| عنوان | The Trusted Domain Project OpenDMARC 1.4.2 Improper Authentication |
|---|
| الوصف | OpenDMARC 1.4.2 incorrectly expands the SPF `%{l}` macro to the fixed string `postmaster` when using its built-in SPF checker, `SPFSelfValidate`. For a non-null envelope sender, `%{l}` should expand to the local part of the checked identity. OpenDMARC instead applies the special null-sender substitution to every message.
As a result, an SPF mechanism such as `exists:%{l}._spf.%{d}` performs the DNS lookup for `postmaster._spf.example.com` rather than the actual sender-specific name, such as `alice._spf.example.com`. The domain portion is expanded correctly, but the authorization decision is made using the wrong local identity.
A remote unauthenticated attacker can exploit this behavior against a domain that uses `%{l}` for per-user SPF authorization. If the fixed `postmaster` lookup succeeds while the actual sender-specific lookup would fail, OpenDMARC may return `spf=pass`. When the SPF domain aligns with the visible `From:` domain, the incorrect result may also produce `dmarc=pass`, allowing forged mail to bypass a published `p=reject` policy.
The issue can also cause legitimate messages to fail because OpenDMARC never consults the sender’s actual per-user SPF entry. OpenDMARC should derive `%{l}` and `%{s}` from the checked identity and use `postmaster` only when the reverse path is null. |
|---|
| المصدر | ⚠️ https://xuyongzhe-vt.github.io/share/opendmarc-spf-postmaster-macro.html |
|---|
| المستخدم | yongzhe_xu (UID 100420) |
|---|
| ارسال | 07/08/2026 06:15 AM (2 أشهر منذ) |
|---|
| الاعتدال | 28/09/2026 01:53 PM (2 months later) |
|---|
| الحالة | تمت الموافقة |
|---|
| إدخال VulDB | 411038 [Trusted Domain Project OpenDMARC حتى 1.4.2 SPF Macro opendmarc_spf.c opendmarc_sp2_find_mailfrom_domain توثيق ضعيف] |
|---|
| النقاط | 20 |
|---|