We’re launching Lyria 3.5 in Google Flow Music, with advances across musicality, lyrics, vocals, and creative control
deepmind.google·6d ago
AI Engineering
Hacker News·Jul 5·5 min read
Why DMARC's new "NP" tag can fail with DNSSEC
TL;DR
A conflict exists between the new 'np' tag in DMARC, which addresses non-existent subdomains, and DNSSEC's definition of non-existence. The 'np' tag was introduced in RFC 9989 to guide email receivers on handling these subdomains.
✦ Why It Matters
Understanding this conflict helps engineers ensure proper email handling in domains using DNSSEC.
Key Takeaways
- Review DMARC implementation for potential DNSSEC conflicts.
- Stay updated on IETF discussions regarding DMARC and DNSSEC.
- Test email handling for non-existent subdomains in your domain.
- Consider alternative configurations if using DNSSEC with DMARC.
Full Summary
DMARC, or Domain-based Message Authentication, Reporting & Conformance, recently updated its specification with RFC 9989, introducing the 'np' tag for non-existent subdomain policy. This tag aims to instruct email receivers on how to treat subdomains that do not exist under the main domain.
However, a clash arises with RFC 9824, which defines 'Compact Denial of Existence in DNSSEC', leading to potential failures in the 'np' tag's functionality. Despite the acknowledgment of this issue by the IETF working group, no resolution has been reached.
The implications are significant, as many domains using DNSSEC with major providers may face unexpected behavior in email handling. This situation highlights the need for further collaboration between standards organizations to ensure compatibility.
Engineers and researchers should be aware of these nuances when implementing DMARC and DNSSEC.