0

We have SPF on approx 30 domains configured with a redirect like this:

v=spf1 redirect=_spf.example.com

This simplifies management since changes now only need to happen in one place to affect all of our domains which share the same policy.

Is there anything like this for DMARC? It would be nice to avoid having to create and maintain so many records which will inevitably be identical.

1 Answer 1

1

DMARC record is in fact a DNS TXT record on name _dmarc at apex of zone.

As such, you can completely use a CNAME there:

_dmarc.client1.example. CNAME _dmarc_for_clients.provider.example.
_dmarc.client2.example. CNAME _dmarc_for_clients.provider.example.
_dmarc.client3.example. CNAME _dmarc_for_clients.provider.example.
_dmarc.client42.example. CNAME _dmarc_for_clients.provider.example.
_dmarc_for_clients.provider.example. TXT "v=DMARC1; p=none"

(better not to use _dmarc for this need in the provider.example. zone as you might/need want, to setup DMARC as well for the name provider.example and the content could be completely different than the one needed for "clients" DMARC).

The same trick is used for DKIM records, but can not be used for SPF records which are in fact TXT records but at apex, and you can't have a CNAME record at apex (which is why basically you have redirect= inside the SPF pseudo record).

4
  • that's awesome. in my case provider.example. does indeed have an identical record as all of the clients so am I correct in understanding that I just need to do _dmarc.client1.example. CNAME _dmarc.provider.example.? I guess I'll need Dmarc External Validation records for each client domain as well? Commented Dec 22, 2021 at 20:17
  • 1
    You can use any existing TXT record as destination, so _dmarc is fine as well if the content is right for your usecase. Note that the above is not specific to DMARC records, CNAME is a standard DNS feature you can use for almost anything (you can't for apex). Commented Dec 22, 2021 at 20:36
  • 1
    DMARC External Validation records are again TXT records but you wouldn't get a lot by using CNAME here. Like with _dmarc_for_clients.provider.example. TXT "v=DMARC1; p=none; rua=mailto:[email protected]; ruf=mailto:[email protected]" you need a record of example.com._report._dmarc.provider.example. TXT "v=DMARC1" for each client zone (example.com). So just have multiple of those TXT records, they are all in provider.example zone, not in clients zones. Commented Dec 22, 2021 at 20:49
  • Thanks @Patrick - that's pretty much what I figured but I really appreciate you verifying it. Commented Dec 22, 2021 at 20:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.