cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
Announcements
Cisco Secure Email Support Community

Product Support Talos Support Cisco Support Reference + Current Release
Gateway Reputation Lookup Open a support case Secure Email Guided Setup
Gateway: 14.2.0-616
Cloud Gateway Email Status Portal Support & Downloads docs.ces.cisco.com
Email and Web Manager: 14.2.0-203
Email and Web Manager Web & Email Reputation Worldwide Contacts Product Naming Quick Reference
Reporting Plug-in: 1.1.0.136
Encryption Bug Search
Encryption Plug-in: 1.2.1.167
Cloud Mailbox Notification Service
Outlook Add-in(s): More info

1626
Views
5
Helpful
2
Replies
rolelael
Beginner

Ways to log/quarantine Dmarc = none , when dmarc fails

When an external party has a Dmarc record set to p = none ( states hey you don't need to act on it ) .... that mails comes in on our cisco esa's.. Its the external parties choice to tell us what we will need to do with mails that fails on Dmarc...

 

If there is no dmarc record specified ,I understand we can't act on that one ( besides acting on spf or dkim checks ) 

 

But..... we as a financial institute don't want such mails anyway where dmarc fails and p=none. I don't see an option to act on that on the cisco esa's ( there are only actions for reject/quarantine/Perm-temp errors)

 

I also checked the X-Ironport-Dmarc-Check-Result header, but that is just for use when verification fails

 

So is there a way on cisco esa's to act on p=none mails ???

1 ACCEPTED SOLUTION

Accepted Solutions
rolelael
Beginner

Hello Shane.. Well I already looked at that header ( since it was visible in the headers in O365 ) ... But I also found out that this header does not exist on the cisco esa's when a mail comes in. The Authentication-Results is offcourse.  As soon as the mail enters O365 , the Authentication-Results-Original is added and copies the info from the Authentication-Results ... 

 

Info I found ; the header filed "Authentication-Results-Original" contains the authentication results of a previous mailserver. When a mail server authenticates a message, it "writes" the result to the header field Authentication-Results. If this field already exists, its contents can be saved in the filed : Authentication-Results-Original   . This header and copy/action is NOT a standard

 

So I worked with the Authentication-Results header on Cisco and looked for 2 entries :

 

a) p=none

b) dmarc=fail

 

Voila that one solves my issues... 

 

But anyway thanks for your feedback

View solution in original post

2 REPLIES 2
shane.dollery
Beginner

Hi There,
You should be able to use an Incoming Content Filter to check for Other Header "Authentication-Results-Original:" (pretty sure) then contains "p=none" and take the appropriate action. You can add to the ESA logs, bcc the message to a Quarantine (which might be easier for checking and reporting).
Regards,

rolelael
Beginner

Hello Shane.. Well I already looked at that header ( since it was visible in the headers in O365 ) ... But I also found out that this header does not exist on the cisco esa's when a mail comes in. The Authentication-Results is offcourse.  As soon as the mail enters O365 , the Authentication-Results-Original is added and copies the info from the Authentication-Results ... 

 

Info I found ; the header filed "Authentication-Results-Original" contains the authentication results of a previous mailserver. When a mail server authenticates a message, it "writes" the result to the header field Authentication-Results. If this field already exists, its contents can be saved in the filed : Authentication-Results-Original   . This header and copy/action is NOT a standard

 

So I worked with the Authentication-Results header on Cisco and looked for 2 entries :

 

a) p=none

b) dmarc=fail

 

Voila that one solves my issues... 

 

But anyway thanks for your feedback

Create
Recognize Your Peers
Content for Community-Ad