附录 A. 失败报告示例
本附录给出一个完整的 DMARC failure report 示例, 包括外层消息头, MIME multipart/report 结构, 面向人的说明部分, message/feedback-report 部分, 以及原始失败消息的 message/rfc822 部分. 该示例用于说明失败报告如何同时携带传输元数据, ARF 字段, DMARC failure type, identity alignment 信息, DKIM/SPF 相关字段和原始邮件内容.
下方报文是协议样例数据, 邮件头字段, DKIM-Signature, Authentication-Results, MIME boundary, IP 地址和域名均需保持原样. 中文导读说明各部分用途: 第一部分是报告消息自身, 第二部分是可读说明, 第三部分是 machine-readable feedback report, 第四部分是触发失败报告的原始消息. 实现者可用该示例验证解析器是否能识别 Feedback-Type: auth-failure, Auth-Failure: dmarc, Identity-Alignment, DKIM 字段和原始 message/rfc822 内容.
该示例还展示了失败报告中的安全敏感信息量: 原始消息头, 转发路径, DKIM selector, Authentication-Results 和 Source-IP 都可能泄露发送路径或认证配置. 因此, 实现者在生成, 接收和存储失败报告时, 应结合正文的隐私和安全考虑进行访问控制, 速率限制和日志保护. 本附录的目的不是建议真实部署中的字段值, 而是提供一个覆盖多种字段的解析样本.
下面是一个失败消息样例的完整内容, 包括消息头. 样例先给出报告生成方发送给报告接收方的外层消息, 然后通过 MIME boundary 分隔各个报告实体. text/plain 实体提供面向人的说明, message/feedback-report 实体提供 ARF 字段, 最后的 message/rfc822 实体则嵌入被报告的原始消息. 这些字段共同说明接收系统为什么认为认证失败与 DMARC 有关, 以及该判断涉及哪些 DKIM/SPF 结果.
Received: from gen.example (gen.example [192.0.2.1])
(TLS: TLS1.3,256bits,ECDHE_RSA_AES_256_GCM_SHA384)
by mail.consumer.example with ESMTPS
id 00000000005DC0DD.0000442E; Tue, 19 Jul 2022 07:57:50 +0200
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple;
d=gen.example; s=mail; t=1658210268;
bh=rCrh1aFDE8d/Fltt8wbcu48bLOu4OM23QXqphUZPAIM=;
h=From:To:Date:Subject:From;
b=IND9JkuwF9/5841kzxMbPeej0VYimVzNKozR2R89M8eYO2zOlCBblx507Gz0YK7mE
/h6pslWm0ODBVFzLlwY9CXv4Vu62QsN0RBIXHPjEXOkoM2VCD5zCd+5i5dtCFX7Mxh
LThb2ZJ3efklbSB9RQRwxcmRvCPV7z6lt/Ds9sucVE1RDODYHjx+iWnAUQrlos6ZQb
u/YOUGjf60LPpyljfPu3EpFwo80mSHyQlP/4S5KEykgPQMgCqLPPKvJwu1aAIDj+jG
q2ylO3fmc/ERDeDWACtR67YNabEKBWtjqCRLNxKttazViJTZ5drcLfpX0853KoougX
Rltp7zdoLdy4A==
From: DMARC Filter <[email protected]>;
To: [email protected]
Date: Tue, 19 Jul 2022 00:57:48 -0500 (CDT)
Subject: FW: This is the original subject
Mime-Version: 1.0
Content-Type: multipart/report; report-type=feedback-report;
boundary="=_mime_boundary_"
Message-Id: <[email protected]>;
This is a MIME-formatted message. If you see this text it means that
your E-mail software does not support MIME-formatted messages.
--=_mime_boundary_
Content-Type: text/plain; charset=utf-8
Content-Disposition: inline
Content-Transfer-Encoding: 7bit
This is an authentication failure report for an email message
received from IP 192.0.2.2 on Tue, 19 Jul 2022 00:57:48 -0500.
