search

hardenize / hardenize-public

11 stars 0 forks source link

Add verification of configured DMARC destinations #23

Open Tributh opened 6 years ago

Tributh commented 6 years ago

Hi,

you reported under: https://www.hardenize.com/report/xing.com/1519175242#email_dmarc

"Good. You have a valid DMARC policy."

...but in this case, it's a bit useless, when the mailto addresses are not working.

rua | mailto:dmarc_agg@xing.com ruf | mailto:dmarc_afrf@xing.com

After some failures in my sending DMARC-reports I started checking the adresses and as a result, both addresses are invalid. See sample:

=== Trying mx1-2.xing.com:25... === Connected to mx1-2.xing.com. <- 220 mx1-2.xing.com ESMTP Postfix -> EHLO www.tributh.net <- 250-iitmx-3.mail.ams1.xing.com <- 250-PIPELINING <- 250-SIZE 20480000 <- 250-VRFY <- 250-ETRN <- 250-STARTTLS <- 250-ENHANCEDSTATUSCODES <- 250-8BITMIME <- 250 SMTPUTF8 -> MAIL FROM:mailverification@tributh.net <- 250 2.1.0 Ok -> RCPT TO:dmarc_agg@xing.com <** 577 5.1.1 dmarc_agg@xing.com: Recipient address rejected: undeliverable address: host barracuda-2.mail.ams1.xing.com[10.12.16.55] said: 550 No such user (dmarc_agg@xing.com) (in reply to RCPT TO command) -> QUIT <- 221 2.0.0 Bye === Connection closed with remote host.

Can this be checked are marked also?

Cheers Torsten

ivanr commented 6 years ago

Yes, that's planned, although we yet have to figure out of we're going to be penalised by SMTP servers for verifying email addresses like that.

Tributh commented 6 years ago

Good to know. In my mailsetup you wouldn't be penalized for checking an RCPT. I have also a type of callout for every unknown/new emailaddress sending to our system. So we are doing a RCPT-Check on foreign mailservers on every new incoing senderaddress without recognizing penalties for that.

yoshimo commented 5 years ago

There is a postfix feature for that: http://www.postfix.org/ADDRESS_VERIFICATION_README.html