DMARC subdomain delegation can help domain owners delegate subdomains or a top-level domain to a third party in a way that is DMARC compliant. This can help the owner’s domain name reflect in the sender’s Mail From: address.
When you delegate subdomains to a third-party DNS provider, the delegated organization becomes responsible for all DNS requests related to those subdomains. The delegated organization also has access to the subdomain’s MX records and TXT records, although they may not see these settings unless they are specifically configured to do so.
What is DNS zone delegation?
DNS delegation is the process by which a DNS server authorizes another DNS server to perform authoritative actions on behalf of that server. This allows for more efficient use of resources, especially when it comes to large-scale deployments.
For example, if your company has hundreds of servers across many different sites, you may want to delegate authority over those servers so that only one server is responsible for all records in a zone. This means that if one site goes down, other sites will still be able to resolve their name servers and access their data without issue.
Why is Zone delegation important or beneficial?
DNS zone delegation is an important part of your DNS infrastructure.
The DNS zone, or domain, is a collection of one or more DNS servers that are authoritative for a given domain. When you have a single DNS server, it’s called a primary DNS server. If you have multiple DNS servers, they’re all called secondary servers.
Zone delegation allows you to designate one or more name servers as secondary servers for the zone. The main goal of zone delegation as rightfully pointed out by Microsoft in their Zone delegation document, is to create redundancy in your DNS environment and allow you to add new name servers or change their configuration without disturbing the rest of your network.
What is Subdomain Delegation?
Subdomain delegation is a great way to delegate control of your domain to another person or entity. It’s also known as subdomain transfer, subdomain management, and subdomain proxy, and it can be used for many different purposes.
What does Subdomain Delegation mean for you?
When you delegate your domain, you’re essentially giving someone else permission to manage your domain on your behalf. This means that the person who receives your domain will be able to do whatever they want with it—whether that’s adding additional domains or changing DNS settings or even deleting the whole thing outright. It’s up to them!
How does Subdomain Delegation work?
Subdomains are just like regular domains: they have names and an IP address. The difference between a domain and a subdomain is that subdomains are under some other domain name (like “example.com”). To use them effectively, you need three things: a hostname that matches the original domain name, an IP address that matches what was assigned when the original domain was created (which may or may not be the same as the current one), and access rights given by whoever controls it.
Does DMARC Subdomain Delegation make your life easier?
There are several reasons as to why you might want to delegate your subdomains to a third-party provider. Given below are a few of them:
- You want your domain’s identity and name to reflect on the emails your third parties send out through their nameservers
- Your emails will be DMARC compliant as they will appear to be originating from your domain, and since you will be in full control of the subdomain you can make DNS changes at will
- All emails originating from nameservers with your delegated subdomains will pass SPF authorization and therefore DMARC
- This will ensure smooth and uninterrupted email delivery
How to delegate a subdomain to a third-party provider?
Note: For subdomain delegation, you will need to have a subdomain registered with your current DNS provider and the nameserver information of the third party.
- Login to your DNS registrar’s control panel
- In your DNS zone file, create a new NS (nameserver) record
- Enter your subdomain name in the Name field, your nameserver information followed by a dot (.) in the Value field, and a TTL of 1800 or 3600
- Save changes to your record and wait for your DNS to update the changes
You can follow the same procedure to delegate the subdomain to all the nameservers of your third-party provider.
Finally, to finish your subdomain delegation process you need to add your subdomain to the DNS zone file of your third-party provider, and you’re done!
DMARC Compliance and Your Third Parties
Making your third parties DMARC compliant is a good way to make sure you’re getting no false negatives. More often than not a legitimate email fails delivery on the receiver’s side and gets marked as spam due to misconfigured third-party source alignment for the DMARC protocol.
We have covered an entire blog on how to make your third-party vendors DMARC compliant.
For more information, contact us today and book a free consultation with a DMARC expert!
- PowerDMARC and Cipher Sign On a Memorandum of Understanding at Black Hat MEA Riyadh - November 28, 2022
- DMARC Tester – DMARC Testing Methods Explained - November 28, 2022
- Zero-day Vulnerability: Definition and Examples? - November 28, 2022
