[exim/exim] [Bug]: DMARC always return norecord (Accept) for any police in subdomain bacause bug in opendmarc (#3090) (Issue #3231)

What is the problem environment ?
---------------------------------

NOT REOPENED:

bes commented 2024-04-09:
- https://code.exim.org/exim/exim/issues/3090

Dmarc check should use organizational domain for query of dmarc record if no record on original domain found according to RFC.

Since Exim now ( 2024 ) relies on an external library for native processing, the result is incorrect.

I would like to draw attention to the problem in order to somehow influence its resolution. Perhaps you are the one who can help. Thanks.

--

Exim returns the following data for a given ( not given: ) message:
$h_from = [email protected]
$dmarc_status == norecord
$dmarc_used_domain == notify.vk.com
$dmarc_status_text == No DMARC record

Authentication-Results:
iprev = pass ( cs611100-22.vk.com ) smtp.remote-ip = 95.142.197.156 ;
spf = pass smtp.mailfrom = notify.vk.com ;
dkim = pass header.d = notify.vk.com header.s = mail header.a = rsa-sha256 ;
dmarc = none header.from = notify.vk.com

DMARC Record for notify.vk.com ( original domain )
no record

DMARC Record for vk.com ( organizational domain )
"v=DMARC1; p=reject; sp=reject; pct=100; rua=mailto:[email protected],mailto:[email protected]"

--

Organizational Domain:
- https://datatracker.ietf.org/doc/html/rfc7489#section-3.2

Bug in opendmarc:
- https://github.com/trusteddomainproject/OpenDMARC/issues/54

------------------------------

@Arek has commented 2026-05-13:

Turns out that this issue is valid ( could be reopened ) and the bug is in exim non-experimental dmarc implementation.

opendmarc bug ( https://github.com/trusteddomainproject/OpenDMARC/issues/54 ) and a recent work to fix it ( https://github.com/thegushi/OpenDMARC/tree/fix/issue-54-subdomain-fallback ) is in opendmarc_policy_query_dmarc () which exim doesn 't use:

src/src/miscmods/dmarc.c
Lines 308 to 311 in 2045ec0
 /* Look up DMARC policy record in DNS.  We do this explicitly, rather than
 letting the dmarc library do it with opendmarc_policy_query_dmarc(), so that
 our dns access path is used for debug tracing and for the testsuite
 diversion. */
The new EXPERIMENTAL_DMARC_NATIVE implementation doesn' t have this problem.

Old non-experimental dmarc, part

libdm_status = ( rr = dmarc_dns_lookup ( dmarc_header_from_sender ))
? opendmarc_policy_store_dmarc ( dmarc_pctx, rr, dmarc_header_from_sender, NULL )
: DMARC_DNS_ERROR_NO_RECORD ;

could also switch to new dmarc_get_dns_policy_record to solve this problem.

----------------

@Neustradamus has commented 2026-05-13:

@jgh, @HeikoSchlittermann, @toolsmith: Can you reopen this ticket?

@Arek has done a good comment : )

Can you look to solve it?

Thanks in advance.

What happened?
--------------

^

Relevant log output
-------------------

No response

---
View it on Exim Forgejo ( https://code.exim.org/exim/exim/issues/3231 ) or reply to this email directly.