Ways to log/quarantine Dmarc = none , when dmarc fails

[rolelael]

When an external party has a Dmarc record set to p = none ( states hey you don't need to act on it ) .... that mails comes in on our cisco esa's.. Its the external parties choice to tell us what we will need to do with mails that fails on Dmarc...

If there is no dmarc record specified ,I understand we can't act on that one ( besides acting on spf or dkim checks ) 

But..... we as a financial institute don't want such mails anyway where dmarc fails and p=none. I don't see an option to act on that on the cisco esa's ( there are only actions for reject/quarantine/Perm-temp errors)

I also checked the X-Ironport-Dmarc-Check-Result header, but that is just for use when verification fails

So is there a way on cisco esa's to act on p=none mails ???

[shane.dollery]

Hi There,
You should be able to use an Incoming Content Filter to check for Other Header "Authentication-Results-Original:" (pretty sure) then contains "p=none" and take the appropriate action. You can add to the ESA logs, bcc the message to a Quarantine (which might be easier for checking and reporting).
Regards,

[rolelael · Accepted solution]

Hello Shane.. Well I already looked at that header ( since it was visible in the headers in O365 ) ... But I also found out that this header does not exist on the cisco esa's when a mail comes in. The Authentication-Results is offcourse.  As soon as the mail enters O365 , the Authentication-Results-Original is added and copies the info from the Authentication-Results ... 

Info I found ; the header filed "Authentication-Results-Original" contains the authentication results of a previous mailserver. When a mail server authenticates a message, it "writes" the result to the header field Authentication-Results. If this field already exists, its contents can be saved in the filed : Authentication-Results-Original   . This header and copy/action is NOT a standard

So I worked with the Authentication-Results header on Cisco and looked for 2 entries :

a) p=none

b) dmarc=fail

Voila that one solves my issues... 

But anyway thanks for your feedback