; 仅监控，不采取行动
_dmarc.example.com. IN TXT "v=DMARC1; p=none; rua=mailto:[email protected]; ruf=mailto:[email protected]; fo=1; ri=3600"

; 隔离未验证的邮件
_dmarc.example.com. IN TXT "v=DMARC1; p=quarantine; pct=25; rua=mailto:[email protected]; ruf=mailto:[email protected]; fo=1"

; 拒绝未验证的邮件
_dmarc.example.com. IN TXT "v=DMARC1; p=reject; rua=mailto:[email protected]; ruf=mailto:[email protected]; fo=1; ri=86400"

; 生产环境完整配置
_dmarc.example.com. IN TXT "v=DMARC1; p=reject; sp=reject; adkim=s; aspf=s; rua=mailto:[email protected]; ruf=mailto:[email protected]; fo=1; ri=86400; pct=100"

; example.com
_dmarc.example.com. IN TXT "v=DMARC1; p=reject; rua=mailto:[email protected]"

; example.org
_dmarc.example.org. IN TXT "v=DMARC1; p=reject; rua=mailto:[email protected]"

; 使用 redirect 重定向到统一报告地址
_dmarc.sub.example.com. IN TXT "v=DMARC1; redirect=example.com"

# 查询 DMARC 记录
dig TXT _dmarc.example.com +short

# 使用 nslookup
nslookup -type=TXT _dmarc.example.com

# 使用 Python 验证
python3 -c "
import dns.resolver
answers = dns.resolver.resolve('_dmarc.example.com', 'TXT')
for rdata in answers:
    print(rdata.to_text())
"

#!/bin/bash
# dmarc-check.sh — DMARC 记录检查脚本

DOMAIN="$1"

if [ -z "$DOMAIN" ]; then
    echo "用法: $0 <域名>"
    exit 1
fi

echo "=== DMARC 记录检查: $DOMAIN ==="

# 1. 查询 DMARC 记录
echo "[1/5] 查询 DMARC TXT 记录..."
DMARC_RECORD=$(dig +short TXT _dmarc.$DOMAIN | tr -d '"')

if [ -z "$DMARC_RECORD" ]; then
    echo "  ❌ 未找到 DMARC 记录"
    exit 1
else
    echo "  ✅ DMARC 记录: $DMARC_RECORD"
fi

# 2. 检查版本
echo "[2/5] 检查 DMARC 版本..."
if echo "$DMARC_RECORD" | grep -q "^v=DMARC1"; then
    echo "  ✅ DMARC 版本正确"
else
    echo "  ❌ DMARC 版本格式错误"
fi

# 3. 检查策略
echo "[3/5] 检查策略..."
if echo "$DMARC_RECORD" | grep -q "p=reject"; then
    echo "  ✅ 策略: reject（推荐）"
elif echo "$DMARC_RECORD" | grep -q "p=quarantine"; then
    echo "  ⚠️ 策略: quarantine（建议升级到 reject）"
elif echo "$DMARC_RECORD" | grep -q "p=none"; then
    echo "  ⚠️ 策略: none（仅监控，建议最终升级到 reject）"
fi

# 4. 检查报告地址
echo "[4/5] 检查报告地址..."
if echo "$DMARC_RECORD" | grep -q "rua=mailto:"; then
    RUA=$(echo "$DMARC_RECORD" | grep -oP 'rua=mailto:\K[^;]+')
    echo "  ✅ 聚合报告地址: $RUA"
else
    echo "  ⚠️ 未配置聚合报告地址"
fi

if echo "$DMARC_RECORD" | grep -q "ruf=mailto:"; then
    RUF=$(echo "$DMARC_RECORD" | grep -oP 'ruf=mailto:\K[^;]+')
    echo "  ✅ 失败报告地址: $RUF"
else
    echo "  ⚠️ 未配置失败报告地址"
fi

# 5. 检查对齐模式
echo "[5/5] 检查对齐模式..."
if echo "$DMARC_RECORD" | grep -q "adkim=s"; then
    echo "  DKIM 对齐: strict"
else
    echo "  DKIM 对齐: relaxed（默认）"
fi

if echo "$DMARC_RECORD" | grep -q "aspf=s"; then
    echo "  SPF 对齐: strict"
else
    echo "  SPF 对齐: relaxed（默认）"
fi

echo ""
echo "=== 检查完成 ==="

