search

internetstandards / Internet.nl

Internet standards compliance test suite
https://internet.nl
178 stars 38 forks source link

DMARC mailto schema should be required #1474

Open patrickbenkoetter opened 3 months ago

patrickbenkoetter commented 3 months ago

Currently the internet.nl tool does not detect erroneous URIs in rua or ruf tags and in consequence it doesn't mark the test as failure. Instead it reports the DMARC DNS resource record to be valid and flags the test as passed. But specifying a valid URI is a mandatory RFC requirement:

A Mail Receiver MUST implement support for a "mailto:" URI, i.e., the ability to send a DMARC report via electronic mail. If not provided, Mail Receivers MUST NOT generate failure reports. -- RFC 7489: 6.3 General Record Format

An invalid DMARC DNS record is a problem, because if the URI is missing, any RFC compliant mail receiver will not send a report and the senderdomain owner will not be able to detect abuse of the senderdomain. Therefore the whole concept to protect a senderdomain with DMARC fails.

The reason internet.n doesn't detect the error probably stems from the fact that the Python standard library urlparse-function, used by internet.nl, doesn't return an error if the URI is missing:

>>> urlparse("recipient@example.com")
>>> urlparse("mailto:recipient@example.com")

internet.nl therefore doesn't take notice and subsequently it doesn't mark the DNS Resource Record to be invalid.

RFC 7489 specifies one but only one valid URI any mail receiver MUST support which is mailto:.

Examples for valid rua URIs are:

v=DMARC1; p=none; rua=mailto:dmarc-feedback@example.com
v=DMARC1; p=none; rua=mailto:dmarc-feedback@example.com,mailto:dmarc-reports@example.net,
    mailto:report@dmarc.example.com

Examples for invalid rua URIs would be:

v=DMARC1; p=none; rua=dmarc-feedback@example.com
v=DMARC1; p=none; rua=mailto:dmarc-feedback@example.com,dmarc-reports@example.net,
    report@dmarc.example.com

We believe this is an error and we think it should be fixed. internet.nl should detect an URI error and flag the corresponding test as failed so that people can notice there's something important wrong.

bwbroersma commented 2 months ago

Also because of other DMARC parsing issues:

It might be interesting to use an ABNF regex generator package instead. Note there is a package that already encoded RFC 7489 - DMARC, plus uses the referenced RFC's to parse other elements like URI's etc.

uwekamper commented 2 months ago

I added a small PR to fix this particular problem. All it does is checking if URI that is parsed by Python's own urllib.parse contains a scheme (parsed.scheme is not "").

See the PR here: https://github.com/internetstandards/Internet.nl/pull/1493