Log DMARC DNS lookup failures instead of silently skipping protection - #2074
Open
paulmenzel wants to merge 1 commit into
Open
Log DMARC DNS lookup failures instead of silently skipping protection#2074paulmenzel wants to merge 1 commit into
paulmenzel wants to merge 1 commit into
Conversation
`_check_dmarc_rr()` uses `Net::DNS::Resolver::query()`, which returns undef
both when the sender domain publishes no DMARC record and when the lookup
itself fails. The failure case is therefore taken for "no record", From: is
left unmunged and the message is rejected by receivers enforcing DMARC, with
no log entry at any log level - not even at `log_level 5`, which shows only:
[debug] DMARC protection on
[debug] From address: <someone@gmx.de>
Lookups do fail in practice. In issue sympa-community#1969 SELinux blocked the daemon's UDP
socket, the only trace being an AVC in /var/log/audit/audit.log:
type=AVC msg=audit(1752302753.696:85038): avc: denied { create } for pid=1739896 comm="bulk.pl" scontext=system_u:system_r:sympa_t:s0 tcontext=system_u:system_r:sympa_t:s0 tclass=udp_socket permissive=0
A systemd sandbox, a firewall or a broken resolver produce the same silence.
Use `send()`, which returns a packet whenever the resolver replied at all –
including NXDOMAIN and NOERROR with an empty answer section – and undef only
on a real transport or resolver failure, and report that failure:
[err] DNS lookup of "_dmarc.gmx.de" TXT failed: Network is unreachable. DMARC protection is not applied
`$packet->answer` stays empty for domains without a record, so the remaining
logic is unchanged.
Verified against sympa 6.2.76~dfsg-1 on Debian 13 (trixie), Net::DNS 1.56,
perl 5.40.1: From: someone@gmx.de (v=DMARC1; p=quarantine) with
`dmarc_protection.mode=dmarc_reject,dmarc_quarantine` is still munged with
working DNS, the new err entry appears with the network removed, and
someone@iana.org (p=none, and a NXDOMAIN subdomain of it) logs no error.
Assisted-by: Claude Opus 5 (Claude Code)
Author
|
Description is in the commit message. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.