-
-
Notifications
You must be signed in to change notification settings - Fork 0
DMARC: pct= tag not enforced #103
Copy link
Copy link
Closed
Labels
area:securitySPF/DKIM/DMARC, TLSSPF/DKIM/DMARC, TLSeffort:SA few hoursA few hoursprio:P1HighHighstatus:reviewWaiting for reviewWaiting for reviewtype:securitySecurity issue or hardeningSecurity issue or hardening
Metadata
Metadata
Assignees
Labels
area:securitySPF/DKIM/DMARC, TLSSPF/DKIM/DMARC, TLSeffort:SA few hoursA few hoursprio:P1HighHighstatus:reviewWaiting for reviewWaiting for reviewtype:securitySecurity issue or hardeningSecurity issue or hardening
Type
Fields
Give feedbackNo fields configured for issues without a type.
RFC 7489 §6.6.2 requires that messages outside the
pct=percentile be treated as if policy werenone, effectively downgrading enforcement. Currentlypct=is parsed but silently discarded — every failing message is rejected/quarantined regardless of the percentage.Fix: parse
pct=intoRecord, apply sampling inevaluate()viaring::rand::SystemRandom. Non-numeric values are a parse error (permerror).