cisagov / cyhy-system

Cyber Hygiene system and overall documentation/issue tracking
Creative Commons Zero v1.0 Universal
6 stars 0 forks source link

Add header-from domain in Trustymail's dmarc_failures.csv #80

Closed climber-girl closed 1 year ago

climber-girl commented 1 year ago

💡 Summary

The dmarc_failures.csv could be improved by including the header_from identifier listed within the aggregate reports we parse for agencies to better understand the DMARC failures occurring.

Motivation and context

This would be useful because it could help agencies further dig into the failures they are interested in knowing more about to see whether the header from was a subdomain of theirs that doesn't have its own DMARC record and instead relies on the root domain's DMARC record (which I believe is the one showing in the Policy Domain column when such is the case).

Implementation notes

A new column could be included to report the <header_from>exampledomain.com</header_from> info. Hopefully this could be as easy as adding a "Header From" column between L1285 and L1286 of generate_trustymail_report.py since it looks like the info is already grabbed at L1106.

Acceptance criteria

How do we know when this work is done?