We might want to reject emails that fail DMARC check that have p=reject because if we forward those to mailinglists (without From rewriting) they will cause bounces from some subscribers (eventually causing those subscribers to be unsubscribed). To do that we should set RejectFailures true in /etc/opendmarc.conf
Are you sure? Incoming messages are the ones DMARC-checked here by opendmarc, and failures are already penalized by spamassassin. From: not-rewriting affects outgoing messages, whose incoming dmarc etc. stuff was presumably fine. It's our non-from-rewriting lists that might break their signature verification stuff at the recipients.
(In reply to Frank Ch. Eigler from comment #1) > Are you sure? Yes. opendmarc RejectFailures is not set and defaults to false. So we accept emails who fail their dmarc policy even when that policy is to reject. > Incoming messages are the ones DMARC-checked here by > opendmarc, and failures are already penalized by spamassassin. Yes, spamassassin will add DKIM or SPF failure markers, but doesn't score them that high. So they aren't actually rejected even if the p=reject. > From: not-rewriting affects outgoing messages, whose incoming dmarc etc. > stuff was presumably fine. It's our non-from-rewriting lists that might > break their signature verification stuff at the recipients. Sure, but this is about messages whose incoming dmarc was not fine and have an explicit p=reject.
OK, got it. (We could also add stronger spamassassin penalties toward incoming crypto failures.)
diff --git a/opendmarc.conf b/opendmarc.conf index ca99a153..47aa4016 100644 --- a/opendmarc.conf +++ b/opendmarc.conf @@ -250,7 +250,7 @@ IgnoreHosts /etc/opendmarc/ignore.hosts ## evaluation of the message. Instead, an Authentication-Results header ## field will be added. # -# RejectFailures false +RejectFailures true
--- a/mail/spamassassin/local.cf +++ b/mail/spamassassin/local.cf @@ -40,6 +40,11 @@ add_header all ASN _ASN_ _ASNCIDR_ # drop bondedsender; https://lwn.net/Articles/987566/ dns_query_restriction deny sa-trusted.bondedsender.org +# penalize incoming mail with authentication-results indicating failure +header LOCAL_AUTHENTCATION_FAIL Authentication-Results =~ /.*sourceware.org: (dmarc|spf|arc)=fail/ +describe LOCAL_AUTHENTCATION_FAIL Incoming DMARC or SPF or ARC authentication failure +score LOCAL_AUTHENTCATION_FAIL 5 oh yeah, with the typo :-)