On 3/8/23 16:02, Bernardo Reino via Postfix-users wrote:
Here some quick notes from my configuration (related to SPF/DKIM/DMARC checking,
i.e. when receiving e-mails):
SPF and DKIM are enabled by default, and at least I didn't need to have any
local config (which would go in local.d/{spf,dkim}.conf)
(DKIM signing is another matter, requiring configuration, but this is another
topic)
DMARC is also enabled by default,
OK, this is very useful information that's not obvious from the
documentation. I have taken a leap of faith and made the tiny handful
of Postfix configuration changes necessary to let Rspamd handle all of
DKIM, DMARC, SPF instead of handing them off to OpenDKIM, OpenDMARC, and
pypolicyd-spf.
I will be watching my logs closely for a while, exactly as I did after
finally figuring out a working configuration to get fail2ban to talk to
my physically-separate firewall host.
I also have enabled DMARC reporting, including a list of domains
to which no report should be sent (e.g. because they reject e-mails to the very
address they publish for this purpose..)
***
actions = {
quarantine = "add_header";
# reject = "reject";
reject = "add_header";
}
reporting {
enabled = true;
org_name = "BBMK";
domain = "bbmk.org";
email = "rep...@dmarc.bbmk.org";
from_name = "Rspamd"
max_entries = 1000; # per domain
keys_expire = 7d; # expire date for redis
# bcc_addrs = [ "postmas...@bbmk.org" ];
}
no_reporting_domains = "/etc/rspamd/local.d/dmarc_no_reporting_domains.txt";
***
(obviously, org_name, domain, email and from_name should be adapted
accordingly..)
And I'll be hanging onto this for reference. So far I have not found
DMARC reporting very useful to me except to confirm that a couple of
moderately large Boston-area remailers consistently throw my DMARC on
the floor. :p
--
Phil Stracchino
Babylon Communications
ph...@caerllewys.net
p...@co.ordinate.org
Landline: +1.603.293.8485
Mobile: +1.603.998.6958
_______________________________________________
Postfix-users mailing list -- postfix-users@postfix.org
To unsubscribe send an email to postfix-users-le...@postfix.org