<?xml version="1.0" encoding="UTF-8"?>
<feedback>
  <report_metadata>
    <org_name>google.com</org_name>
    <email>[email protected]</email>
    <report_id>1234567890</report_id>
    <date_range>
      <begin>1715385600</begin>
      <end>1715472000</end>
    </date_range>
  </report_metadata>
  <policy_published>
    <domain>example.com</domain>
    <adkim>r</adkim>
    <aspf>r</aspf>
    <p>reject</p>
    <sp>reject</sp>
    <pct>100</pct>
  </policy_published>
  <record>
    <row>
      <source_ip>203.0.113.10</source_ip>
      <count>150</count>
      <policy_evaluated>
        <disposition>none</disposition>
        <dkim>pass</dkim>
        <spf>pass</spf>
      </policy_evaluated>
    </row>
    <identifiers>
      <header_from>example.com</header_from>
    </identifiers>
    <auth_results>
      <dkim>
        <domain>example.com</domain>
        <result>pass</result>
        <selector>mail</selector>
      </dkim>
      <spf>
        <domain>example.com</domain>
        <result>pass</result>
      </spf>
    </auth_results>
  </record>
</feedback>

# 安装解析工具
pip install dmarc-report-analyzer

# 使用脚本解析
#!/bin/bash
# parse-dmarc-reports.sh — DMARC 报告解析脚本

REPORT_DIR="/var/mail/dmarc-reports"
PARSED_DIR="/var/mail/dmarc-parsed"

mkdir -p "$PARSED_DIR"

# 解压报告
for report in $REPORT_DIR/*.gz; do
    echo "解析: $report"
    gunzip -c "$report" | python3 -c "
import sys
import xml.etree.ElementTree as ET

xml_data = sys.stdin.read()
root = ET.fromstring(xml_data)

org = root.find('.//report_metadata/org_name').text
domain = root.find('.//policy_published/domain').text
print(f'组织: {org}')
print(f'域名: {domain}')

for record in root.findall('.//record'):
    ip = record.find('.//source_ip').text
    count = record.find('.//count').text
    dkim = record.find('.//policy_evaluated/dkim').text
    spf = record.find('.//policy_evaluated/spf').text
    print(f'  IP: {ip}, 数量: {count}, DKIM: {dkim}, SPF: {spf}')
"
done

# 创建专用邮箱
sudo postconf -e "virtual_alias_maps = hash:/etc/postfix/virtual"

# 添加别名
# /etc/postfix/virtual
[email protected]    [email protected]
[email protected]    [email protected]

sudo postmap /etc/postfix/virtual
sudo systemctl reload postfix

; 使用 dmarcian 的报告收集服务
_dmarc.example.com. IN TXT "v=DMARC1; p=reject; rua=mailto:[email protected]"

#!/bin/bash
# dmarc-report-processor.sh — 自动处理 DMARC 报告

REPORT_EMAIL="/var/mail/vhosts/example.com/dmarc-rua/new/*"
OUTPUT_DIR="/var/www/dmarc-reports/$(date +%Y-%m-%d)"

mkdir -p "$OUTPUT_DIR"

# 处理新报告
for email in $REPORT_EMAIL; do
    echo "处理: $email"
    
    # 提取附件
    munpack -q -C "$OUTPUT_DIR" "$email"
    
    # 解压 .gz 文件
    for gz in "$OUTPUT_DIR"/*.gz; do
        [ -f "$gz" ] && gunzip "$gz"
    done
    
    # 移动已处理的邮件
    mv "$email" /var/mail/vhosts/example.com/dmarc-rua/cur/
done

# 解析报告
for xml in "$OUTPUT_DIR"/*.xml; do
    [ -f "$xml" ] && python3 /usr/local/bin/parse-dmarc-xml.py "$xml" >> "$OUTPUT_DIR/report-summary.txt"
done

echo "报告处理完成: $OUTPUT_DIR"

# 第 1 周：监控模式
_dmarc.example.com. IN TXT "v=DMARC1; p=none; rua=mailto:[email protected]; fo=1; ri=3600"

# 第 4 周：隔离模式（25%）
_dmarc.example.com. IN TXT "v=DMARC1; p=quarantine; pct=25; rua=mailto:[email protected]; ruf=mailto:[email protected]; fo=1"

# 第 6 周：拒绝模式
_dmarc.example.com. IN TXT "v=DMARC1; p=reject; rua=mailto:[email protected]; ruf=mailto:[email protected]; fo=1"