cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
2737
Views
5
Helpful
2
Replies

Ways to log/quarantine Dmarc = none , when dmarc fails

rolelael
Level 1
Level 1

When an external party has a Dmarc record set to p = none ( states hey you don't need to act on it ) .... that mails comes in on our cisco esa's.. Its the external parties choice to tell us what we will need to do with mails that fails on Dmarc...

 

If there is no dmarc record specified ,I understand we can't act on that one ( besides acting on spf or dkim checks ) 

 

But..... we as a financial institute don't want such mails anyway where dmarc fails and p=none. I don't see an option to act on that on the cisco esa's ( there are only actions for reject/quarantine/Perm-temp errors)

 

I also checked the X-Ironport-Dmarc-Check-Result header, but that is just for use when verification fails

 

So is there a way on cisco esa's to act on p=none mails ???

1 Accepted Solution

Accepted Solutions

rolelael
Level 1
Level 1

Hello Shane.. Well I already looked at that header ( since it was visible in the headers in O365 ) ... But I also found out that this header does not exist on the cisco esa's when a mail comes in. The Authentication-Results is offcourse.  As soon as the mail enters O365 , the Authentication-Results-Original is added and copies the info from the Authentication-Results ... 

 

Info I found ; the header filed "Authentication-Results-Original" contains the authentication results of a previous mailserver. When a mail server authenticates a message, it "writes" the result to the header field Authentication-Results. If this field already exists, its contents can be saved in the filed : Authentication-Results-Original   . This header and copy/action is NOT a standard

 

So I worked with the Authentication-Results header on Cisco and looked for 2 entries :

 

a) p=none

b) dmarc=fail

 

Voila that one solves my issues... 

 

But anyway thanks for your feedback

View solution in original post

2 Replies 2

shane.dollery
Level 1
Level 1
Hi There,
You should be able to use an Incoming Content Filter to check for Other Header "Authentication-Results-Original:" (pretty sure) then contains "p=none" and take the appropriate action. You can add to the ESA logs, bcc the message to a Quarantine (which might be easier for checking and reporting).
Regards,

rolelael
Level 1
Level 1

Hello Shane.. Well I already looked at that header ( since it was visible in the headers in O365 ) ... But I also found out that this header does not exist on the cisco esa's when a mail comes in. The Authentication-Results is offcourse.  As soon as the mail enters O365 , the Authentication-Results-Original is added and copies the info from the Authentication-Results ... 

 

Info I found ; the header filed "Authentication-Results-Original" contains the authentication results of a previous mailserver. When a mail server authenticates a message, it "writes" the result to the header field Authentication-Results. If this field already exists, its contents can be saved in the filed : Authentication-Results-Original   . This header and copy/action is NOT a standard

 

So I worked with the Authentication-Results header on Cisco and looked for 2 entries :

 

a) p=none

b) dmarc=fail

 

Voila that one solves my issues... 

 

But anyway thanks for your feedback

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: