW] DMARC policy lookup violates RFC 7849.

Public bug reported: If DNS lookup of TXT records for a domain finds more than one v=DMARC1; record, it checks them all for policy = reject or quarantine. RFC 7849, Sec 6.6.3 item 5 says 5. If the remaining set contains multiple records or no records, policy discovery terminates and DMARC processing is not applied to this message. Thus, if we find multiple records we should assume no DMARC policy for this domain. ** Affects: mailman Importance: Low Status: Triaged -- You received this bug notification because you are a member of Mailman Coders, which is subscribed to GNU Mailman. https://bugs.launchpad.net/bugs/1931029 Title: DMARC policy lookup violates RFC 7849. To manage notifications about this bug go to: https://bugs.launchpad.net/mailman/+bug/1931029/+subscriptions

Here's the 5 items: https://datatracker.ietf.org/doc/html/rfc7489#section-6.6.3 If item 2 matches multiple v=DMARC1 records, and therefore item 3 is ignored, does item 5 even apply? -- You received this bug notification because you are a member of Mailman Coders, which is subscribed to GNU Mailman. https://bugs.launchpad.net/bugs/1931029 Title: DMARC policy lookup violates RFC 7849. To manage notifications about this bug go to: https://bugs.launchpad.net/mailman/+bug/1931029/+subscriptions

** Branch linked: lp:mailman/2.1 -- You received this bug notification because you are a member of Mailman Coders, which is subscribed to GNU Mailman. https://bugs.launchpad.net/bugs/1931029 Title: DMARC policy lookup violates RFC 7849. To manage notifications about this bug go to: https://bugs.launchpad.net/mailman/+bug/1931029/+subscriptions

** Changed in: mailman Status: Triaged => Fix Committed -- You received this bug notification because you are a member of Mailman Coders, which is subscribed to GNU Mailman. https://bugs.launchpad.net/bugs/1931029 Title: DMARC policy lookup violates RFC 7849. To manage notifications about this bug go to: https://bugs.launchpad.net/mailman/+bug/1931029/+subscriptions

We are concerned about a domain which has multiple v=DMARC1 TXT records. This is exactly the case that item 5 addresses. I.e. a domain which publishes multiple _dmarc TXT records with v=DMARC1 is treated as publishing no policy. -- You received this bug notification because you are a member of Mailman Coders, which is subscribed to GNU Mailman. https://bugs.launchpad.net/bugs/1931029 Title: DMARC policy lookup violates RFC 7849. To manage notifications about this bug go to: https://bugs.launchpad.net/mailman/+bug/1931029/+subscriptions

I guess RFC 7849 is just not clear to me that item #5 applies if item 3 contains more than 1 v=DMARC1 record. I say this because item 2 and 4 are identical, and to me that signifies that the items are a logical path, not a list of mandatory principals. That said, to err on the side of common sense, makes good sense, otherwise we'd have to choose which v=DMARC1 record to honor. -- You received this bug notification because you are a member of Mailman Coders, which is subscribed to GNU Mailman. https://bugs.launchpad.net/bugs/1931029 Title: DMARC policy lookup violates RFC 7849. To manage notifications about this bug go to: https://bugs.launchpad.net/mailman/+bug/1931029/+subscriptions

The items are steps in a process, not an unordered list of rules. Step 3 says if There are no DMARC records for the domain, check the organizational domain if different. Thus, step 4 is saying discard any non-v=DMARC1 records from the organizational domain. If the From: domain has any v=DMARC1 records, we skip step 3 and step 4 is moot because of step 2 and we get to step 5. If the From: domain has no v=DMARC1 records, we check the organizational domain if different per step 3 and then we get to steps 4 and 5 -- You received this bug notification because you are a member of Mailman Coders, which is subscribed to GNU Mailman. https://bugs.launchpad.net/bugs/1931029 Title: DMARC policy lookup violates RFC 7849. To manage notifications about this bug go to: https://bugs.launchpad.net/mailman/+bug/1931029/+subscriptions

RFCs should really include logic trees. Thanks Mark. -- You received this bug notification because you are a member of Mailman Coders, which is subscribed to GNU Mailman. https://bugs.launchpad.net/bugs/1931029 Title: DMARC policy lookup violates RFC 7849. To manage notifications about this bug go to: https://bugs.launchpad.net/mailman/+bug/1931029/+subscriptions

