DMARC p=reject ???????????????????????

2.2 ?????????????????/h3>

?????????????????????????????strong>???????/strong>???????????????????????/strong>??/p>

# Gmail ?????????????????
Authentication-Results: mx.google.com;
       dkim=**fail** header.i=@partner-domain.com header.s=dkim1024;
       spf=**fail** (google.com: domain of sender@partner-domain.com does not designate 198.51.100.20 as permitted sender) smtp.mailfrom=sender@partner-domain.com;
       dmarc=**fail** (p=REJECT sp=REJECT dis=QUARANTINE) header.from=partner-domain.com

# ????????# 1. dkim=fail ??????????? DKIM ?????????
# 2. spf=fail ??????????? SPF ????????? IP
# 3. dmarc=fail ?????????????? DMARC ??????
# 4. dis=QUARANTINE ??Gmail ????????????????????p=REJECT??? Gmail ???????????????

2.3 ??? Gmail ???????/h3>

??????????????????????????? Google Admin Toolbox Messageheader ????????/p>

# ????????????
# https://toolbox.googleapps.com/apps/messageheader/
#
# ??????????????????????????? "???" ??????
# - ???????????? SPF/DKIM/DMARC ???
# - ??????????????# - ?????????

????????? DNS ??????????????

# ??? DMARC ???
dig TXT _dmarc.partner-domain.com +short
# ?????v=DMARC1; p=reject; sp=reject; rua=mailto:dmarc@partner-domain.com"

# ??? SPF ???
dig TXT partner-domain.com +short
# ?????????????IP ???????
# ??? DKIM ???
dig TXT dkim1024._domainkey.partner-domain.com +short

????MARC DNS ?????????

3.1 Google Postmaster Tools (GPT) ??????

???????????? Gmail ???????? Google Postmaster Tools ?????? DMARC ????????????????Google ??????????????????

1. ??? https://postmaster.google.com
2. ??Gmail ??????????????????
3. ???????????DNS ???
4. ??? "???" (Authentication) ?????   ?????PF ?????/ DKIM ?????/ DMARC ?????/ ???????????5. ??? "??????? ?????   ???????????? / SMTP ????????/ ?????
# ?????????
# DMARC ?????< 95%  ?????????# SPF ?????< 90%   ??SPF ?????????
# DKIM ?????< 85%  ??DKIM ???????????MTA ???

3.2 ????????????

??2??MARC ?????????

???	?????/th>	???
Google Check MX	Google	???????SPF??KIM??MARC ??????
dmarctest.com	PowerDMARC	????????????????? DMARC ??????
mail-tester.com	???	??????????????SPF/DKIM/DMARC??/td>
DMARC Analyzer	Red Sift	rua ????????+ ???????????????
dmarcian checker	dmarcian	DMARC DNS ??????

# ??? dmarctest.com API ??????????????????? API key??curl -X POST https://api.dmarctest.com/v1/send-test \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -d '{"from_address": "test@example.com", "to_address": "check@dmarctest.com"}'

????ua ?????????

4.1 DMARC rua ??????

RFC 7489 Section 7 ?????XML ???????????????????? Google??icrosoft??ahoo?????DMARC ????????? rua URI????????XML ???????????????????????????

• ???????????????
• ??????????????????????ontact info??/li>
• ???????????PF ?????KIM ?????MARC ???????????IP??????????eader From

4.2 ??? parsedmarc ??????

?????????????parsedmarc ???????????rua ?????/p>

# ??? parsedmarc??ython 3.9+??pip install parsedmarc

# ??? parsedmarc
cat > /etc/parsedmarc/config.ini << 'INI'
[general]
save_aggregate = True
save_forensic = True

[elasticsearch]
hosts = localhost:9200
# ???????? ELK ????????
[imap]
host = imap.example.com
user = dmarc-reports@example.com
password = YOUR_SECURE_PASSWORD
watch = True
report_folder = INBOX/dmarc-reports
archive_folder = INBOX/dmarc-reports/archive
INI

