DMARC - Revision history

Woozle at 20:27, 21 December 2022

2022-12-21T20:27:04Z

← Older revision		Revision as of 20:27, 21 December 2022
Line 7:		Line 7:
	[[category:anti-spam]]		[[category:anti-spam]]
	[[category:SMTP]]		[[category:SMTP]]
			[[category:email/server/configuration]]
	</hide>		</hide>
	{{fmt/title\|DMARC: Domain-based Message Authentication, Reporting and Conformance}}		{{fmt/title\|DMARC: Domain-based Message Authentication, Reporting and Conformance}}

Woozle at 19:31, 20 August 2022

2022-08-20T19:31:58Z

← Older revision		Revision as of 19:31, 20 August 2022
Line 107:		Line 107:
	* [https://datatracker.ietf.org/doc/html/rfc7489 RFC 7489]		* [https://datatracker.ietf.org/doc/html/rfc7489 RFC 7489]
	* [https://mxtoolbox.com/problem/dmarc MxToolBox Problem Knowledge Base]		* [https://mxtoolbox.com/problem/dmarc MxToolBox Problem Knowledge Base]
			===Posts===
			* '''2014-04-07''' [https://mailarchive.ietf.org/arch/msg/ietf/J-IsfA0Lb-6T_NeMD1ENKZyb9tA/ Yahoo breaks every mailing list in the world including the IETF's]: a problem with how DMARC is designed

Woozle at 16:27, 18 August 2022

2022-08-18T16:27:04Z

← Older revision		Revision as of 16:27, 18 August 2022
Line 101:		Line 101:
	It appears that some large email services (such as GMail) may reject messages if DMARC is not configured in a way they deem suitable; as far as I know, this is not officially documented anywhere (security by obscurity), and proper configuration can only be determined by experimentation.		It appears that some large email services (such as GMail) may reject messages if DMARC is not configured in a way they deem suitable; as far as I know, this is not officially documented anywhere (security by obscurity), and proper configuration can only be determined by experimentation.
	==Notes==		==Notes==
	* [https://mxtoolbox.com/problem/dmarc/dmarc-external-validation DMARC External Validation]

	For some reason, [[DigitalOcean]] [https://docs.digitalocean.com/products/networking/dns/how-to/manage-records/ apparently] does not support wildcards in TXT DNS records, so you can't set up a wildcard DMARC recipient.		For some reason, [[DigitalOcean]] [https://docs.digitalocean.com/products/networking/dns/how-to/manage-records/ apparently] does not support wildcards in TXT DNS records, so you can't set up a wildcard DMARC recipient.
	==Links==		==Links==
			===Reference===
	* {{wikipedia}}		* {{wikipedia}}
			* [https://datatracker.ietf.org/doc/html/rfc7489 RFC 7489]
			* [https://mxtoolbox.com/problem/dmarc MxToolBox Problem Knowledge Base]

Woozle at 21:45, 16 August 2022

2022-08-16T21:45:06Z

← Older revision		Revision as of 21:45, 16 August 2022
Line 95:		Line 95:
	\| YES		\| YES
	\| <code>DMARC1</code>		\| <code>DMARC1</code>
	\| Version - identifies the record retrieved as a ~~valud~~ DMARC record. Must be the first tag.		\| Version - identifies the record retrieved as a valid DMARC record. Must be the first tag.
	\|}		\|}
	''documentation in progress''		''documentation in progress''

Woozle at 21:34, 16 August 2022

2022-08-16T21:34:19Z

← Older revision		Revision as of 21:34, 16 August 2022
Line 8:		Line 8:
	[[category:SMTP]]		[[category:SMTP]]
	</hide>		</hide>
	{{fmt/title\|Domain-based Message Authentication, Reporting and Conformance ~~(DMARC)~~}}		{{fmt/title\|DMARC: Domain-based Message Authentication, Reporting and Conformance}}
	==About==		==About==
	Configuring [[DMARC]] for any given domain requires only a DNS entry for that domain, containing machine-readable instructions for any message recipient to automatically authenticate an incoming message. The server receiving any message can check the "from" domain's DNS for a DMARC record. If one is found, the message will be accepted only if it passes the requirements.		Configuring [[DMARC]] for any given domain requires only a DNS entry for that domain, containing machine-readable instructions for any message recipient to automatically authenticate an incoming message. The server receiving any message can check the "from" domain's DNS for a DMARC record. If one is found, the message will be accepted only if it passes the requirements.

