[Rspamd-Users] DMARC reporting, discarding reports to specific domains/addresses?

[Michael Kliewe]

Am 16.09.2022 um 22:46 schrieb Vsevolod Stakhov:
> On 16/09/2022 11:37, Max Grobecker wrote:
>> Hello,
>>
>> we let Rspamd send DMARC reports, which is all working fine.
>> However, we get about 10% undeliverable mails of this because of full 
>> or unknown destination mailboxes because of oblivious receipients.
>>
>> Is there a way to tell Rspamd to not send DMARC reports regarding 
>> specific domains or to specific receipients, maybe using a map?
>> I haven't found something like this in the docs.
Hi,

I would love to have a centralized "source of trust" where I can 
regularly download such a list, and where I can report those "dead" 
DMARC mailboxes, so everyone can share and benefit.  There are mailboxes 
which are full since multiple weeks, which don't accept attachments at 
all, which don't exist ("recipient does not exist"), and so on...

Maybe rspamd.com could have a list of such email addresses, where people 
can report those dead DMARC mailboxes via website, and download a 
map/list. Maybe a small website similar to https://bl.rspamd.com/

An email address is only listed in the map if more than X people report 
the same email address. It's only listed for 6 months or so (or until 
someone requests a removal). If dozens of people fill that list, 
everyone benefits by having less bounces/"recipient unknown" errors, 
which currently reduce outbound reputation... I know some people who 
disabled DMARC reporting because of those bounces and negative impact on 
their outbound reputation...

I currently have a small list in my Postfix. A list of email addresses 
to which I DISCARD the dmarc mails because they had DMARC bounces in the 
past. Not perfect, but enough for my small server:

--------------------------------

cd /etc/postfix/
nano recipient_dmarc_report_bounce_accesslist
dmarc at domain1.de      DISCARD discarded because of DMARC report bounces 
in the past
abuse at domain2.com     DISCARD discarded because of DMARC report bounces 
in the past
...

In main.cf:
smtpd_recipient_restrictions_block_dmarc_bounces = 
check_recipient_access 
hash:/etc/postfix/recipient_dmarc_report_bounce_accesslist

In master.cf in block for 587+465:
  -o 
smtpd_recipient_restrictions=$smtpd_recipient_restrictions_block_dmarc_bounces

postmap recipient_dmarc_report_bounce_accesslist
systemctl restart postfix

--------------------------------

Michael