| Title | The Trusted Domain Project OpenDMARC 1.4.2 Improper Authentication |
|---|
| Description | OpenDMARC 1.4.2 incorrectly calculates the organizational domain for names covered by wildcard rules in the Public Suffix List. When a wildcard rule such as `*.compute.amazonaws.com` applies, the label matched by the wildcard forms part of the public suffix. OpenDMARC fails to include that label when calculating the registrable domain, producing an organizational domain that is one label too broad.
As a result, separate hostnames under the same wildcard tenant name may be treated as belonging to the same organization. Under relaxed DKIM alignment, a message signed by one such hostname can therefore align with a different hostname used in the visible `From:` address, even though the two names are distinct registrable domains.
A remote attacker who controls a sibling hostname under the same wildcard tenant can publish a DKIM key, sign a message with that hostname, and forge the victim’s address in the `From:` header. OpenDMARC may return `dmarc=pass` despite the victim publishing a strict `p=reject` policy.
The issue breaks the tenant isolation that wildcard Public Suffix List rules are intended to provide and can lead to DMARC authentication bypass and email impersonation. The organizational-domain calculation should include the label consumed by the wildcard rule before selecting the registrable domain. |
|---|
| Source | ⚠️ https://xuyongzhe-vt.github.io/share/opendmarc-psl-wildcard-orgdomain.html |
|---|
| User | yongzhe_xu (UID 100420) |
|---|
| Submission | 08/07/2026 05:54 (2 months ago) |
|---|
| Moderation | 09/28/2026 13:53 (2 months later) |
|---|
| Status | Accepted |
|---|
| VulDB entry | 411035 [Trusted Domain Project OpenDMARC up to 1.4.2 PSL Wildcard opendmarc_tld.c : opendmarc_get_tld origin validation] |
|---|
| Points | 20 |
|---|