dmarc-srg icon indicating copy to clipboard operation
dmarc-srg copied to clipboard

Email source data in reports

Open ShawnPConroy opened this issue 3 months ago • 1 comments

When going over email reports, it would be very helpful to have additional data from the failing record to help be able to dismiss non-issues. Sources should be divided between not aligned, partially aligned and fully aligned, and shown in that order.

For fully aligned sources, include the identifier domain from email_header if present. If not, I doubt it fully aligned. But take any other header_from, envelope_from etc.

For partially aligned sources, and not aligned sources, including the domains listed in the identifiers, DKIM and SPF would be useful:

Identifiers: email_header, header_from, envelope_from, envelope_to DKIM auth: domain+selector SPF auth: domain+selector

It's simple to just list each on its own line. It's cleaner to remove duplicates. And except for the selectors, any time the domain matches the FQDN I guess that could be ignored, as it's a given.

This can either be a new Identifiers column next to the source IP, or included below and change the column name to source. No need for a new column for each data item.


For example, I get a lot of email spoofing my domains from one website. It would be nice to know at a glance, oh that rejected email was from website spoof1. Good. Or, oh, that rejected or quarantined email was from sender1, sender2, or sender3, that's an issue that needs resolving. Oh, partial aligned from sender4? That's expected behaviour.

domain+selector is useful for newsletter and marketing emails that have a DKIM or SPF setup with the selector as part of the DNS record name.

ShawnPConroy avatar Nov 12 '24 18:11 ShawnPConroy