feat: add configurable walk-mode fallback and fix S 4.10.2 secondary alignment walk - #433
Merged
thegushi merged 1 commit intoJun 22, 2026
Conversation
…alignment walk opendmarc_policy_query_dmarc() and the new opendmarc_policy_check_alignment() dispatch both now consult a configurable walk_mode_fallback (DMARCbisWalkModeFallback in opendmarc.conf, -f in opendmarc-check) when the primary walk_mode strategy finds nothing. Any of PSL, RFC7489, or RFC9989 can serve as either the primary or fallback strategy; AUTO's existing PSL-then-RFC7489 combinator is unaffected. This matters because RFC 9989 deprecates PSL-based discovery but RFC 9990's discovery_method report field still has to be able to say "psl", so PSL has to stay a live, selectable strategy rather than something to delete. opendmarc_policy_check_alignment() also now performs the S 4.10.2 secondary alignment walk for the SPF/DKIM identifier (via the same walk_mode/fallback dispatch) instead of always reducing it through the PSL. Per direct correspondence with an RFC 9989 co-author (DMARCBIS-EDITOR-EMAIL.txt), reusing the single policy-discovery walk's org domain for every identifier, as before, was confirmed non-compliant rather than an optional reading of "might". DMARCBIS-WALK-NOTES.txt is reconciled against that correspondence: items 1, 4, and 5 are confirmed-correct/resolved with no code change, item 2 (above) is fixed, item 3 (multiple records at one level) was already fixed upstream, and a new item 7 documents the fallback feature. Also rewrites the live-DNS test suite (test_dns_lookup.c, test_spf.c, and new test_dmarc_walk.c) against gushi.org and its dmarcwalk.gushi.org fixture zone, replacing cases that depended on flaky third-party domains (bcx.com, facebook.com, agari.com, linkedin.com, csh.rit.edu, web.de, zalando-lounge.de) that nobody on this project controls.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
opendmarc_policy_query_dmarc()and the newopendmarc_policy_check_alignment()dispatch both now consult a configurablewalk_mode_fallback(DMARCbisWalkModeFallbackin opendmarc.conf,-fin opendmarc-check) when the primarywalk_modestrategy finds nothing. Any of PSL, RFC7489, or RFC9989 can serve as either the primary or fallback strategy;Auto's existing PSL-then-RFC7489 combinator is unaffected. This matters because RFC 9989 deprecates PSL-based discovery, but RFC 9990'sdiscovery_methodreport field still has to be able to say "psl", so PSL has to stay a live, selectable strategy.opendmarc_policy_check_alignment()now performs the S 4.10.2 secondary alignment walk for the SPF/DKIM identifier (via the same walk_mode/fallback dispatch) instead of always reducing it through the PSL. Per direct correspondence with an RFC 9989 co-author (DMARCBIS-EDITOR-EMAIL.txt), reusing the single policy-discovery walk's org domain for every identifier was confirmed non-compliant, not an optional reading of "might".DMARCBIS-WALK-NOTES.txtreconciled against that correspondence.test_dns_lookup.c,test_spf.c, newtest_dmarc_walk.c) rewritten against gushi.org / dmarcwalk.gushi.org, replacing cases that depended on flaky third-party domains nobody on this project controls.Test plan
make checkinlibopendmarc/-- 13/13 pass, including live-DNStest_dmarc_walkandtest_alignmentopendmarc-check -m psl -f rfc9989againstsub.nopsd.dmarcwalk.gushi.orgconfirms the fallback resolves where PSL alone failsmakeclean build oflibopendmarc,opendmarc, andopendmarc-check