--=_mime_boundary_
Content-Type: message/feedback-report
Content-Transfer-Encoding: 7bit
Feedback-Type: auth-failure
Version: 1
User-Agent: DMARC-Filter/1.2.3
Auth-Failure: dmarc
Authentication-Results: gen.example;
dmarc=fail header.from=consumer.example
Identity-Alignment: dkim
DKIM-Domain: consumer.example
DKIM-Identity: @consumer.example
DKIM-Selector: epsilon
Original-Envelope-Id: 65E1A3F0A0
Original-Mail-From: [email protected]
Source-IP: 192.0.2.2
Source-Port: 12345
Reported-Domain: consumer.example
--=_mime_boundary_
Content-Type: message/rfc822; charset=utf-8
Content-Transfer-Encoding: 7bit
Authentication-Results: gen.example;
dkim=permerror header.d=forwarder.example header.b="EjCbN/c3";
dkim=temperror header.d=forwarder.example header.b="mQ8GEWPc";
dkim=permerror header.d=consumer.example header.b="hETrymCb";
dkim=neutral header.d=consumer.example header.b="C2nsAp3A";
Received: from mail.forwarder.example
(mail.forwarder.example [IPv6:2001:db8::23ac])
by mail.gen.example (Postfix) with ESMTP id 5E8B0C159826
for <[email protected]>; Sun, 14 Aug 2022 07:58:29 -0700 (PDT)
Received: from mail.forwarder.example (localhost [127.0.0.1])
by mail.forwarder.example (Postfix) with ESMTP id 4Ln7Qw4fnvz6Bq
for <[email protected]>; Tue, 19 Jul 2022 07:57:44 +0200
DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed;
d=forwarder.example; s=ed25519-59hs; t=1658210264;
x=1663210264; bh=KYH/g7ForvDbnyyDLYSjauMYMW6sEIqu75/9w3OIONg=;
h=Message-ID:Date:List-Id:List-Archive:List-Post:List-Help:
List-Subscribe:List-Unsubscribe:List-Owner:MIME-Version:Subject:
To:References:From:In-Reply-To:Content-Type:
Content-Transfer-Encoding:autocrypt:cc:content-transfer-encoding:
content-type:date:from:in-reply-to:message-id:mime-version:
openpgp:references:subject:to;
b=EjCbN/c3bTU4QkZH/zwTbYxBDp0k8kpmWSXh5h1M7T8J4vtRo+hvafJazT3ZRgq+7
+4dzEQwUhl+NOJYXXNUAA==
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=forwarder.example; s=rsa-wgJg; t=1658210264; x=1663210264;
bh=KYH/g7ForvDbnyyDLYSjauMYMW6sEIqu75/9w3OIONg=;
h=Message-ID:Date:List-Id:List-Archive:List-Post:List-Help:
List-Subscribe:List-Unsubscribe:List-Owner:MIME-Version:Subject:
To:References:From:In-Reply-To:Content-Type:
Content-Transfer-Encoding:autocrypt:cc:content-transfer-encoding:
content-type:date:from:in-reply-to:message-id:mime-version:
openpgp:references:subject:to;
b=mQ8GEWPcVpBpeqQ88pcbXpGHBT0J/Rwi8Zd2WZTXWWneQGRCOJLRcbBJpjqnrwtqd
76IqawH86tihz4Z/12J1GBCdNx1gfazsoI3yaqfooRDYg0mSyZHrYhQBmodnPcqZj4
/25L5278sc/UNrYO9az2n7R/skbVZ0bvSo2eEiGU8fcpO8+a5SKNYskhaviAI4eGIB
iRMdEP7gP8dESdnZguNbY5HI32UMDpPPNqajzd/BgcqbveYpRrWCDOhcY47POV7GHM
i/KLHiZXtJsL3/Pr/4TL+HTjdX8EDSsy1K5/JCvJCFsJHnSvkEaJQGLn/2m03eW9r8
9w1bQ90aY+VCQ==
X-Original-To: [email protected]
Received: from mail.consumer.example
(mail.consumer.example [192.0.2.4])
