News for hackers. Stuff that matters.

A comment on How to prevent email spoofing, using an unholy combination of silly standards. Parent comment

Re:How to prevent email spoofing, using an unholy combinatio... by teddyh on Monday August 16, 2021 @03:23AM (#28195737)
DKIM and DMARC can be CNAMEs, but not SPF, since SPF lives at the apex domain name, which can not be a CNAME. (Of course, if your email address is on a subdomain, then that can be a CNAME. But then the MX records will also have to be moved to the CNAME target.)
[ Parent | on HN ]
Re:How to prevent email spoofing, using an unholy combinatio... by marcbradshaw on Monday August 16, 2021 @03:32AM (#28195780)
Not even then, RFCs state that a CNAME may not exist with any other RR type, and your apex domain needs at least SOA and NS records. A CNAME on the apex domain may kind of work, but it will present as broken in subtle and unexpected ways.
[ Parent | on HN ]
Re:How to prevent email spoofing, using an unholy combinatio... by teddyh on Monday August 16, 2021 @04:13AM (#28195987)
Um, what? I think you misunderstood me. Or you are unaware that DMARC and DKIM records live on subdomains.
[ Parent | on HN ]