Woozle at 21:33, 16 August 2022

2022-08-16T21:33:39Z

← Older revision		Revision as of 21:33, 16 August 2022
Line 15:		Line 15:
	===Tags===		===Tags===
	{\| class="wikitable"		{\| class="wikitable"
	! tag !! values !! description		! tag !! req? !! values !! description
	\|-		\|-
	\| '''adkim'''		\| '''adkim'''
			\| n
	\|<poem>		\|<poem>
	<code>s</code>: strict		<code>s</code>: strict
Line 25:		Line 26:
	\|-		\|-
	\| '''aspf'''		\| '''aspf'''
			\| n
	\|<poem>		\|<poem>
	<code>s</code>: strict		<code>s</code>: strict
Line 32:		Line 34:
	\|-		\|-
	\| '''fo'''		\| '''fo'''
			\| n
	\|<poem>		\|<poem>
	<code>0</code>: report DMARC failure if '''all''' underlying auths don't align		<code>0</code>: report DMARC failure if '''all''' underlying auths don't align
Line 41:		Line 44:
	\|-		\|-
	\| '''p'''		\| '''p'''
			\| YES
	\|		\|

Line 55:		Line 59:
	\|-		\|-
	\| '''pct'''		\| '''pct'''
			\| n
	\| <code>0</code> to <code>100</code>, default = <code>100</code>		\| <code>0</code> to <code>100</code>, default = <code>100</code>
	\| % of domain's messages subject to policy		\| % of domain's messages subject to policy
Line 61:		Line 66:
	\|-		\|-
	\| '''rf'''		\| '''rf'''
			\| n
	\| {{arg\|list of one or more [https://datatracker.ietf.org/doc/html/rfc7489#section-11.5 report formats]}}		\| {{arg\|list of one or more [https://datatracker.ietf.org/doc/html/rfc7489#section-11.5 report formats]}}
	\| Format to be used for message-specific failure reports		\| Format to be used for message-specific failure reports
Line 67:		Line 73:
	\|-		\|-
	\| '''ri'''		\| '''ri'''
			\| n
	\| {{arg\|number of seconds}}		\| {{arg\|number of seconds}}
	\| maximum interval between aggregate reports; default is 86400		\| maximum interval between aggregate reports; default is 86400
	\|-		\|-
	\| '''rua'''		\| '''rua'''
			\| n
	\| {{arg\|one or more email addresses, comma-separated}}		\| {{arg\|one or more email addresses, comma-separated}}
	\| addresses ([[DMARC URI]]s) to which aggregate reports are to be sent		\| addresses ([[DMARC URI]]s) to which aggregate reports are to be sent
	\|-		\|-
	\| '''ruf'''		\| '''ruf'''
	\| {{arg\|one or more email addresses, comma-separated}}		\| n
			\| {{arg\|one or more email addresses, comma-separated}}
	\| addresses ([[DMARC URI]]s) to which message-specific failure information is to be sent		\| addresses ([[DMARC URI]]s) to which message-specific failure information is to be sent
			\|-
			\| '''sp'''
			\| n
			\| (same as '''p'''; optional)
			\| Requested Mail Receiver policy for all subdomains; defaults to value of '''p'''
			\|-
			\| '''v'''
			\| YES
			\| <code>DMARC1</code>
			\| Version - identifies the record retrieved as a valud DMARC record. Must be the first tag.
	\|}		\|}
	''documentation in progress''		''documentation in progress''

Woozle at 15:33, 16 August 2022

2022-08-16T15:33:20Z

← Older revision		Revision as of 15:33, 16 August 2022
Line 71:		Line 71:
	\|-		\|-
	\| '''rua'''		\| '''rua'''
	\| {{arg\|one or more email addresses}}		\| {{arg\|one or more email addresses, comma-separated}}
	\| addresses (DMARC ~~URIs~~) to which aggregate reports are to be sent		\| addresses ([[DMARC URI]]s) to which aggregate reports are to be sent
	* comma-separated ~~list~~		\|-
	* the [https://datatracker.ietf.org/doc/html/rfc7489#section-6.4 definition] of [[~~/URI\|~~DMARC URI]] is ~~very obtuse, but "mailto:{{arg\|email address}}" seems~~ to ~~work"~~		\| '''ruf'''
			\| {{arg\|one or more email addresses, comma-separated}}
			\| addresses ([[DMARC URI]]s) to which message-specific failure information is to be sent
	\|}		\|}
	''documentation in progress''		''documentation in progress''

Woozle at 14:34, 15 August 2022

2022-08-15T14:34:17Z

← Older revision		Revision as of 14:34, 15 August 2022
Line 47:		Line 47:
	\| <code>none</code> \|\| no specific action		\| <code>none</code> \|\| no specific action
	\|-		\|-
	\| <code>quarantine</code> \|\| treat all failed messages as suspicious (receiver can decide how to handle)		\| <code>quarantine</code> \|\| treat all failed messages as suspicious<br>receiver can decide how to handle
	\|-		\|-
	\| <code>reject</code> \|\| reject all failed messages, preferably during the SMTP transaction (see [https://datatracker.ietf.org/doc/html/rfc7489#section-10.3 Section 10.3])		\| <code>reject</code> \|\| reject all failed messages<br>preferably during the SMTP transaction<br>see [https://datatracker.ietf.org/doc/html/rfc7489#section-10.3 Section 10.3]
	\|}		\|}

