Home / user-180142

Braiam's questions

Martin Hope
Braiam
Asked: 2017-02-19 05:55:51 +0800 CST
  • -1

According to DMARC FAQ it's possible to have a single policy for multiple domains, and that all tools refer to this main policy:

How can I put DMARC records on many domains at once?

Some organizations may have registered many domain names for brand protection or other reasons. Managing all these domains is often challenging. Here is one possible way to put a DMARC record on all of them and easily control changes. You can use CNAME for the DMARC record and wildcard for the reporting.

_dmarc.example.com. IN TXT "v=DMARC1; p=none; rua=mailto:[email protected]"
_dmarc.example.net. IN CNAME _dmarc.example.com.

*._report._dmarc.example.com IN TXT "v=DMARC1"

Now there is only one DMARC record to manage. The report record is needed because you are asking for the aggregate report for example.net to be sent to another domain, example.com. Therefore this domain must indicate it is willing to receive such reports. With a wildcard, this domain indicates it is willing to receive reports about any domain. Set email filtering correctly for the mailbox [email protected] to avoid receiving reports you are not interested in.

For the aliased domain managed by Cloudflare:

;; CNAME Records
_dmarc.lists.example.net.   300 IN  CNAME   _dmarc.example.org.
_dmarc.example.net. 300 IN  CNAME   _dmarc.example.org.

For the domain that actually sends the mails and will be main policy:

;; TXT Records
_dmarc.example.org. 300 IN  TXT "v=DMARC1\; p=quarantine\; pct=1\; rua=mailto:[email protected]"
*._report._dmarc.example.org.   300 IN  TXT "v=DMARC1"

As seen I use dmarcian to handle dmarc reports. When I tested it couldn't find dmarc records for example.net domain, nor could other tools like Mbox Proofpoint. I would trust that the FAQ isn't lying (DNS behavior tell us it should be possible) but the specification doesn't explicitly mention this characteristic, so what's going on?

domain-name-system cloudflare dmarc
Martin Hope
Braiam
Asked: 2017-02-15 08:14:48 +0800 CST
  • 0

I'm painfully aware that using the ssl equivalent of:

server {
        listen 80;
        return 444;
}

kills all ssl exchanges, meanwhile, without something of the sort, nginx happily serve a random virtual host. Instead of trying to gracefully end the connection, I would like nginx to simply terminate the tcp connection. If I'm not mistaken, the ssl has to send the domain as part of the negotiation. I would like nginx to simply close the connection if it can't find a virtual host that matches the domain the client is asking for. How could I do this? Should I use a middleman?

If a correct domain is give:

1. C: (TLS Handshake) Hello, I support XYZ Encryption, and I am trying to connect to 'site.example.com'.
2. S: (TLS Handshake) Hi There, Here is my Public Certificate, and lets use this encryption algorithm.

Now an invalid one:

1. C: (TLS Handshake) Hello, I support XYZ Encryption, and I am trying to connect to 'invalid-domain.com'.
2. S: CLOSE
nginx