Adam Williamson wrote: > On Fri, 2026-09-04 at 23:31 +0200, Björn Persson wrote: > > Adam Williamson wrote: > > > Finally, DMARC is a kinda meta mechanism: it lets you tell recipient > > > systems what you think they should do if mails fail any of the *other* > > > checks. > > > > Not really, because it checks another thing than SPF does. SPF works > > in the SMTP layer. It checks the envelope sender address and the "HELO" > > identity. DMARC works in the Internet Message Format layer. It performs > > SPF-like checks on the From header field instead. > > Well, the truth appears to be between the two. As the DMARC spec puts > it: > > "SPF [RFC7208] can validate the uses of both the domain found in an > SMTP [RFC5321] HELO/EHLO command (the HELO identity) and the domain > found in an SMTP MAIL command (the MAIL FROM identity). DMARC relies > solely on SPF validation of the MAIL FROM identity."
The address in the SMTP MAIL command isn't always the same as the one in the From header field. When this message reaches you, the domain in the SMTP command will be lists.fedoraproject.org, but in the header field it's rombobjörn.se. I shouldn't have written "instead". It's an additional requirement. DMARC requires "Identifier Alignment" between the From header field and the MAIL FROM identity, in addition to SPF's validation of the MAIL FROM identity. There's a rather complex algorithm for determining whether they are in "relaxed alignment". Thus DMARC does more than just tell recipient systems what to do if mails fail SPF or DKIM checks. I quote RFC 9989: | 3.2.2. Author Domain | | The Author Domain is the domain name of the apparent author as | extracted from the RFC5322.From header field. | 3.2.4. SPF Domain | | [...] | | The term "SPF Domain" when used in this document refers to an SPF- | validated MAIL FROM identity. | 4.3. Authentication Mechanisms | | [...] | | * SPF [RFC7208]: The validated SPF Domain (Section 3.2.4) from the | email message is the Authenticated Identifier. | 3.2.10. Identifier Alignment | | DMARC describes the concept of alignment between the Author Domain | (Section 3.2.2) and an Authenticated Identifier (Section 3.2.1) and | requires such Identifier Alignment between the two for a message to | achieve a DMARC pass. DMARC defines two states for alignment. | | 3.2.10.1. Relaxed Alignment | | When the Author Domain (Section 3.2.2) has the same Organizational | Domain (Section 3.2.14) as an Authenticated Identifier (Section | 3.2.1), the two are said to be in relaxed alignment. | | 3.2.10.2. Strict Alignment | | When the Author Domain (Section 3.2.2) is identical to an | Authenticated Identifier (Section 3.2.1), the two are said to be in | strict alignment. Björn Persson
pgpEBqSAPONXZ.pgp
Description: OpenPGP digital signatur
-- _______________________________________________ devel mailing list -- [email protected] To unsubscribe send an email to [email protected] Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/[email protected] Do not reply to spam, report it: https://forge.fedoraproject.org/infra/tickets/issues/new
