Update firststeps-dmarc_reporting.md
Dieser Commit ist enthalten in:
Ursprung
7c953ae4aa
Commit
8ceb276495
1 geänderte Dateien mit 41 neuen und 17 gelöschten Zeilen
|
@ -3,18 +3,18 @@ DMARC Reporting done via Rspamd DMARC Module.
|
|||
Rspamd documentation can be found here: https://rspamd.com/doc/modules/dmarc.html
|
||||
|
||||
**Important:**
|
||||
1. Before use examples bellow, change `example.com`, `mail.example.com` and `Example` to your actual data
|
||||
2. DMARC reporting require additional attention, especially at first days
|
||||
3. Your reports for all server will be send from one reporting domain. Recommended to use parent domain of your `MAILCOW_HOSTNAME`, f.e:
|
||||
- if your `MAILCOW_HOSTNAME=mail.example.com` then Reporting `domain = "example.com";`
|
||||
- set `email` from same domain also, `email = "noreply-dmarc@example.com";`
|
||||
1. Before you use the examples below, change `example.com`, `mail.example.com` and `Example` to reflect your setup
|
||||
2. DMARC reporting requires additional attention, especially over the first few days
|
||||
3. All receiving domains hosted on mailcow send from one reporting domain. Recommended to use parent domain of your `MAILCOW_HOSTNAME`, for example:
|
||||
- if your `MAILCOW_HOSTNAME=mail.example.com` then change your reporting config to match `domain = "example.com";`
|
||||
- set `email` from the same domain also, `email = "noreply-dmarc@example.com";`
|
||||
4. This optional, but recommended step: create `noreply-dmarc` email user in mailcow to handle bounces.
|
||||
- Go to mailcow admin UI → Configuration → Mail Setup → Mailboxes → Add mailbox → Create mailbox `noreply-dmarc`, please choose correct domain
|
||||
- In case you want silently discard bounces: login in SOGo from this account and go to Preferences → Mail → Filters → Create Filter → Add action → Provide name, f.e: `noreply` and add action: Discard the message and save filter
|
||||
- In case you plan to resend a copy of reports to yourself: you need add condition to previous filter example `From is not noreply-dmarc@example.com`
|
||||
- In case you want silently discard bounces: login in SOGo from this account and go to Preferences → Mail → Filters → Create Filter → Add action → Provide name, enter `noreply` and add action: Discard the message and save filter
|
||||
- In case you plan to resend a copy of reports to yourself, you need to add a condition to previous filter example `From is not noreply-dmarc@example.com`
|
||||
|
||||
## Enable DMARC Reporting
|
||||
1. Create or edit file in `data/conf/rspamd/local.d/dmarc.conf` and set content to:
|
||||
1. Create or edit file in `data/conf/rspamd/local.d/dmarc.conf` and set contents to:
|
||||
```
|
||||
reporting {
|
||||
enabled = true;
|
||||
|
@ -49,20 +49,44 @@ services:
|
|||
3. Run `docker-compose up -d`
|
||||
|
||||
## Send a copy reports to yourself
|
||||
To recieve a hidden copy of reports generated by Rspamd you can set a list of comma-separated emails via `bcc_addrs = ["noreply-dmarc@example.com","parsedmarc@example.com"];` in `reporting` section.
|
||||
To receive a hidden copy of reports generated by Rspamd you can set a `bcc_addrs` list in `reporting` section.
|
||||
|
||||
Rspamd will load changes in runtime, no need to restart it.
|
||||
```
|
||||
reporting {
|
||||
enabled = true;
|
||||
email = 'noreply-dmarc@example.com';
|
||||
bcc_addrs = ["noreply-dmarc@example.com","parsedmarc@example.com"];
|
||||
...
|
||||
```
|
||||
|
||||
Rspamd will load changes in real time, no need to restart it.
|
||||
|
||||
This useful in case:
|
||||
- you want to check that your DMARC Reports send correctly, e.g.: check that they signed by DKIM, etc.
|
||||
- you want to analyze own reports to get statics data, f.e: use with ParseDMARC or other analytic system
|
||||
- you want to check that your DMARC Reports send correctly, check that they signed by DKIM, etc.
|
||||
- you want to analyze own reports to get statics data, for example use with ParseDMARC or other analytic system
|
||||
|
||||
## Troubleshooting
|
||||
You can check:
|
||||
1. Run `docker-compose exec rspamd-mailcow ls -lah /var/lib/rspamd/dmarc_reports_last_log` to check when file was been modified last time
|
||||
2. Do `docker-compose exec rspamd-mailcow cat /var/lib/rspamd/dmarc_reports_last_log` to check last report output
|
||||
3. Manually trigger sending of DMARC reports via `rspamd-mailcow rspamadm dmarc_report` and check the output
|
||||
4. Validate that Rspamd has recorded data in Redis via `docker-compose exec redis-mailcow redis-cli KEYS 'dmarc;*'` and then run `docker-compose exec redis-mailcow redis-cli HGETALL "dmarc;example.com;date"`
|
||||
|
||||
Check when the report schedule last ran
|
||||
```
|
||||
docker-compose exec rspamd-mailcow date -r /var/lib/rspamd/dmarc_reports_last_log
|
||||
```
|
||||
|
||||
See last report output
|
||||
```
|
||||
docker-compose exec rspamd-mailcow cat /var/lib/rspamd/dmarc_reports_last_log
|
||||
```
|
||||
|
||||
Manually Trigger DMARC report
|
||||
```
|
||||
docker-compose exec rspamd-mailcow rspamadm dmarc_report
|
||||
```
|
||||
|
||||
Validate that Rspamd has recorded data in Redis
|
||||
```
|
||||
docker-compose exec redis-mailcow redis-cli KEYS 'dmarc;*'
|
||||
docker-compose exec redis-mailcow redis-cli HGETALL "dmarc;example.com;20211231"
|
||||
```
|
||||
|
||||
## Change DMARC Reporting Frequency
|
||||
In the example above reports are send once a 24 hours. To change this behaviour:
|
||||
|
|
Laden …
In neuem Issue referenzieren