One Missing DMARC Tag, and Your Subdomains Can Lose Protection Under RFC 9989: When ‘psd’ Matters for Domains with Multi-Part Suffixes
A change in DMARC RFC 9989 now uses DNS Tree Walk instead of the Public Suffix List to identify Organizational Domains, potentially leaving subdomains unprotected if the 'psd' tag is missing.
Domain-based Message Authentication, Reporting, and Conformance (DMARC) RFC 9989 has introduced significant changes that could leave subdomains vulnerable to spoofing attacks. The new standard no longer relies on the Public Suffix List (PSL) to determine the Organizational Domain, instead using a DNS Tree Walk method. This shift means that domains without the 'psd' tag may have their boundaries incorrectly identified, potentially exposing subdomains to security risks.
How the Change Affects Domains
Under the previous RFC 7489 standard, the Public Suffix List helped clearly identify Organizational Domains. For example, with acmecorp.uk.com, uk.com would be recognized as a public suffix, making acmecorp.uk.com the Organizational Domain. Subdomains like it.acmecorp.uk.com would inherit the parent domain's DMARC policy if they had no record of their own.
However, RFC 9989 changes this approach. When a receiver encounters a subdomain without its own DMARC record, it performs a DNS Tree Walk up the hierarchy. If no 'psd' tag is found to stop the walk, the domain with the fewest labels that has a valid DMARC record becomes the Organizational Domain. This can result in completely different policy enforcement and report destinations.
Publishing 'psd=n' on your Organizational Domain is a low-risk way to make the boundary explicit and to limit the potential impact of records published higher in the tree.
Practical Implications
The practical consequences of this change can be significant. In the example provided, email from it.acmecorp.uk.com would be protected under RFC 7489 with a 'reject' policy, but under RFC 9989, it would inherit a 'none' policy from uk.com. This means email spoofing protection is effectively lost for the subdomain.
Additionally, aggregate (RUA) and forensic (RUF) reports would be sent to different addresses under the two standards. Under RFC 7489, reports go to Proofpoint, while under RFC 9989, they would be directed to CentralNic. This change in reporting destinations can complicate security monitoring and response.
The Solution
The fix is straightforward: organizations should add 'psd=n' to their DMARC record on the Organizational Domain. This explicitly declares the boundary and stops the DNS Tree Walk at the intended domain. For acmecorp.uk.com, adding 'psd=n' ensures that subdomains inherit the correct policy and report destinations under both standards.
Organizations should review their domains, especially those operating under multi-part suffixes like uk.com or co.uk. They need to check if their domain publishes a 'psd' tag, verify how subdomains rely on inherited policies, and ensure protection levels remain consistent across both DMARC standards.
Proofpoint Email Fraud Defense can help by analyzing domains under both RFC 7489 and RFC 9989, flagging cases where policies differ. This allows organizations to address potential issues before enforcement decisions create security gaps or operational surprises.
Related