(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
key-exchange ECDHE (P-256) server-signature ECDSA (P-384)
server-digest SHA384)
(Client did not present a certificate)
by mail.forwarder.example (Postfix) with ESMTPS id 4Ln7Qs55xmz4nP
for <[email protected]>;
Tue, 19 Jul 2022 07:57:41 +0200 (CEST)
Authentication-Results: mail.forwarder.example;
arc=none smtp.remote-ip=192.0.2.4
Authentication-Results: mail.forwarder.example;
dkim=pass (512-bit key; secure) header.d=consumer.example
[email protected] header.a=ed25519-sha256
header.s=epsilon header.b=hETrymCb;
dkim=pass (1152-bit key; secure) header.d=consumer.example
[email protected] header.a=rsa-sha256
header.s=delta header.b=C2nsAp3A
DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed;
d=consumer.example; s=epsilon; t=1658210255;
bh=KYH/g7ForvDbnyyDLYSjauMYMW6sEIqu75/9w3OIONg=;
h=Date:Subject:To:References:From:In-Reply-To;
b=hETrymCbz6T1Dyo5dCG9dk8rPykKLdhJCPFeJ9TiiP/kaoN2afpUYtj+SrI+I83lp
p1F/FfYSGy7zz3Q3OdxBA==
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=consumer.example; s=delta; t=1658210255;
bh=KYH/g7ForvDbnyyDLYSjauMYMW6sEIqu75/9w3OIONg=;
h=Date:To:References:From:In-Reply-To;
b=C2nsAp3AMNX33Nq7nN/StPo921xE3XGF8Ju3iAKdYB3EKhsril0N5IjWGlglJECst
jLNKSo7KWZZ2lkH/dVZ9Rs1GHT2uaKy1sc/xmNIC5rHdhrxammiwpTSo4PsT8disfc
3DVF6Q62n0EsdLFqcw1KY8A9inFqYKY2tqoo+y4zMtItqCYx3xjsj3I0IFLuX
Author: Message Author <[email protected]>
Received: from [192.0.2.8] (host-8-2-0-192.isp.example [192.0.2.8])
(AUTH: CRAM-MD5 uXDGrn@SYT0/k, TLS: TLS1.3,128bits,
ECDHE_RSA_AES_128_GCM_SHA256)
by mail.consumer.example with ESMTPSA
id 00000000005DC076.00004417; Tue, 19 Jul 2022 07:57:35 +0200
Message-ID: <[email protected]>
Date: Tue, 19 Jul 2022 07:57:33 +0200
List-Id: <users.forwarder.example>
List-Post: <mailto:[email protected]>
List-Help: <mailto:[email protected]>
List-Subscribe: <mailto:[email protected]>
List-Unsubscribe: <mailto:[email protected]>
List-Owner: <mailto:[email protected]>
Precedence: list
MIME-Version: 1.0
Subject: This is the original subject
Content-Language: en-US
To: [email protected]
Authentication-Results: consumer.example; auth=pass (details omitted)
From: Message Author <[email protected]>
In-Reply-To: <[email protected]>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 8bit
[ Message body was here ]
--=_mime_boundary_--
Source-Port 字段的定义见 [RFC6692].
在最后一个 MIME 实体中, To 和 From 地址的 local-part 未经遮蔽即被报告. 由于 local-part 属于 PII, 可以通过遮蔽它们来降低隐私风险. 在本示例中, 报告生成方本可以在整个实体中将 "users" 替换为 "lRLxexey", 并将 "author" 替换为 "RT47aVey".
如果不包含消息正文, 最后一个 MIME 实体会使用 Content-Type: text/rfc822-headers, 而不是 message/rfc822.
实现者在处理这类报告时需要区分三类信息: 报告本身的传输封装, ARF 定义的认证失败元数据, 以及原始消息副本或其头部摘要. 解析器不应把外层报告消息的认证结果误认为原始消息的认证结果, 也不应把示例中的域名, 地址或 selector 当作部署建议. 对隐私敏感的系统还应在发送前评估是否需要移除正文, 截断头部, 或对 local-part 进行一致性遮蔽, 以便在保留诊断价值的同时减少个人信息暴露.