Subject: [dmarc-ietf] Duplicate DMARC records and tags?

From: "John Levine" <[email-masked]>
Date: 19 Dec 2017 11:34:25 -0500

Dunno if this ever came up before.  What, if anything, does this mean?

_dmarc.example.com IN TXT "v=DMARC1; p=none"
_dmarc.example.com IN TXT "v=DMARC1; p=reject"

Looking through RFC 7489 I don't see anywhere that it says that more
than one record is forbidden.

For that matter, what if anything does this mean?

_dmarc.example.com IN TXT "v=DMARC1; p=none; p=reject"

In 7489 it says "DMARC records follow the extensible "tag-value"
syntax for DNS-based key records defined in DKIM [DKIM]."  I hope that
means they follow the DKIM rule that duplicate tags make the whole
record invalid, but that could be clearer.

R's,
John

PS: This came up when I was reading a guy's code where he carefully
looks at multiple records and somehow decides which one to believe.

---

From: "A. Schulze" <[email-masked]>
Date: Tue, 19 Dec 2017 18:50:13 +0100

> _dmarc.example.com IN TXT "v=DMARC1; p=reject"

Hello John,

https://tools.ietf.org/html/rfc7489#section-6.1 say
.. MUST concatenate these strings ...

One may read the example above like "v=DMARC1; p=none v=DMARC1; p=reject"
which is invalid thus must be ignored.

> than one record is forbidden.
yes, that would make it clear.
 
> _dmarc.example.com IN TXT "v=DMARC1; p=none; p=reject"
I would expect this to be valid but the result depend on the implemented parser
thus is not predictable. Could be p=none OR p=reject
 
> syntax for DNS-based key records defined in DKIM [DKIM]."
... or this...

> I hope that 
+1

Andreas

---

From: Zeke Hendrickson <[email-masked]>
Date: Tue, 19 Dec 2017 18:36:16 +0000

> than one record is forbidden.

Section 6.6.3, Policy Discovery.

"If the remaining set contains multiple records or no records,
policy discovery terminates and DMARC processing is not applied
to this message."

> record invalid, but that could be clearer.

The definition of tag-value syntax in [DKIM] section 3.2 says "Tags
with duplicate names MUST NOT occur within a single tag-list; if a tag
name does occur more than once, the entire tag-list is invalid." This
language could be repeated in the DMARC specification, but I don't see
any real reason to do so.

There's also a formal ABNF definition in 7489 section 6.4 which shows
that duplicate tags aren't allowed.

-- 
Zeke Hendrickson ([email-masked])
University of Michigan | Information and Technology Services 
Infrastructure | Application Operations | Application Delivery Support

---

From: "John Levine" <[email-masked]>
Date: 19 Dec 2017 13:49:15 -0500

>.. MUST concatenate these strings ...

Nope, that's talking about strings in a single TXT record.  These are separate TXT records.

>thus is not predictable. Could be p=none OR p=reject

I would prefer it's not valid.  If you can't figure out how to tell me
what your policy (or whatever is) I don't see why I should waste time
guessing.  It would also make the parsing rules compatible with DKIM.

R's,
John

---

From: "John Levine" <[email-masked]>
Date: 19 Dec 2017 13:54:40 -0500

>policy discovery terminates and DMARC processing is not applied

Oh, look at that.  Thanks.

>that duplicate tags aren't allowed.

I see that, but unfortunately the DMARC ABNF doesn't match the prose.
Section 6.3 says that unknown tags are ignored, but the ABNF syntax
doesn't allow them.

R's,
John

---

From: Hector Santos <[email-masked]>
Date: Sat, 23 Dec 2017 10:53:51 -0500

We should probably add a "v=counter" to the DMARC syntax.  But the 
odds are good that will screwed up too in duplicate records.

I think my software will read the first encounter of a DMARC text 
record and not seek for an "override" that could follow.  Not going to 
waste time to verify it.

We could add language in the future specification which suggest when 
duplicates exist, the harshest record (p=reject) will be used.

-- 
HLS

On 12/19/2017 1:54 PM, John Levine wrote:
> _______________________________________________
> dmarc mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/dmarc
>
>