supaeasyandGitHub d9f6532841 Default missing Feedback-Type and Authentication-Results in failure reports (#332) (#831) ...

Some Exim/cPanel-based gateways send DMARC failure reports without a
machine-readable message/feedback-report part. parse_report_email()'s
plain-text fallback synthesizes a minimal feedback report with only
Arrival-Date and Source-IP, but the Elasticsearch/OpenSearch outputs
access feedback_type and authentication_results with hard key lookups,
so every such report was archived but never indexed, failing with
"Failure report missing required field: 'feedback_type'".

parse_failure_report() now defaults feedback_type to auth-failure
(RFC 5965 3.1) and authentication_results to None (RFC 6591 3.1) with
logged warnings, matching the existing handling of the REQUIRED
Auth-Failure and Identity-Alignment fields. Adds a sanitized sample
and a regression test asserting the sink-required keys are present.

2026-07-20 15:21:55 -04:00

..

[Netease DMARC Failure Report] Rent Reminder.eml

Add RFC 9989/9990/9991 (final DMARC) report support; rename forensic→failure project-wide (#659)

2026-05-20 18:51:08 -04:00

DMARC Failure Report for domain.de (mail-from=sharepoint@domain.de, ip=10.10.10.10).eml

Add RFC 9989/9990/9991 (final DMARC) report support; rename forensic→failure project-wide (#659)

2026-05-20 18:51:08 -04:00

dmarc_ruf_report_linkedin.crlf.eml

Add RFC 9989/9990/9991 (final DMARC) report support; rename forensic→failure project-wide (#659)

2026-05-20 18:51:08 -04:00

dmarc_ruf_report_linkedin.eml

Add RFC 9989/9990/9991 (final DMARC) report support; rename forensic→failure project-wide (#659)

2026-05-20 18:51:08 -04:00

exim_plain_text_only_no_arf_part.eml

Default missing Feedback-Type and Authentication-Results in failure reports (#332) (#831)

2026-07-20 15:21:55 -04:00