Aggregate reports include wrong published domain

[dlucredativ]

I have seen aggregate reports that I believe to originate from OpenDMARC (they have a boundary="report_section").

Those reports contain a feedback.policy_published.domain entry of the form subdomain.example.com, with example.com being the organizational domain. However, there is no DNS-Record _dmarc.subdomain.example.com, the reports are instead triggered by _dmarc.example.com.
According to RFC7489 appendix C, the domain field of PolicyPublishedType is

The domain at which the DMARC record was found

so the value should actually be example.com.

[thegushi]

Could I ask you to send me some of these privately (github at gushi dot org) so I can take a look? Confidentially, of course, it won't make it onto github.

[thegushi]

Confirmed this in the code. The milter already does the right thing -- opendmarc_policy_fetch_utilized_domain() captures the domain where the DMARC record was actually found and writes it to the history file as pdomain, which opendmarc-import stores in messages.policy_domain.

The bug is in opendmarc-reports: when generating the <policy_published> block, it uses the from domain (the domain being reported on) rather than looking up policy_domain from the messages table. For a subdomain inheriting policy from the organizational domain, these differ.

The fix adds a query to look up the actual policy domain from messages for the reporting window and uses that in <domain>. It falls back to the from domain if no rows are found. No schema changes required.

A fix is queued for inclusion in the next reporting fixes release.