Update dns.rb to make default dmarc policy safer

BytemarkHosting / symbiosis

A hosting environment that works with you, not against you.

GNU General Public License v2.0

21 stars 14 forks source link

Update dns.rb to make default dmarc policy safer #130

Closed ianeiloart closed 5 years ago

ianeiloart commented 6 years ago

The current dmarc policy is dangerous, in that it says to quarantine 100% of unaligned email from the main domain (but oddly not subdomains). This policy is much safer for an initial dmarc policy, as recommended for example, by Google at https://support.google.com/a/answer/2466563?hl=en&ref_topic=2759254

pcollinson commented 5 years ago

I tried this - and DMARC analyser (https://app.dmarcanalyzer.com) complains about the pct=0

The percentage tag instructs ISPs to only apply the DMARC policy to a percentage of failing email's. 'pct = 50' will tell receivers to only apply the 'p = ' policy 50% of the time against email's that fail the DMARC check. NOTE: this will not work for the 'none' policy, but only for 'quarantine' or 'reject' policies.