feat: add DMARCbis walk mode selection (RFC 9989 DNS Tree Walk)#430
Merged
thegushi merged 5 commits intoJun 21, 2026
Merged
Conversation
Refactor organizational domain discovery in libopendmarc into three
independently-callable walk strategies selectable at runtime via a new
DMARCbisWalkMode config option in opendmarc.conf.
- Add OPENDMARC_WALK_MODE_{AUTO,PSL,RFC7489,RFC9989} constants and walk_mode
field to OPENDMARC_LIB_T (dmarc.h.in)
- Add np= and psd= fields to DMARC_POLICY_T (opendmarc_internal.h)
- Extract dmarc_query_at(), psd_from_record(), query_dmarc_psl(),
query_dmarc_rfc7489_walk(), and query_dmarc_rfc9989_walk() from the
monolithic opendmarc_policy_query_dmarc(); dispatch by walk_mode
- Parse np= and psd= tags in opendmarc_policy_parse_dmarc()
- Wire DMARCbisWalkMode config key in opendmarc-config.h and opendmarc.c
- Document DMARCbisWalkMode in opendmarc.conf.sample and opendmarc.conf.5.in
- Add DMARCBIS-WALK-NOTES.txt capturing RFC 9989 open questions
AUTO mode preserves pre-DMARCbis behaviour (PSL if configured, label-strip
walk otherwise). No #ifdef compile-time gates.
…C 9989 S 4.10) dmarc_dns_get_record() previously returned the first "v=DMARC" TXT record found without checking for duplicates, silently violating the rule in both RFCs that multiple valid DMARC records at a single DNS name must all be discarded. - Scan all TXT records in the answer before returning; count those containing "v=DMARC". Return the record only when exactly one is found; return NULL/NO_DATA when zero or more than one are found. - Fix the fake DNS table path with the same count-before-returning logic. - Fix a pre-existing cursor advancement bug: the non-DMARC TXT branch was adding the already-consumed dn_expand name length a second time. Replace ad-hoc cur_ptr arithmetic with an rdata_end pointer set from RDLENGTH. - Add a fake-DNS test case: two v=DMARC1 entries for the same name must yield DMARC_DNS_ERROR_NO_RECORD.
…survey
For every rua= and ruf= URI whose destination domain differs from the
policy domain, query {policy-domain}._report._dmarc.{dest-domain} and
flag any that lack a v=DMARC1 consent record.
- New output columns rua_bad / ruf_bad: comma-separated list of external
URIs missing consent, or "-" if none problematic
- Async consent-check phase after the main DNS loop, at full concurrency
- Same-domain and subdomain URIs skipped (no check needed)
- Output buffered until consent phase completes; then written in one pass
- Summary log gains rua_ext_bad / ruf_ext_bad columns for trend tracking
Casts strdup() results back to u_char * for organizational_domain assignments in query_dmarc_psl, query_dmarc_rfc7489_walk, and query_dmarc_rfc9989_walk, matching the cast convention applied elsewhere in trusteddomainproject#426.
Documents that AUTO mode's fallback to the RFC 7489 walk applies whenever the PSL path fails, not only when no PSL boundary was found, which is a deliberate broadening versus pre-refactor behavior.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
See DMARCBIS-WALK-NOTES.txt for open RFC 9989 interpretation questions and the rationale behind AUTO mode's fallback scope (item 6).
Test plan