Bug 32255 - reject emails that fail DMARC check
Summary: reject emails that fail DMARC check
Status: RESOLVED FIXED
Alias: None
Product: sourceware
Classification: Unclassified
Component: Infrastructure (show other bugs)
Version: unspecified
: P2 normal
Target Milestone: ---
Assignee: overseers mailing list
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2024-10-08 20:21 UTC by Mark Wielaard
Modified: 2024-11-04 16:42 UTC (History)
1 user (show)

See Also:
Host:
Target:
Build:
Last reconfirmed:
Project(s) to access:
ssh public key:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Mark Wielaard 2024-10-08 20:21:48 UTC
We might want to reject emails that fail DMARC check that have p=reject because if we forward those to mailinglists (without From rewriting) they will cause bounces from some subscribers (eventually causing those subscribers to be unsubscribed).

To do that we should set RejectFailures true in /etc/opendmarc.conf
Comment 1 Frank Ch. Eigler 2024-10-08 20:32:37 UTC
Are you sure?  Incoming messages are the ones DMARC-checked here by opendmarc, and failures are already penalized by spamassassin.

From: not-rewriting affects outgoing messages, whose incoming dmarc etc. stuff was presumably fine.  It's our non-from-rewriting lists that might break their signature verification stuff at the recipients.
Comment 2 Mark Wielaard 2024-10-10 09:57:21 UTC
(In reply to Frank Ch. Eigler from comment #1)
> Are you sure?

Yes. opendmarc RejectFailures is not set and defaults to false. So we accept emails who fail their dmarc policy even when that policy is to reject.

> Incoming messages are the ones DMARC-checked here by
> opendmarc, and failures are already penalized by spamassassin.

Yes, spamassassin will add DKIM or SPF failure markers, but doesn't score them that high. So they aren't actually rejected even if the p=reject.

> From: not-rewriting affects outgoing messages, whose incoming dmarc etc.
> stuff was presumably fine.  It's our non-from-rewriting lists that might
> break their signature verification stuff at the recipients.

Sure, but this is about messages whose incoming dmarc was not fine and have an explicit p=reject.
Comment 3 Frank Ch. Eigler 2024-10-10 13:05:24 UTC
OK, got it.
(We could also add stronger spamassassin penalties toward incoming crypto failures.)
Comment 4 Frank Ch. Eigler 2024-11-04 16:31:58 UTC
diff --git a/opendmarc.conf b/opendmarc.conf
index ca99a153..47aa4016 100644
--- a/opendmarc.conf
+++ b/opendmarc.conf
@@ -250,7 +250,7 @@ IgnoreHosts /etc/opendmarc/ignore.hosts
 ##  evaluation of the message.  Instead, an Authentication-Results header
 ##  field will be added.
 #
-# RejectFailures false
+RejectFailures true
Comment 5 Frank Ch. Eigler 2024-11-04 16:42:45 UTC
--- a/mail/spamassassin/local.cf
+++ b/mail/spamassassin/local.cf
@@ -40,6 +40,11 @@ add_header all ASN _ASN_ _ASNCIDR_
 # drop bondedsender; https://lwn.net/Articles/987566/
 dns_query_restriction deny sa-trusted.bondedsender.org
 
+# penalize incoming mail with authentication-results indicating failure
+header LOCAL_AUTHENTCATION_FAIL Authentication-Results =~ /.*sourceware.org: (dmarc|spf|arc)=fail/
+describe LOCAL_AUTHENTCATION_FAIL Incoming DMARC or SPF or ARC authentication failure
+score  LOCAL_AUTHENTCATION_FAIL 5



oh yeah, with the typo :-)