amorfo77/parsedmarc
1
0
Fork 0
mirror of https://github.com/domainaware/parsedmarc.git synced 2026-08-03 14:12:20 +00:00
Code Issues Projects Releases Wiki Activity

Detect aggregate reports by "domain" instead of "adkim"

Browse Source 
adkim is the published policy's DKIM alignment mode (defaulted to "r" by
parsedmarc), an obscure thing to key detection on. Switch the aggregate
detector to "domain" -- the reported From-domain, a required element present
and non-empty in every aggregate record (2388/2388 sample rows) and unique to
aggregate (failure uses reported_domain, SMTP TLS uses policy_domain).
header_from is unsuitable: it can be empty when a record carries no
identifiers.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This commit is contained in:
Sean Whalen
2026-07-11 13:58:09 -04:00
co-authored by Claude Opus 4.8
parent cf601b6d01
commit 7d9d693c05
2 changed files with 11 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
google_secops_parser/README.md
+1 -1
View File
@@ -27,7 +27,7 @@ detects them by a field unique to each and maps them as follows:
| parsedmarc report | Detected by | UDM `metadata.event_type` |
|---|---|---|
| DMARC aggregate | `adkim` | `EMAIL_TRANSACTION` |
| DMARC aggregate | `domain` | `EMAIL_TRANSACTION` |
| DMARC failure | `feedback_type` | `EMAIL_TRANSACTION` |
| SMTP TLS (RFC 8460) | `policy_type` | `GENERIC_EVENT` |