| शीर्षक | The Trusted Domain Project OpenDMARC 1.4.2 Improper Authentication |
|---|
| विवरण | OpenDMARC 1.4.2 fails to convert internationalized domain names to their ASCII-compatible encoding before performing DMARC DNS lookups. When the domain in the visible `From:` address contains non-ASCII characters, OpenDMARC queries the raw Unicode name rather than its corresponding Punycode form. This may prevent an existing DMARC record from being found and cause OpenDMARC to return `dmarc=none`.
A remote unauthenticated attacker can exploit the issue by sending a forged message that claims to originate from an affected internationalized domain. The domain’s published `p=reject` or `p=quarantine` policy may consequently be ignored, allowing the message to bypass DMARC enforcement.
The issue also affects legitimate messages from internationalized domains, which may be incorrectly treated as having no DMARC policy. The behavior was reproduced with Latin, CJK, and Cyrillic domain names. |
|---|
| स्रोत | ⚠️ https://weitongli.com/share/opendmarc-ulabel-not-converted.html |
|---|
| उपयोगकर्ता | WeitongLi (UID 100239) |
|---|
| सबमिशन | 06/08/2026 12:50 PM (2 महीनों पहले) |
|---|
| संयम | 27/09/2026 09:55 AM (2 months later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 410841 [Trusted Domain Project OpenDMARC तक 1.4.2 Internationalized Domain Name opendmarc_policy.c opendmarc_policy_query_dmarc दूरस्थ कोड निष्पादन] |
|---|
| अंक | 20 |
|---|