Re: [exim/exim] DMARC always return norecord (Accept) for any police in subdomain bacause bug in opendmarc (Issue #3090)

Turns out that this issue is valid (could be reopened) and the bug is in exim non-experimental dmarc implementation.

opendmarc bug ( https://github.com/trusteddomainproject/OpenDMARC/issues/54 ) and a recent work to fix it ( https://github.com/thegushi/OpenDMARC/tree/fix/issue-54-subdomain-fallback ) is in opendmarc_policy_query_dmarc() which exim doesn't use:

src/src/miscmods/dmarc.c ( https://code.exim.org/exim/exim/src/commit/2045ec00087a44a1c012b31107258d1ed80eedfb/src/src/miscmods/dmarc.c#L308-L311 )
Lines 308 to 311 in 2045ec0 ( https://code.exim.org/exim/exim/src/commit/2045ec00087a44a1c012b31107258d1ed80eedfb )

/* Look up DMARC policy record in DNS. We do this explicitly, rather than letting the dmarc library do it with opendmarc_policy_query_dmarc(), so that our dns access path is used for debug tracing and for the testsuite diversion. */

The new EXPERIMENTAL_DMARC_NATIVE implementation doesn't have this problem.

Old non-experimental dmarc, part

libdm_status = (rr = dmarc_dns_lookup(dmarc_header_from_sender))
? opendmarc_policy_store_dmarc(dmarc_pctx, rr, dmarc_header_from_sender, NULL)
: DMARC_DNS_ERROR_NO_RECORD;

could also switch to new dmarc_get_dns_policy_record to solve this problem.

---
View it on Exim Forgejo ( https://code.exim.org/exim/exim/issues/3090#issuecomment-239619 ) or reply to this email directly.