Rspamd: [BUG] Invalid DMARC Aggregate Reports generated by rspamd

[prehor]

I have validated approximately 9600 DMARC Aggregate Reports generated by rspamd versions 1.8.3 and 1.9.1 during March and April on my mail server against XSD Schema in RFC7489. I have found three types of errors:

1) 82 reports contained in the reason element in policy_evaluated string sampled_out:

<policy_evaluated>
  <disposition> quarantine</disposition>
  <dkim>fail</dkim>
  <spf>fail</spf>
  <reason>sampled_out</reason>
</policy_evaluated>

The reason element is not a string, but a complex type with type and comment elements and reason must be in the type element:

<policy_evaluated>
  <disposition>quarantine</disposition>
  <dkim>fail</dkim>
  <spf>fail</spf>
  <reason>
    <type>sampled_out</type>
  </reason>
</policy_evaluated>

2) 81 reports contained in disposition element in policy_evaluated string softfail:

<policy_evaluated>
  <disposition>softfail</disposition>
  <dkim>fail</dkim>
  <spf>fail</spf>
</policy_evaluated>

The disposition element can contain only strings none, quarantine and reject. I think softfail should be changed to quarantine:

<policy_evaluated>
  <disposition>quarantine</disposition>
  <dkim>fail</dkim>
  <spf>fail</spf>
</policy_evaluated>

3) 5 reports did not contain any record element. These reports should never be sent.

---

Finally, I would like to ask whether it would be possible for mails that have a score above the Probably Spam level to not be included in DMARC reports. In my case, 1900 reports from 9600 were for domains from TLD .icu, from which we only get spam. I don't want to send to spammers information about how successful they are. This new feature was already described in #2745, which was unfortunately closed by stale bot.

[vstakhov]

The main problem in DMARC reporting is that the current code quality is very poor so the only way how to make it working is to rewrite this part of the plugin I'm afraid. On the other hand, I don't have any desire in doing that as well as it is not used by me anywhere...

[yoshimo]

In that case you should disable the code and remove the feature.

[vstakhov]

I think I'm still able to decide what to do, thanks.

[prehor]

It is a pity. Unfortunately I am not able to help with this because I do not know LUA at all.

Could you please fix the first bug? It should be quite simple and it is very difficult to solve it during validation. The second bug can be easily fixed during validation. The third error is not such a problem, the report is invalid and will be discarded during validation.

Without the limit to whom the reports will be sent, I can't imagine using this functionality.

[stale[bot]]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.