Discussion about SPF/DMARC and postmaster

[DorianCoding]

Hello,

I know it has been discussed here : #1687 but I have some questions or need some clarification:

• Is pct enforced in DMARC policy?
• Why the relaxing mode does not enforce hard fail of SPF and DMARC whereas they are clearly here to reject. Strict mode should be to reject in case of error fetching the rule, not when the rule asks rejection. Same should apply but I believe is already for MTA-STS.
• Is there any work on implementing the RFC-required postmaster mailbox? Even with rewriting, a mailbox without @ is rejected as invalid. At best an option should be available to choose which emails should receive it.

Thank you.

[mdecimus]

Hi,

Is pct enforced in DMARC policy?

Yes.

Why the relaxing mode does not enforce hard fail of SPF and DMARC whereas they are clearly here to reject.

It is a safe default which you can change. Instead of rejecting them, those emails go to the user's spam folder.

Is there any work on implementing the RFC-required postmaster mailbox? Even with rewriting, a mailbox without @ is rejected as invalid. At best an option should be available to choose which emails should receive it.

Do you mean accepting an empty RCPT address such as RCPT TO:<>?

[DorianCoding]

Hello,

It is a safe default which you can change. Instead of rejecting them, those emails go to the user's spam folder.

This is what I think should be discussed. If the domain requires rejection it should be enforced.

https://www.rfc-editor.org/rfc/rfc7489#section-10.3

quarantine:  The Domain Owner wishes to have email that fails the
         DMARC mechanism check be treated by Mail Receivers as
         suspicious.  Depending on the capabilities of the Mail
         Receiver, this can mean "place into spam folder", "scrutinize
         with additional intensity", and/or "flag as suspicious".

      reject:  The Domain Owner wishes for Mail Receivers to reject
         email that fails the DMARC mechanism check.  Rejection SHOULD
         occur during the SMTP transaction.  See [Section 10.3](https://www.rfc-editor.org/rfc/rfc7489#section-10.3) for some
         discussion of SMTP rejection methods and their implications.

Strict should reject if there is a temp error or a perm error.
Or maybe a new parameter should be available.
None : do nothing
Relax: only report
Enforce: reject if ask rejection and quarantaine if ask quarantaine. Do nothing if temp error or perm error.
Strict: enforce policy if it does not pass.

Do you mean accepting an empty RCPT address such as RCPT TO:<>?

I mean accepting RCPT TO:<postmaster> (now it rejects for bad mailbox address because no @) or at best, ke reports have the ability to choose where to put all alias such as postmaster*. And choose another default for reports like reports@*.

This is a requirement of RFC 5321.

https://www.rfc-editor.org/rfc/rfc5321.html#section-4.1.1.3

Any system that includes an SMTP server supporting mail relaying or
   delivery MUST support the reserved mailbox "postmaster" as a case-
   insensitive local name.  This postmaster address is not strictly
   necessary if the server always returns 554 on connection opening (as
   described in [Section 3.1](https://www.rfc-editor.org/rfc/rfc5321.html#section-3.1)).  The requirement to accept mail for
   postmaster implies that RCPT commands that specify a mailbox for
   postmaster at any of the domains for which the SMTP server provides
   mail service, as well as the special case of "RCPT TO:<Postmaster>"
   (with no domain specification), MUST be supported.

[DorianCoding]

Talking of reports, would it be possible to check if forwarding is disabled and mail matches the pattern to accept the email even if the mailbox does not exist?

[mdecimus]

Not currently. The mailbox needs to exist in the directory for a message to a local domain to be accepted.