[Fix] DMARC: evaluate the From and envelope domains as seen in the message

DMARC must align identifiers and look up the policy for the RFC5322.From
domain as it appears in the message, and check SPF alignment against the
RFC5321.MailFrom as transmitted. Use the 'orig' address flavour so that
rewrites done via task:set_from (e.g. by the aliases module) do not
affect alignment, policy lookup or rua report attribution.

Issue: #6137

diff --git a/src/plugins/lua/dmarc.lua b/src/plugins/lua/dmarc.lua
index ef524e47d9cf2bd561df301ae7f38badf6965dbe..cca98bb1de91a5b92d4bcb224c253b84428255c6 100644 (file)
--- a/src/plugins/lua/dmarc.lua
+++ b/src/plugins/lua/dmarc.lua
@@ -76,7 +76,9 @@ local function dmarc_validate_policy(task, policy, hdrfromdom, dmarc_esld)
   local spf_tmpfail = false
   local dkim_tmpfail = false
 
-  local spf_domain = ((task:get_from(1) or E)[1] or E).domain
+  -- SPF alignment is checked against the envelope domain as it was seen in
+  -- the message, before any rewrite (e.g. by the aliases module)
+  local spf_domain = ((task:get_from({ 'smtp', 'orig' }) or E)[1] or E).domain
 
   if not spf_domain or spf_domain == '' then
     spf_domain = task:get_helo() or ''
@@ -450,7 +452,10 @@ local function dmarc_validate_policy(task, policy, hdrfromdom, dmarc_esld)
 end
 
 local function dmarc_callback(task)
-  local from = task:get_from(2)
+  -- DMARC must evaluate the RFC5322.From domain as it was seen in the
+  -- message; rewrites done via task:set_from (e.g. by the aliases module)
+  -- must not affect alignment, policy lookup or reporting
+  local from = task:get_from({ 'mime', 'orig' })
   local hfromdom = ((from or E)[1] or E).domain
   local dmarc_domain
   local ip_addr = task:get_ip()