Skip to content

Fail if multiple DMARC records are present #939

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
adhilto merged 4 commits into from
Mar 16, 2026
Merged

Fail if multiple DMARC records are present #939

Show file tree
Hide file tree
Changes from 2 commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
2e62a1e
fail if multiple dmarc records
adhilto Mar 2, 2026
0d10eb1
improve dns table layout
adhilto Mar 2, 2026
c669578
fail if multiple spf records
adhilto Mar 2, 2026
671848f
add warning to details
adhilto Mar 3, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
93 changes: 93 additions & 0 deletions scubagoggles/Testing/Unit/Rego/gmail/gmail04_test.rego
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -101,6 +101,29 @@ test_DMARC_Incorrect_V2 if {
RuleOutput[0].ReportDetails == concat(" ", ["1 of 1 agency domain(s) found in violation: test.name.", DNSLink])
}

test_DMARC_Incorrect_V3 if {
# Test DMARC when there are multiple dmarc records
PolicyId := GmailId4_1
Output := tests with input as {
"dmarc_records": [
{
"domain": "test.name",
"rdata": [
"v=DMARC1; p=reject; pct=100; rua=mailto:DMARC@hq.dhs.gov, mailto:reports@dmarc.cyber.dhs.gov",
"v=DMARC1; p=reject"
]
}
],
"domains": ["test.name"]
}

RuleOutput := [Result | some Result in Output; Result.PolicyId == PolicyId]
count(RuleOutput) == 1
not RuleOutput[0].RequirementMet
not RuleOutput[0].NoSuchEvent
RuleOutput[0].ReportDetails == concat(" ", ["1 of 1 agency domain(s) found in violation: test.name.", DNSLink])
}

#
# GWS.GMAIL.4.2
#--
Expand Down Expand Up @@ -201,6 +224,29 @@ test_DMARCMessageReject_Incorrect_V2 if {
RuleOutput[0].ReportDetails == concat(" ", ["1 of 1 agency domain(s) found in violation: test.name.", DNSLink])
}

test_DMARCMessageReject_Incorrect_V3 if {
# Test DMARC when there are multiple dmarc records
PolicyId := GmailId4_2
Output := tests with input as {
"dmarc_records": [
{
"domain": "test.name",
"rdata": [
"v=DMARC1; p=reject; pct=100; rua=mailto:DMARC@hq.dhs.gov, mailto:reports@dmarc.cyber.dhs.gov",
"v=DMARC1; p=reject"
]
}
],
"domains": ["test.name"]
}

RuleOutput := [Result | some Result in Output; Result.PolicyId == PolicyId]
count(RuleOutput) == 1
not RuleOutput[0].RequirementMet
not RuleOutput[0].NoSuchEvent
RuleOutput[0].ReportDetails == concat(" ", ["1 of 1 agency domain(s) found in violation: test.name.", DNSLink])
}

#
# GWS.GMAIL.4.3
#--
Expand Down Expand Up @@ -301,6 +347,30 @@ test_DMARCAggregateReports_Incorrect_V2 if {
RuleOutput[0].ReportDetails == concat(" ", ["1 of 1 agency domain(s) found in violation: test.name.", DNSLink])
}

test_DMARCAggregateReports_Incorrect_V3 if {
# Test DMARC when there are multiple dmarc records
PolicyId := GmailId4_3
Output := tests with input as {
"dmarc_records": [
{
"domain": "test.name",
"rdata": [
"v=DMARC1; p=reject; pct=100; rua=mailto:DMARC@hq.dhs.gov, mailto:reports@dmarc.cyber.dhs.gov",
"v=DMARC1; p=reject"
]
}
],
"domains": ["test.name"]
}

RuleOutput := [Result | some Result in Output; Result.PolicyId == PolicyId]
count(RuleOutput) == 1
not RuleOutput[0].RequirementMet
not RuleOutput[0].NoSuchEvent
RuleOutput[0].ReportDetails == concat(" ", ["1 of 1 agency domain(s) found in violation: test.name.", DNSLink])
}


#
# GWS.GMAIL.4.4
#--
Expand Down Expand Up @@ -400,4 +470,27 @@ test_DMARCAgencyPOC_Incorrect_V2 if {
not RuleOutput[0].NoSuchEvent
RuleOutput[0].ReportDetails == concat(" ", ["1 of 1 agency domain(s) found in violation: test.name.", DNSLink])
}

test_DMARCAgencyPOC_Incorrect_V3 if {
# Test DMARC when there are multiple dmarc records
PolicyId := GmailId4_4
Output := tests with input as {
"dmarc_records": [
{
"domain": "test.name",
"rdata": [
"v=DMARC1; p=reject; pct=100; rua=mailto:DMARC@hq.dhs.gov, mailto:reports@dmarc.cyber.dhs.gov",
"v=DMARC1; p=reject"
]
}
],
"domains": ["test.name"]
}

RuleOutput := [Result | some Result in Output; Result.PolicyId == PolicyId]
count(RuleOutput) == 1
not RuleOutput[0].RequirementMet
not RuleOutput[0].NoSuchEvent
RuleOutput[0].ReportDetails == concat(" ", ["1 of 1 agency domain(s) found in violation: test.name.", DNSLink])
}
#--
7 changes: 5 additions & 2 deletions scubagoggles/rego/Gmail.rego
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -155,8 +155,8 @@ GmailId4_1 := utils.PolicyIdWithSuffix("GWS.GMAIL.4.1")
# Not applicable at OU or Group level
DomainsWithDmarc contains DmarcRecord.domain if {
some DmarcRecord in input.dmarc_records
some Rdata in DmarcRecord.rdata
startswith(Rdata, "v=DMARC1;")
ValidAnswers := [Answer | some Answer in DmarcRecord.rdata; startswith(Answer, "v=DMARC1;")]
count(ValidAnswers) == 1
}

tests contains {
Expand Down Expand Up @@ -189,6 +189,7 @@ DomainsWithPreject contains DmarcRecord.domain if {
some DmarcRecord in input.dmarc_records
some Rdata in DmarcRecord.rdata
contains(Rdata, "p=reject;")
DmarcRecord.domain in DomainsWithDmarc
}

tests contains {
Expand Down Expand Up @@ -217,6 +218,7 @@ DomainsWithDHSContact contains DmarcRecord.domain if {
some DmarcRecord in input.dmarc_records
some Rdata in DmarcRecord.rdata
contains(Rdata, "mailto:reports@dmarc.cyber.dhs.gov")
DmarcRecord.domain in DomainsWithDmarc
}

tests contains {
Expand Down Expand Up @@ -245,6 +247,7 @@ DomainsWithAgencyContact contains DmarcRecord.domain if {
some DmarcRecord in input.dmarc_records
some Rdata in DmarcRecord.rdata
count(split(Rdata, "@")) >= 3
DmarcRecord.domain in DomainsWithDmarc
}

tests contains {
Expand Down
2 changes: 1 addition & 1 deletion scubagoggles/reporter/reporter.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -875,7 +875,7 @@ def _build_report_html(self,
"Query Name": qname,
"Query Method": query['query_method'],
"Summary": query['query_result'],
"Answers": '\n'.join(answers)
"Answers": '<br>'.join(answers)
})
log_table = self.create_html_table(logs)
log_table = log_table.replace("<table>", "<table class='alternating dns-table'>")
Expand Down