| शीर्षक | The Trusted Domain Project OpenDMARC 1.4.2 Improper Authentication |
|---|
| विवरण | OpenDMARC 1.4.2 incorrectly processes ambiguous DMARC policy sets containing multiple valid `v=DMARC1` records at the same `_dmarc` DNS node. Instead of discarding the entire record set as required, `opendmarc_policy_query_dmarc()` selects the first record it can parse and applies that record’s policy.
The selected policy depends on the order in which the DNS records are returned. For example, when both `p=none` and `p=reject` records are published, OpenDMARC may apply `p=none` if that record appears first, even though the presence of multiple DMARC records should make the policy set unusable. It may consequently return `dmarc=pass` or `dmarc=fail` based on an arbitrarily selected record rather than reporting that no valid policy can be applied.
An attacker able to introduce a competing TXT record at the victim’s `_dmarc` node or influence the DNS response order may exploit this behavior to downgrade a strict `p=reject` or `p=quarantine` policy to `p=none`. Forged messages using the victim’s domain may then be accepted by OpenDMARC-based receivers.
OpenDMARC should count the DMARC records remaining after filtering and discard the complete set whenever more than one valid record remains, rather than selecting and enforcing the first record returned. |
|---|
| स्रोत | ⚠️ https://xuyongzhe-vt.github.io/share/opendmarc-multi-record-downgrade.html |
|---|
| उपयोगकर्ता | yongzhe_xu (UID 100420) |
|---|
| सबमिशन | 07/08/2026 06:13 AM (2 महीनों पहले) |
|---|
| संयम | 28/09/2026 01:53 PM (2 months later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 411037 [Trusted Domain Project OpenDMARC तक 1.4.2 Multi-Record Set opendmarc_policy_query_dmarc कमजोर प्रमाणीकरण] |
|---|
| अंक | 20 |
|---|