DMARC aggregate reports never arrive

dig +short TXT _dmarc.example.com

# a good result looks like:
# "v=DMARC1; p=quarantine; rua=mailto:agg@reports.example.net"

# bad results: no answer at all, more than one TXT string,
# or a record missing v=DMARC1

dig +short TXT example.com._report._dmarc.reports.example.net

# also check the wildcard fallback some providers publish instead:
dig +short TXT *._report._dmarc.reports.example.net

# bad results: NXDOMAIN, an empty answer, or a TXT value
# that does not contain v=DMARC1

# a second opinion with nslookup:
nslookup -type=TXT _dmarc.example.com

; specific authorization, on the reports.example.net zone
example.com._report._dmarc.reports.example.net.  3600  IN  TXT  "v=DMARC1"

; or, to authorize all subdomains of example.com as well
*._report._dmarc.reports.example.net.  3600  IN  TXT  "v=DMARC1"

; also confirm the DMARC record itself is one well formed TXT string
_dmarc.example.com.  3600  IN  TXT  "v=DMARC1; p=quarantine; rua=mailto:agg@reports.example.net; fo=1"

dig +short TXT example.com._report._dmarc.reports.example.net
dig @8.8.8.8 +short TXT example.com._report._dmarc.reports.example.net

# a good result now returns:
# "v=DMARC1"

# re-check the primary record too, confirm exactly one TXT string:
dig +short TXT _dmarc.example.com

# within 24-48 hours, check the rua mailbox or your DMARC
# reporting dashboard for new aggregate report XML files

"""Detect a missing DMARC third party report authorization record and
repair it via Cloudflare. Safe to run on a schedule. Stays in dry run
until DRY_RUN=false.
"""
import os
import logging

logging.basicConfig(level=logging.INFO, format="%(asctime)s %(levelname)s %(message)s")
log = logging.getLogger("dmarc_rua_auth_check")


def parse_rua_domain(dmarc_record_value: str):
    """Pure parser. No network, no I/O.

    Pulls the domain part out of the rua mailto address in a DMARC
    record string. Returns None if there is no rua tag.
    """
    for part in dmarc_record_value.split(";"):
        part = part.strip()
        if not part.lower().startswith("rua="):
            continue
        value = part.split("=", 1)[1]
        # rua can list more than one address, comma separated. Use the first.
        first = value.split(",")[0].strip()
        if first.lower().startswith("mailto:"):
            first = first[len("mailto:"):]
        if "@" in first:
            return first.split("@", 1)[1].strip()
    return None


def needs_third_party_auth(policy_domain: str, rua_domain: str, auth_txt_records: list, wildcard_txt_records: list) -> bool:
    """
    policy_domain: domain publishing the DMARC record (e.g. 'example.com')
    rua_domain: domain part of the rua mailto: address (e.g. 'reports.example.net')
    auth_txt_records: TXT record values found at f'{policy_domain}._report._dmarc.{rua_domain}'
    wildcard_txt_records: TXT record values found at f'*._report._dmarc.{rua_domain}'
    Returns True if authorization is required (domains differ) and missing/invalid in both the
    specific and wildcard record, meaning reports will be silently dropped.
    """
    if policy_domain == rua_domain or rua_domain.endswith("." + policy_domain):
        return False  # same-domain rua, no third-party auth needed per RFC 7489 7.1
    has_specific_auth = any("v=dmarc1" in r.lower().replace(" ", "") for r in auth_txt_records)
    has_wildcard_auth = any("v=dmarc1" in r.lower().replace(" ", "") for r in wildcard_txt_records)
    return not (has_specific_auth or has_wildcard_auth)


def run():
    # Imported lazily so the pure functions above can be tested with no
    # network libraries installed at all.
    import dns.resolver
    import requests

    policy_domain = os.environ["DNS_DOMAIN"]
    dry_run = os.environ.get("DRY_RUN", "true").lower() == "true"

    zone_id = os.environ["CLOUDFLARE_ZONE_ID"]
    api_token = os.environ["CLOUDFLARE_API_TOKEN"]

    resolver = dns.resolver.Resolver()

    def txt_values(name):
        try:
            answer = resolver.resolve(name, "TXT")
            return ["".join(part.decode() if isinstance(part, bytes) else part for part in rdata.strings)
                    for rdata in answer]
        except (dns.resolver.NXDOMAIN, dns.resolver.NoAnswer):
            return []

