filter spamtrap

filter spf

filter dmarc

OpenSMTPD DMARC filter

Verify DMARC on incoming mail.

Changelog

Build

Rust >= 1.88.0 is required (2024 edition).

git clone https://netsend.nl/opensmtpd-filter-dmarc.git
cd opensmtpd-filter-dmarc
cargo build --release

Install

install -m555 -gbin target/release/opensmtpd-filter-dmarc /usr/local/libexec/smtpd/filter-dmarc
useradd -d /var/empty -s /sbin/nologin _dmarc

smtpd.conf:

filter "dmarc" proc-exec "filter-dmarc" user _dmarc
listen on egress filter { dmarc }

Syntax

usage: filter-dmarc [-v] [--spf-only-domains file]

  --spf-only-domains file
        envelope-sender domains for which DMARC must be skipped and only SPF
	should be verified, one per line. Empty lines or lines starting with
	a # will be ignored.
  -v
        increase verbosity (up to -vv)

Mailing lists

Any domain can be exempted from DMARC verification, in that case only SPF is checked. Example allowing two mailing lists:

echo openbsd.org         > /etc/mail/spf-only-domains
echo lists.openwall.com >> /etc/mail/spf-only-domains

Configure your smtpd.conf to start the filter with the SPF-only domains:

filter "dmarc" proc-exec "filter-dmarc --spf-only-domains /etc/mail/spf-only-domains" user _dmarc

Notes

• If a sender does not publish a DMARC record or a policy of none, only SPF will be verified.
• p=quarantine currently proceeds normally as if p=none and as such falls back to SPF.
• If you want to rely on the Authentication-Results header, make sure to put filter-admdscrub in front of it.
• This is a thin wrapper around Stalwart's mail-auth library.
• The filter does not generate DMARC reports.

Code and repository

Browse the source code here or clone the repository:

$ git clone https://netsend.nl/opensmtpd-filter-dmarc.git