July 23, 20262 min read

My scanner told me to add a DNS record that wouldn’t have helped

Sentinel checked a subdomain for a DMARC record, didn’t find one, and told me exactly what to add. Following that advice would have accomplished nothing.

Sentinel checks email hygiene: SPF, DMARC, CAA. When I pointed it at sentinel.nyxoralabs.com, it reported no DMARC record and told me to fix it:

Add TXT at _dmarc.sentinel.nyxoralabs.com: "v=DMARC1; p=quarantine; ..."

That advice is wrong. If I had followed it, I’d have created a record that does nothing.

DMARC resolves at the organizational domain. nyxoralabs.com publishes p=quarantine, and that policy already covers every subdomain under it. There was nothing to fix. My tool had looked for a record at the exact host, not found one, and confidently told me to create something unnecessary.

The cause was a line I’d written earlier without thinking hard about it:

const domain = host.replace(/^www\./, "")

A www special case standing in for actual domain resolution. It handled the one subdomain I’d thought about and silently mishandled every other. Anyone scanning app.theirsite.com or blog.whatever.com would have gotten the same wrong answer and the same useless advice.

Fixing it properly meant admitting I couldn’t do it with string manipulation. You cannot find the boundary between a domain and its public suffix by counting labels. co.ke has two. github.io looks like a domain and isn’t. Getting that boundary wrong means querying the wrong domain, which means giving wrong advice again, just more elaborately.

So I took a dependency on the Public Suffix List, in a package I’d deliberately kept dependency-light. The argument that convinced me: I can’t hand-roll this honestly. A correct implementation is shipping and maintaining the suffix list. A hand-rolled subset goes stale silently, which is worse than a dependency, because at least a dependency announces its version.

While implementing subdomain policy inheritance, I found a second bug hiding behind the first. My tag parser used p=(\w+), which happily matches the p inside sp=. On any domain publishing a subdomain policy, I’d have read the wrong tag. Nobody was looking for that one either.

Wrong remediation is worse than silence. A tool that says nothing leaves you where you were. A tool that tells you to do the wrong thing moves you backwards and charges you for the privilege.

Interested in how this maps to your work?

If this kind of thinking fits a problem you're facing, let's talk it through.

Start a conversation EAT (UTC+3) · Typically responds within 24 hours