# ????????????
parsedmarc -c /etc/parsedmarc/config.ini --no-recurse

# ????????????
cat > /usr/local/bin/analyze-dmarc-reports.py << 'PYTHON'
#!/usr/bin/env python3
"""
??? parsedmarc CSV ????????DMARC ???????? Top 10 ??? IP ?????"""
import csv
import sys
from collections import Counter

failures_per_ip = Counter()
failures_per_domain = Counter()

reader = csv.DictReader(sys.stdin)
for row in reader:
    dmarc_disposition = row.get('disposition', '')
    if dmarc_disposition in ('reject', 'quarantine'):
        failures_per_ip[row.get('source_ip_address', 'unknown')] += 1
        failures_per_domain[row.get('header_from', 'unknown')] += 1

print("=== DMARC ???????? Top 10 ??? IP ===")
for ip, count in failures_per_ip.most_common(10):
    print(f"  {ip}: {count} ?????)

print("\n=== DMARC ???????? Top 10 Header From ??? ===")
for domain, count in failures_per_domain.most_common(10):
    print(f"  {domain}: {count} ?????)
PYTHON
chmod 755 /usr/local/bin/analyze-dmarc-reports.py

# ??? CSV ?????parsedmarc -c /etc/parsedmarc/config.ini \
  --output-format csv \
  --output-file - 2>/dev/null | \
  /usr/local/bin/analyze-dmarc-reports.py

4.3 ??????????????????

??3??ua ????????????

??????	??????	???	??????
SPF fail + DKIM pass	DKIM=pass, SPF=fail, DMARC=pass ??fail	??? IP ?????? SPF ?????????????????DKIM ???	??? SPF ????????IP?????? DKIM ?????? d= ??header.From ????/td>
SPF pass + DKIM fail	SPF=pass, DKIM=fail, DMARC=pass ??fail	????????? mailing list??????????????? DKIM ??????	??? ARC??FC 8617????????DKIM ??? mta ??? l= ???????????? p=quarantine
?????? fail	SPF=fail, DKIM=fail	??????????????????	?????????????????? SPF/DKIM/DMARC
?????????	????????? sub.example.com	??? SPF/DKIM ??????	????????????????? SPF?????? sp= ???

????PF/DKIM ??????

5.1 SPF ??????

??rua ????????? SPF fail ??????????SPF ????????strong>????????FC 7208 Section 10.1 ??? SPF ????10 ??DNS ??????include ?????/strong>??/p>

# SPF ????????DNS ??????
dig TXT example.com +short

# ??? SPF ??? include ???????????????
dig TXT example.com +short | grep -oP 'include:\S+' | wc -l
# ???????????????? include ??DNS ??????

# ??? SPF ???????? spf-tools??pip install spf-tools
spf-tools check example.com

# ??? openspf.org ??SPF ?????# https://www.kitterman.com/spf/validate.html

SPF ????????/p>

cat > /usr/local/bin/spf-debug.sh << 'SH'
#!/bin/bash
# SPF ???????????IP ?????SPF ??????
if [ -z "$1" ] || [ -z "$2" ]; then
  echo "???: $0  "
  echo "???: $0 example.com 203.0.113.5"
  exit 1
fi

DOMAIN="$1"
IP="$2"

echo "=== SPF ???: $DOMAIN / $IP ==="
echo ""

# ??? SPF ???
SPF=$(dig TXT "$DOMAIN" +short | grep -E '^"v=spf')
if [ -z "$SPF" ]; then
  echo "???????SPF ???"
  exit 1
fi
echo "SPF ???: $SPF"
echo ""

# SPF ?????????
INCLUDES=$(echo "$SPF" | grep -oP 'include:\S+' | sed 's/include://g')
echo "include ???: $INCLUDES"
total_queries=1
for inc in $INCLUDES; do
  inc_queries=$(dig TXT "$inc" +short | grep -oP 'include:\S+' | wc -l)
  total_queries=$(( total_queries + inc_queries + 1 ))
done
echo "??DNS ????????????: $total_queries / 10"
echo ""

# ??? Python ?????? SPF ????pip3 install pyspf -q 2>/dev/null
python3 -c "
import spf
result, detail = spf.check2('$IP', '$DOMAIN')
print(f'SPF ??????? {result}')
print(f'???: {detail}')
" 2>/dev/null
SH
chmod 755 /usr/local/bin/spf-debug.sh

