DMARC notifications

[ArjanBroekhuizen]

Hello,

We have configured DMARC filtering in our ESA and that is working well. However, we want to send notifications to an admin or recipient when a message is send to quarantaine. I cannot find an option to do this.

I found a post about this and an enhancement request, but it is not clear what the status is.
https://community.cisco.com/t5/email-security/dmarc-notification/td-p/4265593
https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvn54567

Is there an alternitave option to configure both quarantaine and notifications for DMARC? Can this be done with filter on the header?

Kind regards,
Arjan

[UdupiKrishna]

Since these messages if quarantined would go to Policy, notification isn't possible. However your thoughts are in the right path, you can setup a content filter to scan "authentication-results" header and specifically look for dmarc result values (fail, quarantine etc) after reviewing the headers of a few samples.

Then setup an action to notify specific addresses.