Technical conflict between DMARC's new "np" tag and DNSSEC compact denial of existence

Matteo

3d ago· 19 min readenInsight

Summary

The article explains a technical conflict between two recent internet standards: DMARC's new "np" tag (RFC 9989), designed to specify email authentication policy for non-existent subdomains, and DNSSEC's "Compact Denial of Existence" (RFC 9824). The clash arises because RFC 9824 can make subdomains appear "non-existent" from a DNS perspective even when they actually exist, causing DMARC's np policy to not be applied correctly. The article details which DNS providers and implementations are affected, explores the technical nuances of both specifications, and discusses potential workarounds and implications for email security.

Source

Hacker NewsTechnical conflict between DMARC's new "np" tag and DNSSEC compact denial of existencedmarcwise.io

Key quotes

· 3 pulled

We discovered that the definition of 'non-existent domain' contained in RFC 9989 clashes with another recent specification, RFC 9824, known as 'Compact Denial of Existence in DNSSEC', resulting in the np tag not always working as expected.

Although DNSSEC usage is far from being widespread, the issue affects all domains using DNSSEC with m

The recently updated DMARC specification, published as RFC 9989, introduces the new np tag. Its purpose is to specify the policy that receivers should apply when the sender domain is a non-existent subdomain of the domain where the DMARC record is published.

Snippet from the RSS feed

How DNSSEC compact denial can prevent DMARC's new np policy from being applied and which providers and implementations are affected.

You might also wanna read

How to stop business emails from hitting spam: A guide to SPF, DKIM, and DMARC authentication

This article explains how to prevent business emails from landing in spam folders by implementing three DNS-based email authentication proto

zdnet.com·1mo ago

Study reveals encrypted DNS still leaks metadata through plaintext headers, proposes header elision fix

Encrypted DNS protocols (DoT, DoH, DoQ) protect query contents from eavesdroppers, but plaintext packet headers still expose DNS traffic flo

helpnetsecurity.com·16d ago

DMARKOFF: DMARC Management Tool for Email Security and Deliverability

DMARKOFF is a DMARC management tool designed to simplify email security for both professionals and beginners. It allows users to manage mult

Product Hunt·3mo ago

Comments

No comments yet. Be the first.