5.2 DKIM ??????

DKIM ???????????????????????NS ????????????????????/p>

# ?????? DKIM ???
cat > /tmp/test-dkim.sh << 'SH'
#!/bin/bash
# ??? opendkim ????????DKIM ???
opendkim-testmsg -d example.com -D /tmp/dkim_keys < /tmp/email.eml

# ?????rspamc ??DKIM ???
rspamc -h localhost:11334 symbols < /tmp/email.eml

# ??? DKIM ????????grep -i 'DKIM-Signature' /tmp/email.eml

# ????DKIM ????????dig TXT 20260101._domainkey.example.com +short
# ??????: "v=DKIM1; h=sha256; k=rsa; p=MIGfMA0G..."
SH

# ?????DKIM ??????
cat > /usr/local/bin/dkim-verify-mail.sh << 'SH'
#!/bin/bash
# ??????????????DKIM ???
if [ ! -f "$1" ]; then
  echo "???: $0 "
  exit 1
fi

echo "=== DKIM ?????? ==="
echo ""
echo "--- ?????? DKIM-Signature ??? ---"
grep -i '^DKIM-Signature' "$1" | head -3

echo ""
echo "--- ??? opendkim ??? ---"
opendkim-testmsg "$1" 2>&1
result=$?
if [ "$result" -eq 0 ]; then
  echo "??DKIM ?????????"
else
  echo "??DKIM ????????? (exit code: $result)"
fi

echo ""
echo "--- ??? rspamd DKIM ??? ---"
if command -v rspamc &>/dev/null; then
  rspamc -h localhost:11334 symbols < "$1" 2>&1 | grep -i dkim
fi
SH
chmod 755 /usr/local/bin/dkim-verify-mail.sh

???????????????????/h2>

6.1 ??????????????????

?????????????????? Salesforce??endesk??ailchimp ????????? SPF include ??DKIM ????????? rua ?????????????????????????????????????????????????/p>

??4??????????????SPF/DKIM ???

???	SPF include	DKIM ????????
Mailchimp	include:servers.mcsv.net	k1._domainkey
Salesforce	include:_spf.salesforce.com	salesforce._domainkey
Zendesk	include:mail.zendesk.com	zendesk._domainkey
SendGrid	include:sendgrid.net	sg._domainkey?????????
Mailgun	include:mailgun.org	mg._domainkey
Amazon SES	include:amazonses.com	amazonses._domainkey

6.2 ???????????/h3>

????????? DMARC ??????????????????????????????

1. ????????????????SPF include ??DKIM ??? ?????????? DMARC ???????????/li>
2. ????????????????/strong> ????newsletter.example.com????????sp=quarantine ?????????
3. ??????????????RFC 5782 ??Sender Rewriting Scheme ???????? Envelope From ??? SPF

?????????????????/strong>???????????????????????????????????/p>

# ????????????????SPF/DKIM
# ??????????????SPF ?????DKIM ??????

# ????????? DMARC ??pct ?????????
# ??DMARC ????????v=DMARC1; p=reject; sp=reject; pct=50; rua=mailto:dmarc@example.com
# ?????50% ???????????????????????????????? 100%

# ?????????????????????
# ?????MARC ??????????????????
# ????????????????????????????????

6.3 RFC ??????"????????

???????????DMARC ?????????????????????????????Google???????????????????????? DMARC ?????????????????????????/p>

• SPF ?????????????????????IP
• DKIM ????????????????????????
• ?????? Google Postmaster Tools ????????????

??????????????????????????????????????????????/p>

# ????????? DMARC ????????????????????dig TXT _dmarc.outlook.com +short
# ??? Microsoft ??DMARC ???????????DMARC ???????????
# ????????Gmail?????? Google ??????
# https://support.google.com/mail/contact/forms/recipientfeedback
# ??????????????????????? 1-2 ??/code>

???????????????????/h2>

7.1 ??????????????/h3>

DMARC ?????? sp=??ubdomain policy???????????????????FC 7489 Section 6.3 ?????? sp= ????????????????????p= ???

# ??? A: sp=reject ??p=reject ???
_dmarc.example.com.  IN  TXT  "v=DMARC1; p=reject; sp=reject; ..."
# ??????*.example.com ??????????? SPF/DKIM ???

