CVE-2026-101280 in OpenDMARC
Summary
by MITRE • 09/29/2026
A vulnerability was detected in Trusted Domain Project OpenDMARC up to 1.4.2. Affected is the function opendmarc_policy_query_dmarc of the component Multi-Record Set Handler. The manipulation results in authentication bypass by spoofing. The attack can be executed remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/29/2026
The Trusted Domain Project OpenDMARC software, specifically versions up to 1.4.2, contains a critical security flaw within its Multi-Record Set Handler component that compromises the integrity of email authentication protocols. The vulnerability resides in the opendmarc_policy_query_dmarc function, which is responsible for querying and processing DMARC (Domain-based Message Authentication, Reporting, and Conformance) policies from DNS records. This specific implementation error allows an attacker to manipulate the handling of multiple DNS record sets associated with a domain's policy configuration. By exploiting this flaw, it becomes possible to bypass authentication checks that are designed to verify whether incoming emails originate from authorized sources for the purported sender domain.
The core technical issue stems from how the software processes and validates DMARC records when multiple entries exist or under specific query conditions. The manipulation of these record sets leads to a logic error where the system fails to correctly enforce the strictest policy defined by the domain owner, such as reject or quarantine actions for failed authentication. Instead, the flawed logic may default to a more permissive state or incorrectly validate spoofed messages as legitimate. This results in an authentication bypass that enables email spoofing attacks with high success rates against systems running vulnerable versions of OpenDMARC. The flaw is not limited by network boundaries and can be executed remotely by any actor who has access to the mail server infrastructure, allowing them to send forged emails that appear authentic to downstream recipients and security filters.
From a threat intelligence perspective, this vulnerability aligns with CWE-287, which describes Improper Authentication, as well as CWE-345 regarding Insufficient Verification of Data Authenticity. The attack vector is classified under MITRE ATT&CK technique T1566.001, specifically Spearphishing Attachment or Link variants that rely on spoofed sender addresses to evade detection and gain trust from victims. Because the exploit code has been made public, automated scanning tools and malicious actors can readily leverage this weakness without requiring specialized knowledge of the internal workings of OpenDMARC. This significantly lowers the barrier for entry in phishing campaigns aimed at stealing credentials, distributing malware, or conducting business email compromise schemes that rely on trusted sender identities to bypass spam filters.
The operational impact of this vulnerability is severe for organizations relying on DMARC enforcement to protect their domain reputation and secure user communications. If left unpatched, attackers can impersonate executives, partners, or the organization itself with impunity regarding authentication checks. This undermines the primary purpose of DMARC, which is to prevent email spoofing and phishing attacks that target end-users. Furthermore, because the vendor was contacted early in the disclosure process but failed to respond, there may be a delay in receiving official patches or updates from the Trusted Domain Project. Organizations must therefore take immediate proactive measures rather than waiting for an upstream fix.
Mitigation strategies should focus on both technical controls and procedural adjustments. The most effective remediation is to upgrade OpenDMARC to version 1.4.3 or later, where this logic error in the Multi-Record Set Handler has been corrected. In environments where immediate upgrading is not feasible due to operational constraints, administrators should consider implementing additional layers of email security such as SPF and DKIM validation at the network perimeter using dedicated appliances or cloud-based services that are less susceptible to this specific local implementation flaw. Additionally, monitoring for unusual patterns in DMARC reports can help identify if spoofing attempts are succeeding despite configured policies. It is also advisable to review DNS configurations to ensure they are robust against record manipulation and to enforce strict policy settings like p=reject where possible to minimize the impact of any authentication bypasses that might occur due to other potential weaknesses or misconfigurations.