filter spamtrap

filter spf

filter dmarc

OpenSMTPD DMARC filter

Verify DMARC on incoming mail. Any sender can be allowed to skip DMARC and only pass based on SPF (this can be used with mailing lists).

Changelog

Build

Rust >= 1.88.0 is required (2024 edition).

git clone https://netsend.nl/opensmtpd-filter-dmarc.git
cd opensmtpd-filter-dmarc
cargo build --release

Install

install -m555 -gbin target/release/opensmtpd-filter-dmarc /usr/local/libexec/smtpd/filter-dmarc
useradd -d /var/empty -s /sbin/nologin _dmarc

smtpd.conf:

filter "dmarc" proc-exec "filter-dmarc" user _dmarc
listen on egress filter { dmarc }

Usage

Mailing lists can be allowed by the mailing list's envelope-sender domain if they pass SPF. Example:

echo openbsd.org         > /etc/mail/spf-only-domains
echo lists.openwall.com >> /etc/mail/spf-only-domains

Configure your smtpd.conf to start the filter with filter "dmarc" proc-exec "filter-dmarc --spf-only-domains /etc/mail/spf-only-domains" user _dmarc.

Once everything is set, restart smtpd.

Notes

• If a sender does not publish a DMARC record or a policy of none, pure SPF verification will be applied, this is a feature.
• p=quarantine currently proceeds normally as if p=none and as such falls back to pure SPF.
• The filter currently blocks all mail with an invalid UTF-8 body (attachments are commonly encoded in base64 so by itself this is not a problem).
• If you want to rely on the Authentication-Results header, make sure to put filter-admdscrub in front of it.
• This is a thin wrapper around Stalwart's DMARC, DKIM and SPF implementation.
• Currently on OpenBSD "inet" is pledged, hopefully we can remove this in the future by doing DNS operations in a separate process.
• The filter does not generate DMARC reports.

Syntax

usage: filter-dmarc [-v] [--spf-only-domains file]

  --spf-only-domains file
        envelope-sender domains for which DMARC must be skipped and pure
	SPF should run, one per line. Empty lines or lines starting with
	a # will be ignored.
  -v
        increase verbosity (up to -vv)

Code and repository

Browse the source code here or clone the repository:

$ git clone https://netsend.nl/opensmtpd-filter-dmarc.git