domainaware / checkdmarc

A parser for SPF and DMARC DNS records
https://domainaware.github.io/checkdmarc
Apache License 2.0
246 stars 76 forks source link

warnings given on subdomains when reports are sent to organizational domain #10

Closed kjellchr closed 6 years ago

kjellchr commented 6 years ago
$ checkdmarc random.test.nhn.no
{
  "domain": "random.test.nhn.no",
  "spf": {
    "record": null,
    "valid": false,
    "error": "The domain random.test.nhn.no does not exist"
  },
  "dmarc": {
    "record": "v=DMARC1; p=none; rua=mailto:dmarc@nhn.no,mailto:dsm1h58m@ag.dmarcian.com; ruf=mailto:dmarcfull@nhn.no",
    "valid": true,
    "tsgs": {
      "v": {
        "value": "DMARC1",
        "explicit": true
      },
      "p": {
        "value": "none",
        "explicit": true
      },
      "rua": {
        "value": "mailto:dmarc@nhn.no,mailto:dsm1h58m@ag.dmarcian.com",
        "explicit": true
      },
      "ruf": {
        "value": "mailto:dmarcfull@nhn.no",
        "explicit": true
      },
(...)    
    },
    "warnings": [
      "Unable to validate random.test.nhn.no as an external sender for nhn.no: https://tools.ietf.org/html/rfc7489#section-7.1",
      "Unable to validate random.test.nhn.no as an external sender for nhn.no: https://tools.ietf.org/html/rfc7489#section-7.1"
    ]
  }
}

the warnings here are incorrect, as the organizational domain is nhn.no in both cases, and as listed in https://tools.ietf.org/html/rfc7489#section-7.1 :

   When a Mail Receiver discovers a DMARC policy in the DNS, and the
   Organizational Domain at which that record was discovered is not
   identical to the Organizational Domain of the host part of the
   authority component of a [URI] specified in the "rua" or "ruf" tag,
   the following verification steps are to be taken: