trailofbits
Case sensitiveness of version tag
Hi!
At work, I recently found a case where a DMARC record started with V=DMARC (capitalized v) instead of the more traditional v=DMARC. The former does not pass the current parser but apparently it should...?
The string “DMARC” is the only portion of the DMARC policy record that is case-sensitive, but it is not uncommon for people reading the specification to miss this fact. For best results, keep everything but “DMARC” lower case. (source)
It seems to be a small-enough bug to fix, but I'd like to know if you'd accept a PR for this issue. It would make the parser a bit more lenient, but also more spec-compliant. 😄
My read of the spec is that it's non-conformant; from RFC 7489 7.1:
In particular, the "v=DMARC1" tag is mandatory and MUST appear first in the list. Discard any that do not pass this test.
The RFC doesn't mention case insensitivity in this context, so my interpretation is that V=DMARC1 is 100% invalid and whatever server sent you that needs to update their records 🙂
With that being said, I think it'd be okay to make our parser more lenient if there's evidence that other widely adopted DMARC parsers are similarly lenient with this tag. If not then I think it's on that DMARC user to fix their entry.
