Re: Amavis and OpenDMARC

On 12/11/23 15:10, Noel Butler wrote:
>
> DMARC (thus OpenDMARC) makes its decision based on the senders DMARC 
> fo policy -
>
> if policy uses fo=0  then yes, both SPF and DKIM must exist, and both 
> must pass.
>
> if policy uses fo=1  then no, as a minimum /either/ SPF or DKIM must 
> exist, and pass, so DMARC will work with only SPF or only DKIM, it 
> will also work with both, which has the advantage that only one of 
> these must pass, eg: SPF passes but DKIM fails, DMARC usinng fo=1 will 
> pass.
>
> I recommend fo=1 for general use but fo=0 for critical areas, like 
> govts, legal and finance sectors, or those who deal with them on a 
> very regular basis, in which case they wouldn't be authorised to use 
> there govt/corp email for private use so if ill-configured mailing 
> lists for example rejected them, then that's acceptable collateral damage.
>
Hi Noel.

My understanding of the "fo" option is that it is only used for 
reporting. i.e. It doesn't control whether the received email is 
accepted or not, which is always based on /either/ SPF or DKIM checks 
passing.

 From RFC 7489:

    fo:  Failure reporting options (plain-text; OPTIONAL; default is "0")
       Provides requested options for generation of failure reports.
       Report generators MAY choose to adhere to the requested options.
       This tag's content MUST be ignored if a "ruf" tag (below) is not
       also specified...

Nick.