Line 56:		Line 56:
	\| '''pct'''		\| '''pct'''
	\| <code>0</code> to <code>100</code>, default = <code>100</code>		\| <code>0</code> to <code>100</code>, default = <code>100</code>
	\| % of domain's messages subject to policy (except reports, which are always 100%)		\| % of domain's messages subject to policy
			* except reports, which are always 100%
			* see [https://datatracker.ietf.org/doc/html/rfc7489#section-6.6.4 Section 6.6.4]
			\|-
			\| '''rf'''
			\| {{arg\|list of one or more [https://datatracker.ietf.org/doc/html/rfc7489#section-11.5 report formats]}}
			\| Format to be used for message-specific failure reports
			* colon-separated
			* default is "<code>afrf</code>"
			\|-
			\| '''ri'''
			\| {{arg\|number of seconds}}
			\| maximum interval between aggregate reports; default is 86400
			\|-
			\| '''rua'''
			\| {{arg\|one or more email addresses}}
			\| addresses (DMARC URIs) to which aggregate reports are to be sent
			* comma-separated list
			* the [https://datatracker.ietf.org/doc/html/rfc7489#section-6.4 definition] of [[/URI\|DMARC URI]] is very obtuse, but "mailto:{{arg\|email address}}" seems to work"
	\|}		\|}
	''documentation in progress''		''documentation in progress''

Woozle at 14:14, 15 August 2022

2022-08-15T14:14:46Z

← Older revision		Revision as of 14:14, 15 August 2022
Line 17:		Line 17:
	! tag !! values !! description		! tag !! values !! description
	\|-		\|-
	\| ~~valign=top~~ \| '''~~adkim~~'''		\| '''adkim'''
			\|<poem>
			<code>s</code>: strict
			<code>r</code>: relaxed
			</poem>
			\| how closely to check DKIM configuration ("alignment")
			\|-
			\| '''aspf'''
			\|<poem>
			<code>s</code>: strict
			<code>r</code>: relaxed
			</poem>
			\| how closely to check SPF configuration ("alignment")
			\|-
			\| '''fo'''
			\|<poem>
			<code>0</code>: report DMARC failure if '''all''' underlying auths don't align
			<code>1</code>: report DMARC failure if '''any''' underlying auths don't align
			<code>d</code>: report DKIM failure if DKIM signature fails, regardless of alignment (see [https://datatracker.ietf.org/doc/html/rfc7489#ref-AFRF-DKIM AFRF-DKIM])
			<code>s</code>: report SPF failure if SPF evaluation fails, regardless of alignment (see [https://datatracker.ietf.org/doc/html/rfc7489#ref-AFRF-SPF AFRF-SPF])
			</poem>
			\| failure [reporting] options
			\|-
			\| '''p'''
	\|		\|
	* s (strict)
	* r (relaxed)		{\| class="wikitable"
	\| ~~valign~~=~~top \| how closely to check DKIM configuration (~~"~~alignment~~")
	\|-		\|-
	\| ~~valign=top~~ \| ~~'''aspf'''~~		\| <code>none</code> \|\| no specific action
	\|		\|-
	* s (~~strict~~)		\| <code>quarantine</code> \|\| treat all failed messages as suspicious (receiver can decide how to handle)
	* r (~~relaxed~~)		\|-
	\| ~~valign=top~~ \| ~~how closely to check SPF configuration ("alignment")~~		\| <code>reject</code> \|\| reject all failed messages, preferably during the SMTP transaction (see [https://datatracker.ietf.org/doc/html/rfc7489#section-10.3 Section 10.3])
			\|}

			\| Requested Mail Receiver policy
	\|-		\|-
	~~\| valign=top~~ \| '''fo'''		\| '''pct'''
	\|		\| <code>0</code> to <code>100</code>, default = <code>100</code>
	: <code>0</code>~~: report DMARC failure if '''all''' underlying auths don't align~~		\| % of domain's messages subject to policy (except reports, which are always 100%)
	: <code>1</code>~~: report DMARC failure if '''any''' underlying auths don't align~~
	: <code>d</code>~~: report DKIM failure if DKIM signature fails, regardless~~ of ~~alignment~~ (~~see [https://datatracker.ietf.org/doc/html/rfc7489#ref-AFRF-DKIM AFRF-DKIM])~~
	~~: <code>s</code>: report SPF failure if SPF evaluation fails~~, ~~regardless of alignment (see [https://datatracker.ietf.org/doc/html/rfc7489#ref-AFRF-SPF AFRF-SPF]~~)
	~~\| valign=top \| failure [reporting] options~~
	\|}		\|}
	''documentation in progress''		''documentation in progress''

Woozle at 13:53, 15 August 2022

2022-08-15T13:53:58Z

@@ Line 14: / Line 14: @@
 The DMARC DNS entry for a given domain uses a "_DMARC" subdomain (<code>_DMARC.{{arg|domain}}</code>). The explanation of the DNS record contents seems to begin in [https://datatracker.ietf.org/doc/html/rfc7489#section-6.3 section 6.3] of RFC-7489.
 ===Tags===
-* '''adkim''': s (strict) or r (relaxed) -- how closely to check DKIM configuration ("alignment")
+{| class="wikitable"
-* '''aspf''':  s (strict) or r (relaxed) -- how closely to check SPF configuration ("alignment")
+! tag !! values !! description
+|-
 ''documentation in progress''
 ==In Practice==