From e7f7eb80d19e35c8cb5baccd5a0484f0aa045117 Mon Sep 17 00:00:00 2001 From: Aaron Ten Clay Date: Fri, 18 Aug 2023 08:53:24 -0700 Subject: [PATCH] Disable OpenDMARC sending reports OpenDMARC report messages, while potentially useful for peer operators of mail servers, are abusable and should not be enabled by default. This change prioritizes the safety of the Box's reputation. --- setup/dkim.sh | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/setup/dkim.sh b/setup/dkim.sh index b2541a12..d2d162a7 100755 --- a/setup/dkim.sh +++ b/setup/dkim.sh @@ -63,7 +63,7 @@ chmod go-rwx $STORAGE_ROOT/mail/dkim tools/editconf.py /etc/opendmarc.conf -s \ "Syslog=true" \ "Socket=inet:8893@[127.0.0.1]" \ - "FailureReports=true" + "FailureReports=false" # SPFIgnoreResults causes the filter to ignore any SPF results in the header # of the message. This is useful if you want the filter to perfrom SPF checks @@ -82,11 +82,11 @@ tools/editconf.py /etc/opendmarc.conf -s \ tools/editconf.py /etc/opendmarc.conf -s \ "SPFSelfValidate=true" -# Enables generation of failure reports for sending domains that publish a +# Disables generation of failure reports for sending domains that publish a # "none" policy. tools/editconf.py /etc/opendmarc.conf -s \ - "FailureReportsOnNone=true" + "FailureReportsOnNone=false" # AlwaysAddARHeader Adds an "Authentication-Results:" header field even to # unsigned messages from domains with no "signs all" policy. The reported DKIM