From 62efe985f17817493119ca8584e5b91ed5e99e59 Mon Sep 17 00:00:00 2001 From: Aaron Ten Clay Date: Sat, 2 Sep 2023 04:10:04 -0700 Subject: [PATCH] Disable OpenDMARC sending reports (#2299) OpenDMARC report messages, while potentially useful for peer operators of mail servers, are abusable and should not be enabled by default. This change prioritizes the safety of the Box's reputation. --- setup/dkim.sh | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/setup/dkim.sh b/setup/dkim.sh index b2541a12..d2d162a7 100755 --- a/setup/dkim.sh +++ b/setup/dkim.sh @@ -63,7 +63,7 @@ chmod go-rwx $STORAGE_ROOT/mail/dkim tools/editconf.py /etc/opendmarc.conf -s \ "Syslog=true" \ "Socket=inet:8893@[127.0.0.1]" \ - "FailureReports=true" + "FailureReports=false" # SPFIgnoreResults causes the filter to ignore any SPF results in the header # of the message. This is useful if you want the filter to perfrom SPF checks @@ -82,11 +82,11 @@ tools/editconf.py /etc/opendmarc.conf -s \ tools/editconf.py /etc/opendmarc.conf -s \ "SPFSelfValidate=true" -# Enables generation of failure reports for sending domains that publish a +# Disables generation of failure reports for sending domains that publish a # "none" policy. tools/editconf.py /etc/opendmarc.conf -s \ - "FailureReportsOnNone=true" + "FailureReportsOnNone=false" # AlwaysAddARHeader Adds an "Authentication-Results:" header field even to # unsigned messages from domains with no "signs all" policy. The reported DKIM