# ??? B: ?????????
_dmarc.example.com.  IN  TXT  "v=DMARC1; p=reject; sp=quarantine; ..."
# ??????????????????????
# ??? C: ?????? ?????????????????
_dmarc.sub.example.com.  IN  TXT  "v=DMARC1; p=none; ..."
# ???????sub.example.com ??DMARC ???

7.2 ???????????/h3>

??????"???????rganizational Domain?????????????????? DMARC ????????/p>

• Google ??? Public Suffix List (PSL) ????????/li>
• Microsoft ???????????????
• ???????????? d= ??header.from ???????????

???????????? .com.cn??code>.co.uk????????DMARC ????????? example.co.uk ????????? DMARC ?????????????????/p>

# ??? publicsuffix.org ??API ????????curl -s https://publicsuffix.org/list/public_suffix_list.dat | \
  grep -E '^// (cn|uk|jp)' | head -5

# ???????????PSL ?????python3 -c "
from publicsuffix2 import get_sld
print(get_sld('sub.example.co.uk'))
# ???: example.co.uk
"

??????????????

8.1 ???????????/h3>

??? p=reject ??????????????????????????????

??5??MARC ???????????/caption>

???	???	??????	???
?????/td>	p=none; rua=mailto:...	2-4 ??/td>	????????????
?????/td>	p=quarantine; pct=25	1-2 ??/td>	???????????/td>
?????/td>	p=quarantine; pct=100	1-2 ??/td>	?????????
?????/td>	p=reject; pct=25	1-2 ??/td>	?????? reject
?????/td>	p=reject; pct=100	???	??????

8.2 ?????????

# ??p=reject ?????p=quarantine????????# ??? DNS ???
_dmarc.example.com.  IN  TXT  "v=DMARC1; p=quarantine; sp=quarantine; rua=mailto:dmarc@example.com; pct=50"

# ????????????????????????????????????
# ?????????????? DMARC ???????????????
# ???????????
# ??????????????parsedmarc -c /etc/parsedmarc/config.ini \
  --aggregate-json-lines | \
  jq 'select(.disposition == "reject") | {source_ip, header_from, count}' | \
  head -20

8.3 ?????????????????/h3>

?????????????????????????????Gmail??utlook.com????????????????????????????????? DMARC ??????????????????????????????????????????????????????????????????SPF/DKIM ????????????????????? DMARC ?????/p>

# Gmail ????????????
# https://support.google.com/mail/contact/msgdelivery

# Microsoft SNDS (Smart Network Data Services)
# https://sendersupport.olc.protection.outlook.com/snds/

# Yahoo ????????# https://help.yahoo.com/kb/SLN3428.html

???????/h3>

1. RFC 7489 ??Domain-based Message Authentication, Reporting, and Conformance (DMARC). IETF, March 2015.
2. RFC 8601 ??Message Header Field for Indicating Message Authentication Status. IETF, April 2019.
3. RFC 7208 ??Sender Policy Framework (SPF) for Authorizing Use of Domains in Email, Version 1. IETF, April 2014.
4. RFC 6376 ??DomainKeys Identified Mail (DKIM) Signatures. IETF, September 2011.
5. RFC 8617 ??The Authenticated Received Chain (ARC) Protocol. IETF, July 2019.
6. RFC 5782 ??DNS Whitelisting (DNSWL) for Email Filtering. IETF, February 2010.
7. Google Postmaster Tools. https://postmaster.google.com/
8. M3AAWG ??DMARC Implementation Guide (2025 Edition).
9. NIST SP 800-177 Rev. 1 ??Trustworthy Email, Section 5.3: Domain Authentication.
10. IETF DMARC WG ??Interim Reporting and Handling Considerations (2026 Draft).

引用本文

ztpop.net 知识库编辑. "DMARC p=reject ???????????????????????" ztpop.net 知识库.

本站技术文章采用 CC-BY 4.0 许可，可自由引用，仅需标注来源 ztpop.net。

?????ztpop.net ???????????????????????????????????????/a>??

本站技术文章采用 CC-BY 4.0 许可，可自由引用，仅需标注来源 ztpop.net。