687
edits
Changes
From SME Server
Jump to navigationJump to searchCreated page with "<span id="_top">Qpsmtpd#Plugins</span> = NAME = Domain-based Message Authentication, Reporting and Conformance = SYNOPSIS = DMARC is a reliable ..."
<span id="_top">[[Qpsmtpd#Plugins]]</span>
= [[#___top|NAME]] =
Domain-based Message Authentication, Reporting and Conformance
= [[#___top|SYNOPSIS]] =
DMARC is a reliable means to authenticate email.
= [[#___top|DESCRIPTION]] =
From the DMARC Draft: "DMARC operates as a policy layer atop DKIM and SPF. These technologies are the building blocks of DMARC as each is widely deployed, supported by mature tools, and is readily available to both senders and receivers. They are complementary, as each is resilient to many of the failure modes of the other."
DMARC provides a way to exchange authentication information and policies among mail servers.
DMARC benefits domain owners by preventing others from impersonating them. A domain owner can reliably tell other mail servers that "it it doesn't originate from this list of servers (SPF) and it is not signed (DKIM), then [ignore|quarantine|reject] it." DMARC also provides domain owners with a means to receive feedback and determine that their policies are working as desired.
DMARC benefits mail server operators by providing them with a more reliable (than SPF or DKIM alone) means to block forged emails. Is that message really from PayPal, Chase, Gmail, or Facebook? Since those organizations publish DMARC policies, operators have a definitive means to know.
= [[#___top|HOWTO]] =
== [[#___top|Protect a domain with DMARC]] ==
See Section 10 of the draft: Domain Owner Actions
<pre> 1. Deploy DKIM & SPF
2. Ensure identifier alignment.
3. Publish a "monitor" record, ask for data reports
4. Roll policies from monitor to reject</pre>
=== [[#___top|Publish a DMARC policy]] ===
_dmarc IN TXT "v=DMARC1; p=reject; rua=mailto:dmarc-feedback@example.com;"
<pre> v=DMARC1; (version)
p=none; (disposition policy : reject, quarantine, none (monitor))
sp=reject; (subdomain policy: default, same as p)
adkim=s; (dkim alignment: s=strict, r=relaxed)
aspf=r; (spf alignment: s=strict, r=relaxed)
rua=mailto: dmarc-feedback@example.com; (aggregate reports)
ruf=mailto: dmarc-feedback@example.com; (forensic reports)
rf=afrf; (report format: afrf, iodef)
ri=8400; (report interval)
pct=50; (percent of messages to filter)</pre>
== [[#___top|Validate messages with DMARC]] ==
1. install Mail::DMARC
2. install this plugin
3. activate this plugin. (add to config/plugins, listing it after SPF & DKIM. Check that SPF and DKIM are configured to not reject mail.
= [[#___top|CONFIGURATION =head2 reporting [ 0 | 1 ]]] =
Default: 1
0: do not save and publish aggregate reports
1: publish reports (requires proper Mail::DMARC configuration)
= [[#___top|MORE INFORMATION]] =
http://www.dmarc.org/draft-dmarc-base-00-02.txt
https://github.com/smtpd/qpsmtpd/wiki/DMARC-FAQ
= [[#___top|TODO]] =
<pre> reject messages with multiple From: headers</pre>
= [[#___top|AUTHORS]] =
<pre> 2013 - Matt Simerson <msimerson@cpan.org></pre>
<!-- Generated Sun Jul 30 08:24:17 EDT 2017 using
perldoc -T -ohtml /usr/share/qpsmtpd/plugins/dmarc |pandoc -f html -t mediawiki |sed 1 i\\n\n\n<span id="_top">[[Qpsmtpd#Plugins]]</span> |sed -e s#</d.>##
-->
----
[[Category:Qpsmtpd|dmarc]]
= [[#___top|NAME]] =
Domain-based Message Authentication, Reporting and Conformance
= [[#___top|SYNOPSIS]] =
DMARC is a reliable means to authenticate email.
= [[#___top|DESCRIPTION]] =
From the DMARC Draft: "DMARC operates as a policy layer atop DKIM and SPF. These technologies are the building blocks of DMARC as each is widely deployed, supported by mature tools, and is readily available to both senders and receivers. They are complementary, as each is resilient to many of the failure modes of the other."
DMARC provides a way to exchange authentication information and policies among mail servers.
DMARC benefits domain owners by preventing others from impersonating them. A domain owner can reliably tell other mail servers that "it it doesn't originate from this list of servers (SPF) and it is not signed (DKIM), then [ignore|quarantine|reject] it." DMARC also provides domain owners with a means to receive feedback and determine that their policies are working as desired.
DMARC benefits mail server operators by providing them with a more reliable (than SPF or DKIM alone) means to block forged emails. Is that message really from PayPal, Chase, Gmail, or Facebook? Since those organizations publish DMARC policies, operators have a definitive means to know.
= [[#___top|HOWTO]] =
== [[#___top|Protect a domain with DMARC]] ==
See Section 10 of the draft: Domain Owner Actions
<pre> 1. Deploy DKIM & SPF
2. Ensure identifier alignment.
3. Publish a "monitor" record, ask for data reports
4. Roll policies from monitor to reject</pre>
=== [[#___top|Publish a DMARC policy]] ===
_dmarc IN TXT "v=DMARC1; p=reject; rua=mailto:dmarc-feedback@example.com;"
<pre> v=DMARC1; (version)
p=none; (disposition policy : reject, quarantine, none (monitor))
sp=reject; (subdomain policy: default, same as p)
adkim=s; (dkim alignment: s=strict, r=relaxed)
aspf=r; (spf alignment: s=strict, r=relaxed)
rua=mailto: dmarc-feedback@example.com; (aggregate reports)
ruf=mailto: dmarc-feedback@example.com; (forensic reports)
rf=afrf; (report format: afrf, iodef)
ri=8400; (report interval)
pct=50; (percent of messages to filter)</pre>
== [[#___top|Validate messages with DMARC]] ==
1. install Mail::DMARC
2. install this plugin
3. activate this plugin. (add to config/plugins, listing it after SPF & DKIM. Check that SPF and DKIM are configured to not reject mail.
= [[#___top|CONFIGURATION =head2 reporting [ 0 | 1 ]]] =
Default: 1
0: do not save and publish aggregate reports
1: publish reports (requires proper Mail::DMARC configuration)
= [[#___top|MORE INFORMATION]] =
http://www.dmarc.org/draft-dmarc-base-00-02.txt
https://github.com/smtpd/qpsmtpd/wiki/DMARC-FAQ
= [[#___top|TODO]] =
<pre> reject messages with multiple From: headers</pre>
= [[#___top|AUTHORS]] =
<pre> 2013 - Matt Simerson <msimerson@cpan.org></pre>
<!-- Generated Sun Jul 30 08:24:17 EDT 2017 using
perldoc -T -ohtml /usr/share/qpsmtpd/plugins/dmarc |pandoc -f html -t mediawiki |sed 1 i\\n\n\n<span id="_top">[[Qpsmtpd#Plugins]]</span> |sed -e s#</d.>##
-->
----
[[Category:Qpsmtpd|dmarc]]
