mirror of
https://github.com/domainaware/parsedmarc.git
synced 2026-10-19 17:48:13 +00:00
Split and Organise documentation files (#404)
* Set global TOC collapse to false * Split documentation I tried to split the index.md file into logical parts, not changing the contents. I did add a space and change one HTTP URL to HTTPS. --------- Co-authored-by: Sean Whalen <44679+seanthegeek@users.noreply.github.com>
This commit is contained in:
1 parent
634631e326
commit
2b35b785c6
13 files changed
+1650
-1668
No files matched your search
@@ -0,0 +1,71 @@
|
||||
# Understanding DMARC
|
||||
## Resources
|
||||
|
||||
### DMARC guides
|
||||
|
||||
- [Demystifying DMARC] - A complete guide to SPF, DKIM, and DMARC
|
||||
|
||||
[demystifying dmarc]: https://seanthegeek.net/459/demystifying-dmarc/
|
||||
|
||||
### SPF and DMARC record validation
|
||||
|
||||
If you are looking for SPF and DMARC record validation and parsing,
|
||||
check out the sister project,
|
||||
[checkdmarc](https://domainaware.github.io/checkdmarc/).
|
||||
|
||||
### Lookalike domains
|
||||
|
||||
DMARC protects against domain spoofing, not lookalike domains. for open source
|
||||
lookalike domain monitoring, check out [DomainAware](https://github.com/seanthegeek/domainaware).
|
||||
|
||||
|
||||
## DMARC Alignment Guide
|
||||
|
||||
DMARC ensures that SPF and DKM authentication mechanisms actually authenticate
|
||||
against the same domain that the end user sees.
|
||||
|
||||
A message passes a DMARC check by passing DKIM or SPF, **as long as the related
|
||||
indicators are also in alignment**.
|
||||
|
||||
```{eval-rst}
|
||||
+-----------------------+-----------------------+-----------------------+
|
||||
| | **DKIM** | **SPF** |
|
||||
+-----------------------+-----------------------+-----------------------+
|
||||
| **Passing** | The signature in the | The mail server's IP |
|
||||
| | DKIM header is | address is listed in |
|
||||
| | validated using a | the SPF record of the |
|
||||
| | public key that is | domain in the SMTP |
|
||||
| | published as a DNS | envelope's mail from |
|
||||
| | record of the domain | header |
|
||||
| | name specified in the | |
|
||||
| | signature | |
|
||||
+-----------------------+-----------------------+-----------------------+
|
||||
| **Alignment** | The signing domain | The domain in the |
|
||||
| | aligns with the | SMTP envelope's mail |
|
||||
| | domain in the | from header aligns |
|
||||
| | message's from header | with the domain in |
|
||||
| | | the message's from |
|
||||
| | | header |
|
||||
+-----------------------+-----------------------+-----------------------+
|
||||
```
|
||||
|
||||
## What if a sender won't support DKIM/DMARC?
|
||||
|
||||
1. Some vendors don't know about DMARC yet; ask about SPF and DKIM/email
|
||||
authentication.
|
||||
2. Check if they can send through your email relays instead of theirs.
|
||||
3. Do they really need to spoof your domain? Why not use the display
|
||||
name instead?
|
||||
4. Worst case, have that vendor send email as a specific subdomain of
|
||||
your domain (e.g. `noreply@news.example.com`), and then create
|
||||
separate SPF and DMARC records on `news.example.com`, and set
|
||||
`p=none` in that DMARC record.
|
||||
|
||||
:::{warning}
|
||||
Do not alter the `p` or `sp` values of the DMARC record on the
|
||||
Top-Level Domain (TLD) – that would leave you vulnerable to
|
||||
spoofing of your TLD and/or any subdomain.
|
||||
:::
|
||||
|
||||
```{include} mailing-lists.md
|
||||
```
|
||||
Reference in new issue
Block a user