DNS tree walk
RFC 9989's method for finding a DMARC policy and organizational domain by querying _dmarc records up the domain name, at most eight queries.
What it means
When no DMARC record exists at the From domain itself, the receiver walks up the name, removing one label at a time and querying _dmarc at each step: _dmarc.a.mail.example.com, _dmarc.mail.example.com, _dmarc.example.com, _dmarc.com. Among the records found, the one with the fewest labels marks the organizational domain unless a psd= tag says otherwise, and its sp= (or np=) policy applies to the subdomain.
To prevent abuse with absurdly long names, the walk makes at most eight queries: names longer than eight labels jump straight to their last seven.
It replaces the public suffix list from RFC 7489. For a typical domain the result is unchanged, and owners of large estates can now set organizational boundaries with psd=n.
Example
_dmarc.a.mail.example.com -> _dmarc.mail.example.com -> _dmarc.example.com -> _dmarc.comRelated terms
On this site
Sources
What this definition rests on. The wording is ours; the facts are theirs.
- RFC 9989: Domain-based Message Authentication, Reporting, and Conformance (DMARC), section 4.10rfc-editor.org
- RFC 9989: Domain-based Message Authentication, Reporting, and Conformance (DMARC), section 4.10.1rfc-editor.org
- RFC 9989: Domain-based Message Authentication, Reporting, and Conformance (DMARC), section 4.10.2rfc-editor.org
All 432 terms in the glossaryThe wiki: blocklists and bounce codes