On Mon 01/Nov/2021 23:25:30 +0100 Scott Kitterman wrote:
Could you perhaps do an assessment of the percentages of email you see where
5322.From == Org domain
5322.From is a sub-domain of Org domain
5321.MailFrom == 5322.From
5321.MailFrom is a sub-domain of 5322.From
5322.From is a sub-domain of 5321.From
d= domain == 5322.From
d= domain is a sub-domain of 5322.From
5322.From is a sub-domain of d= domain
I think that something like this would be very helpful for the group to
understand what is currently used.
I don't currently have access to a large corpus of email either. However, I
managed to find the time to produce some stats. On my disk I got:
307655 80.27% 5322.From == Org domain
75614 19.73% 5322.From is a sub-domain of Org domain
204514 53.36% 5321.MailFrom == 5322.From
25384 6.62% 5321.MailFrom is a sub-domain of 5322.From
6348 1.66% 5322.From is a sub-domain of 5321.From
145138 37.87% 5322.From not related to 5321.From
177731 46.37% d= domain == 5322.From
5896 1.54% d= domain is a sub-domain of 5322.From
13954 3.64% 5322.From is a sub-domain of d= domain
93398 24.37% d= domain not related to 5322.From
150056 39.15% d= domain == Org domain
47877 12.49% d= domain is a sub-domain of Org domain
1 0.00% Org domain is a sub-domain of d= domain
93045 24.28% d= domain not related to Org domain
383269 files processed
38433 files skipped (37837 silently)
Files with neither a Return-Path nor a DKIM-Signature (no identifier) were
silently skipped. Other files were skipped for various reasons. For each
file, only one DKIM signature per type is counted.
The utility to produce that list is here, if someone wants to give it a try:
https://www.tana.it/alignmentstats-0.tar.gz
Best
Ale
--
ale@pcale:~/tmp/zdkimfilter/assess$ sha256sum alignmentstats-0.tar.gz
aa3eb2f036789006dcc5b65ce0492061d5d9827c9f2c5ed8638e2736e4c97ca0
alignmentstats-0.tar.gz
_______________________________________________
dmarc mailing list
[email protected]
https://www.ietf.org/mailman/listinfo/dmarc
