Webmasters Stack Exchange is a question and answer site for webmasters. It only takes a minute to sign up.
Sign up to join this community
We have SPF on approx 30 domains configured with a redirect like this:
v=spf1 redirect=_spf.example.com
This simplifies management since changes now only need to happen in one place to affect all of our domains which share the same policy.
Is there anything like this for DMARC? It would be nice to avoid having to create and maintain so many records which will inevitably be identical.
DMARC record is in fact a DNS TXT record on name _dmarc at apex of zone.
As such, you can completely use a CNAME there:
_dmarc.client1.example. CNAME _dmarc_for_clients.provider.example.
_dmarc.client2.example. CNAME _dmarc_for_clients.provider.example.
_dmarc.client3.example. CNAME _dmarc_for_clients.provider.example.
_dmarc.client42.example. CNAME _dmarc_for_clients.provider.example.
_dmarc_for_clients.provider.example. TXT "v=DMARC1; p=none"
(better not to use _dmarc for this need in the provider.example. zone as you might/need want, to setup DMARC as well for the name provider.example and the content could be completely different than the one needed for "clients" DMARC).
The same trick is used for DKIM records, but can not be used for SPF records which are in fact TXT records but at apex, and you can't have a CNAME record at apex (which is why basically you have redirect= inside the SPF pseudo record).
provider.example. does indeed have an identical record as all of the clients so am I correct in understanding that I just need to do _dmarc.client1.example. CNAME _dmarc.provider.example.? I guess I'll need Dmarc External Validation records for each client domain as well?
Dec 22, 2021 at 20:17
TXT record as destination, so _dmarc is fine as well if the content is right for your usecase. Note that the above is not specific to DMARC records, CNAME is a standard DNS feature you can use for almost anything (you can't for apex).
Dec 22, 2021 at 20:36
TXT records but you wouldn't get a lot by using CNAME here. Like with _dmarc_for_clients.provider.example. TXT "v=DMARC1; p=none; rua=mailto:a-reports@provider.example; ruf=mailto:f-reports@provider.example" you need a record of example.com._report._dmarc.provider.example. TXT "v=DMARC1" for each client zone (example.com). So just have multiple of those TXT records, they are all in provider.example zone, not in clients zones.
Dec 22, 2021 at 20:49