** Changed in: mailman Status: Fix Committed => Fix Released -- You received this bug notification because you are a member of Mailman Coders, which is subscribed to GNU Mailman. https://bugs.launchpad.net/bugs/1931029 Title: DMARC policy lookup violates RFC 7849. To manage notifications about this bug go to: https://bugs.launchpad.net/mailman/+bug/1931029/+subscriptions

Here's the 5 items: https://datatracker.ietf.org/doc/html/rfc7489#section-6.6.3 If item 2 matches multiple v=DMARC1 records, and therefore item 3 is ignored, does item 5 even apply? -- You received this bug notification because you are a member of Mailman Coders, which is subscribed to GNU Mailman. https://bugs.launchpad.net/bugs/1931029 Title: DMARC policy lookup violates RFC 7849. To manage notifications about this bug go to: https://bugs.launchpad.net/mailman/+bug/1931029/+subscriptions

** Branch linked: lp:mailman/2.1 -- You received this bug notification because you are a member of Mailman Coders, which is subscribed to GNU Mailman. https://bugs.launchpad.net/bugs/1931029 Title: DMARC policy lookup violates RFC 7849. To manage notifications about this bug go to: https://bugs.launchpad.net/mailman/+bug/1931029/+subscriptions

** Changed in: mailman Status: Triaged => Fix Committed -- You received this bug notification because you are a member of Mailman Coders, which is subscribed to GNU Mailman. https://bugs.launchpad.net/bugs/1931029 Title: DMARC policy lookup violates RFC 7849. To manage notifications about this bug go to: https://bugs.launchpad.net/mailman/+bug/1931029/+subscriptions

We are concerned about a domain which has multiple v=DMARC1 TXT records. This is exactly the case that item 5 addresses. I.e. a domain which publishes multiple _dmarc TXT records with v=DMARC1 is treated as publishing no policy. -- You received this bug notification because you are a member of Mailman Coders, which is subscribed to GNU Mailman. https://bugs.launchpad.net/bugs/1931029 Title: DMARC policy lookup violates RFC 7849. To manage notifications about this bug go to: https://bugs.launchpad.net/mailman/+bug/1931029/+subscriptions

I guess RFC 7849 is just not clear to me that item #5 applies if item 3 contains more than 1 v=DMARC1 record. I say this because item 2 and 4 are identical, and to me that signifies that the items are a logical path, not a list of mandatory principals. That said, to err on the side of common sense, makes good sense, otherwise we'd have to choose which v=DMARC1 record to honor. -- You received this bug notification because you are a member of Mailman Coders, which is subscribed to GNU Mailman. https://bugs.launchpad.net/bugs/1931029 Title: DMARC policy lookup violates RFC 7849. To manage notifications about this bug go to: https://bugs.launchpad.net/mailman/+bug/1931029/+subscriptions

The items are steps in a process, not an unordered list of rules. Step 3 says if There are no DMARC records for the domain, check the organizational domain if different. Thus, step 4 is saying discard any non-v=DMARC1 records from the organizational domain. If the From: domain has any v=DMARC1 records, we skip step 3 and step 4 is moot because of step 2 and we get to step 5. If the From: domain has no v=DMARC1 records, we check the organizational domain if different per step 3 and then we get to steps 4 and 5 -- You received this bug notification because you are a member of Mailman Coders, which is subscribed to GNU Mailman. https://bugs.launchpad.net/bugs/1931029 Title: DMARC policy lookup violates RFC 7849. To manage notifications about this bug go to: https://bugs.launchpad.net/mailman/+bug/1931029/+subscriptions

RFCs should really include logic trees. Thanks Mark. -- You received this bug notification because you are a member of Mailman Coders, which is subscribed to GNU Mailman. https://bugs.launchpad.net/bugs/1931029 Title: DMARC policy lookup violates RFC 7849. To manage notifications about this bug go to: https://bugs.launchpad.net/mailman/+bug/1931029/+subscriptions

** Changed in: mailman Status: Fix Committed => Fix Released -- You received this bug notification because you are a member of Mailman Coders, which is subscribed to GNU Mailman. https://bugs.launchpad.net/bugs/1931029 Title: DMARC policy lookup violates RFC 7849. To manage notifications about this bug go to: https://bugs.launchpad.net/mailman/+bug/1931029/+subscriptions
participants (3)
-
Jim Popovitch
-
Launchpad Bug Tracker
-
Mark Sapiro