OpenDMARC - ArchWiki

Jump to content

# OpenDMARC

From ArchWiki

OpenDMARC is an open source implementation of the Domain-based Message Authentication, Reporting and Conformance (DMARC) specification.

DMARC is a policy for mail transfer, which is already supported by some common mail providers. It depends on Sender Policy Framework and DKIM. DMARC provides a policy for outgoing mail and checks incoming mails for compliance with that policy. The policy is published via a DNS TXT record. It is explained in #DMARC Record. Validation is done in a daemon. For more info see RFC 7489.

## Installation

Install the opendmarc package.

## Configuration

Main configuration file is `/etc/opendmarc/opendmarc.conf`

Change the following options:

    /etc/opendmarc/opendmarc.conf

    Socket                  unix:/run/opendmarc/opendmarc.sock

Add the socket directory and set its credentials to be accessible to the STMP server user (likely `postfix` or `mail`:

    # mkdir /run/opendmarc
    # chown opendmarc:postfix /run/opendmarc

To have this socket directory created automatically, create the following file `/etc/tmpfiles.d/opendmarc.conf`:

     D /run/opendmarc 0750 opendmarc postfix

To run the `opendmarc.service` as the SMTP server user (default is `opendmarc:mail`) create `/etc/systemd/system/opendmarc.service.d/override.conf`:

    [Service]
    Group=
    Group=postfix

Note: If you want to run your DMARC-Validator on a different machine, you should change the Socket field to `inet:9999@10.0.0.4` with a sample host listening at port 9999 for an optional client 10.0.0.4 (can be omitted, listens on 0.0.0.0 then).

- Enable and start the `opendmarc.service`. Read Daemons for more information.

## Postfix integration

Add the following lines to `main.cf`:

    /etc/postfix/main.cf

    non_smtpd_milters   = unix:/run/opendkim/opendkim.sock, unix:/run/opendmarc/opendmarc.sock
    smtpd_milters       = unix:/run/opendkim/opendkim.sock, unix:/run/opendmarc/opendmarc.sock

Make sure that the DMARC milter is declared after the DKIM milter.

## DMARC Record

To enable DMARC for your domain, you have to add a new TXT record to your DNS zone.Here is an example of a DMARC policy, processed one step after another.

First testing, no harm as (sub)policy is "none", but start to receive aggregated reports and failing reports (SPF and DKIM):

    _dmarc.example.com TXT v=DMARC1; rua=mailto:postmaster@example.com; ruf=mailto:forensic@example.com; adkim=s; fo=1

After a certain time, after analyzing these reports you can enable the policy for let us say 10% of e-mail traffic.

    _dmarc.example.com TXT v=DMARC1; p=quarantine; rua=mailto:postmaster@example.com; ruf=mailto:forensic@example.com; adkim=s; fo=1; pct=10

Then slowly raise the percentage and finalize with policy 100% enabled and only failing reports:

    _dmarc.example.com TXT v=DMARC1; p=quarantine; ruf=mailto:forensic@example.com; adkim=s; fo=1

### DMARC options in detail

All fields are OPTIONAL unless "v" which is RECOMMENDED.

Tag name | Purpose | Sample
--- | --- | ---
v | Protocol version | v=DMARC1
p | Policy for organizational domain (default "none") | p=quarantine
sp | Policy for subdomains (default value of "p" field) | sp=reject
rua | Reporting URI of aggregate reports | rua=mailto:postmaster@example.com
ruf | Reporting URI for forensic reports | ruf=mailto:forensic@example.com
adkim | Alignment mode for DKIM (default "r") | adkim=s
aspf | Alignment mode for SPF (default "r") | aspf=r
ri | Reporting interval of aggregate reports (default "86400" ; often disregarded to default value) | ri=86400
fo | Forensic report options (default "0") | fo=1
rf | Reporting format. (default "afrf") | rf=afrf
pct | Percentage of messages subjected to filtering (default 100) | pct=20

The alignment modes for DKIM and SPF can be:

- "s" for strict: means "strict". Domains from From: shall match DKIM/SPF identifier.
- "r" for relaxed: means "relaxed". Organizational domains from From: and DKIM/SPF shall match.

where the latter allows a subdomain in the "From" header while the former does not.

The domain policy (p) and subdomain policy (sp) might be one of:

- "none" (for monitor mode)get at
- "quarantine"
- "reject"

The forensic report options are:

- "0" to generate reports if all underlying authentication mechanisms (SPF and DKIM) fail to produce a DMARC pass result
- "1" to generate reports if any mechanisms (SPF or DKIM) fail
- "d" to generate report if the DKIM signature failed to verify
- "s" if SPF failed.

## Weblinks

- DMARC Inspector
- IETF RFC 7489

Category:

- Mail server