Why DMARC's new "NP" tag can fail with DNSSEC

Post by amluto » Sun, Jul 05, 2026, 7:07 PM UTC

jeroenhd wrote: post #8

amluto wrote: post #3

While nothing good can be said about the design of DNSSEC here, it seems to me that the new np feature’s semantics are also misguided. I get it: if I own company.com and I’m not using foo.company.com, then maybe I should set np=reject on company.com’s DMARC rule so that no one can spoof email from it. But it seems odd that www.company.com should be considered present for this purpose even if it has no MX records. And…

> Why didn’t the DMARC spec say that a domain is “not present” if it lacks MX records? MX implies a domain can receive email, you don't need it to send email. A setup where company.example sends email from companymailings.example but sets a reply-to for support@company.example is perfectly valid (even if it's stupid and confusing). Plus there's that weird legacy behaviour of mail servers delivering to port 25 to the…

Post by woodruffw » Sun, Jul 05, 2026, 7:24 PM UTC

pocksuppet wrote: post #2

Summary: it's not DNSSEC itself, it's DNS providers like Cloudflare returning incorrect data to make responses shorter and avoid switching to TCP. A DNSSEC signature for "this domain doesn't exist" is much longer than a DNSSEC signature for "this domain exists, but doesn't have the type of record you asked for" so these providers choose to always return the latter type of answer. Since the server is telling you the d…

Post by formerly_proven » Sun, Jul 05, 2026, 9:24 PM UTC

woodruffw wrote: post #13

pocksuppet wrote: post #2

Summary: it's not DNSSEC itself, it's DNS providers like Cloudflare returning incorrect data to make responses shorter and avoid switching to TCP. A DNSSEC signature for "this domain doesn't exist" is much longer than a DNSSEC signature for "this domain exists, but doesn't have the type of record you asked for" so these providers choose to always return the latter type of answer. Since the server is telling you the d…

> A DNSSEC signature for "this domain doesn't exist" is much longer than a DNSSEC signature for "this domain exists, but doesn't have the type of record you asked for" so these providers choose to always return the latter type of answer This seems like a major design flaw in DNSSEC, if so. (I don’t have an opinion on whether Cloudflare or whoever else is a good participant in the DNS.)

Post by tptacek » Sun, Jul 05, 2026, 9:57 PM UTC

formerly_proven wrote: post #15

woodruffw wrote: post #13

Earlier quoted context omitted.

> A DNSSEC signature for "this domain doesn't exist" is much longer than a DNSSEC signature for "this domain exists, but doesn't have the type of record you asked for" so these providers choose to always return the latter type of answer This seems like a major design flaw in DNSSEC, if so. (I don’t have an opinion on whether Cloudflare or whoever else is a good participant in the DNS.)

Most of the time people are not asking for domains which don't resolve. Also, think about what DNSSEC is actually having to do when signing an NXDOMAIN. It needs to prove a negative with offline signing keys, DNSSEC does this by basically making a linked list of each zone and signing the links.

Post by teddyh » Sun, Jul 05, 2026, 10:43 PM UTC

pocksuppet wrote: post #18

teddyh wrote: post #16

Earlier quoted context omitted.

Cloudflare is well known for breaking DNS standards whenever they feel like it; they’re too big to ignore, so they get away with murder.

How did they get this way, anyway? Let's say that I want half the world to sign up for me to MITM their traffic. How would I achieve that?