DMARC CNAME Configuration for EasyDMARC - Does not resolve

What is the name of the domain?

_dmarc.earl.health

What is the error number?

N/A

What is the error message?

N/A

What is the issue you’re encountering

CNAME configuration for EASYDMARC DMARC service

What steps have you taken to resolve the issue?

Hi,
The National Cyber Security Centre (NCSC) are discontinuing their DMARC reporting service. So, we’ve moved to EasyDMARC.

Previously, the NCSC had us use TXT records for the DNS entries. EasyDMARC want us to use CNAMES. The instructions are here (How to Setup Managed DMARC | EasyDMARC) and the images clearly use Cloudflare as the DNS instructions. I’m sure I’ve followed the instructions exactly. The target they have asked me to use is “_dmarc.earl_health._d.easydmarc.pro” - which I’ve copied and pasted from their email instructions.

They have double checked the target. I have double checked my config. But the DMARC does not work. They are telling me it is a problem with Cloudflare. I can’t see one. It seems super simple to set up. I wondered if someone here might be able to spot something I’ve done wrong!

Attached image is a composition of the instructions, my config, and the error.

Incidentally, I’ve waited a week for DNS propogation etc!

Thank you

What feature, service or problem is this related to?

DNS records

What are the steps to reproduce the issue?

As above

Screenshot of the error

It looks like you are trying to manage a zone called easydmarc.com, not earl.health.

1 Like

_dmarc returns directly as a TXT record…

dig +short _dmarc.earl.health txt
"v=DMARC1;p=none;rua=mailto:[email protected];ruf=mailto:[email protected];fo=1;"

https://cf.sjr.dev/tools/check?5d9cde6fac14471da71c77b3668677b4#dns-mail

Check that you haven’t enabled CNAME flattening globally here…
https://dash.cloudflare.com/?to=/:account/:zone/dns/records

If so, you’ll need to turn it off and individually flatten any CNAMEs you want flattened in each DNS record.

2 Likes

Since my post earlier, I’ve had further info from EasyDMARC, with txt record instructions. So, _dmarc now does work, using a text record. I’d still be interested in figuring out why the CNAME didn’t work though.

I’ve checked that " CNAME flattening for all CNAME records" is set to OFF. And, as you can see, the CNAME _dmarc was also set to not flatten.

The top image, was the demo instructions, which were using easydmarc.com as an example. In the middle image, is my screenshot, which has the correct domain, I think?!

1 Like

Sorry, I missed that part. The above zone actually still exists, which had me confused for a moment.

That will be hard to figure out now that you’ve changed the config.

1 Like

This topic was automatically closed 15 days after the last reply. New replies are no longer allowed.