3 ms·
While nothing good can be said about the design of DNSSEC here, it seems to me that the new np feature’s semantics are also misguided. I get it: if I own compan
by amluto 3mo ago
While nothing good can be said about the design of DNSSEC here, it seems to me that the new np feature’s semantics are also misguided. I get it: if I own company.com and I’m not using foo.company.com, then maybe I should set np=reject on company.com’s DMARC rule so that no one can spoof email from it.
But it seems odd that www.company.com should be considered present for this purpose even if it has no MX records. And if I want to send from noreply.company.com, then setting some unrelated DNS record type there to prevent it from being not “not present” seems like a giant kludge.
And lots of domains have subdomains that are intended for some non-email purpose (api.company.com or whatever), and those shouldn’t be allowed without further policy. Nor should (technically invalid for SMTP but maybe allowed anyway) delights like _dmarc.company.com itself.
Why didn’t the DMARC spec say that a domain is “not present” if it lacks MX records?
- gjvc 3mo agohttps://news.ycombinator.com/item?id=291110 https://news.ycombinator.com/item?id=291110
- jeroenhd 3mo ago> Why didn’t the DMARC spec say that a domain is “not present” if it lacks MX records? MX implies a domain can receive email, you don't need it to send email. A setup where company.example sends email from companymailings.example but sets a reply-to for support@company.example is perfectly valid (even if it's stupid and confusing). Plus there's that weird legacy behaviour of mail servers delivering to port 25 to the IP in the A record if MX records are missing.
- amluto 3mo ago> A setup where company.example sends email from companymailings.example but sets a reply-to for support@company.example is perfectly valid So shouldn’t this be done explicitly by setting a policy at _dmarc.companymailings.example instead of implicitly by setting at otherwise entirely useless record (of type A? some unused TXT variant?) at companymailings.example?
- 2000UltraDeluxe 3mo agoNo. MX tells a sender where the mail goes. DMARC allows the recipient to verify the adress in the From header. Neither has anything to do with the fact whether a server sends emails or not.
- sealedmailuk 3mo ago[dead]
- toast0 3mo ago> Why didn’t the DMARC spec say that a domain is “not present” if it lacks MX records? That doesn't match the SMTP spec, RFC 5321 says > If an empty list of MXs is returned, the address is treated as if it was associated with an implicit MX RR, with a preference of 0, pointing to that host. https://www.rfc-editor.org/rfc/rfc5321.html#section-5 https://www.rfc-editor.org/rfc/rfc5321.html#section-5
- em-bee 3mo agoDMARC demands extra DNS entries that SMTP doesn't need, so there is no reason why DMARC could not also demand an explicit MX record even if plain SMPT doesn't
- sealedmailuk 3mo ago[dead]
- ZWoz 3mo agoDMARC isn't part of SMTP. Now, steelman argument is that DMARC is used together with SMTP, so it should be somewhat compatible to work in practice. But in this case there isn't fundamental conflict breaking SMTP.