    dmarc_name = f"_dmarc.{policy_domain}"
    dmarc_records = txt_values(dmarc_name)
    if not dmarc_records:
        log.warning("No DMARC record found at %s", dmarc_name)
        return

    rua_domain = parse_rua_domain(dmarc_records[0])
    if rua_domain is None:
        log.warning("No rua tag found in DMARC record at %s", dmarc_name)
        return

    log.info("Policy domain %s reports to rua domain %s", policy_domain, rua_domain)

    auth_name = f"{policy_domain}._report._dmarc.{rua_domain}"
    wildcard_name = f"*._report._dmarc.{rua_domain}"
    auth_records = txt_values(auth_name)
    wildcard_records = txt_values(wildcard_name)

    if not needs_third_party_auth(policy_domain, rua_domain, auth_records, wildcard_records):
        log.info("Authorization already satisfied, or same-domain rua. Nothing to do.")
        return

    log.warning("Missing authorization record at %s. Reports are being silently dropped.", auth_name)
    log.info("%s create TXT %s = v=DMARC1", "Would" if dry_run else "Will", auth_name)
    if dry_run:
        return

    resp = requests.post(
        f"https://api.cloudflare.com/client/v4/zones/{zone_id}/dns_records",
        headers={"Authorization": f"Bearer {api_token}", "Content-Type": "application/json"},
        json={"type": "TXT", "name": auth_name, "content": "v=DMARC1", "ttl": 3600},
        timeout=30,
    )
    resp.raise_for_status()
    log.info("Created authorization record at %s", auth_name)


if __name__ == "__main__":
    run()

/**
 * Detect a missing DMARC third party report authorization record and
 * repair it via Cloudflare. Safe to run on a schedule. Stays in dry
 * run until DRY_RUN=false.
 */
import { pathToFileURL } from "node:url";

export function parseRuaDomain(dmarcRecordValue) {
  // Pure parser. No network, no I/O.
  for (const part of dmarcRecordValue.split(";")) {
    const trimmed = part.trim();
    if (!trimmed.toLowerCase().startsWith("rua=")) continue;
    const value = trimmed.slice(trimmed.indexOf("=") + 1);
    let first = value.split(",")[0].trim();
    if (first.toLowerCase().startsWith("mailto:")) first = first.slice("mailto:".length);
    if (first.includes("@")) return first.split("@")[1].trim();
  }
  return null;
}

export function needsThirdPartyAuth(policyDomain, ruaDomain, authTxtRecords, wildcardTxtRecords) {
  /**
   * policyDomain: domain publishing the DMARC record (e.g. 'example.com')
   * ruaDomain: domain part of the rua mailto: address (e.g. 'reports.example.net')
   * authTxtRecords: TXT record values found at `${policyDomain}._report._dmarc.${ruaDomain}`
   * wildcardTxtRecords: TXT record values found at `*._report._dmarc.${ruaDomain}`
   * Returns true if authorization is required (domains differ) and missing/invalid in both the
   * specific and wildcard record, meaning reports will be silently dropped.
   */
  if (policyDomain === ruaDomain || ruaDomain.endsWith(`.${policyDomain}`)) {
    return false; // same-domain rua, no third-party auth needed per RFC 7489 7.1
  }
  const hasSpecificAuth = authTxtRecords.some((r) => r.toLowerCase().replace(/ /g, "").includes("v=dmarc1"));
  const hasWildcardAuth = wildcardTxtRecords.some((r) => r.toLowerCase().replace(/ /g, "").includes("v=dmarc1"));
  return !(hasSpecificAuth || hasWildcardAuth);
}

export async function run() {
  // Imported lazily so the pure functions above can be tested with no
  // network modules touched at all.
  const dns = await import("node:dns");

  const policyDomain = process.env.DNS_DOMAIN;
  const dryRun = (process.env.DRY_RUN || "true").toLowerCase() === "true";

  const zoneId = process.env.CLOUDFLARE_ZONE_ID;
  const apiToken = process.env.CLOUDFLARE_API_TOKEN;

  const resolver = new dns.promises.Resolver();

  async function txtValues(name) {
    try {
      const answers = await resolver.resolveTxt(name);
      return answers.map((chunks) => chunks.join(""));
    } catch (err) {
      if (err.code === "ENOTFOUND" || err.code === "ENODATA") return [];
      throw err;
    }
  }

  const dmarcName = `_dmarc.${policyDomain}`;
  const dmarcRecords = await txtValues(dmarcName);
  if (dmarcRecords.length === 0) {
    console.warn(`No DMARC record found at ${dmarcName}`);
    return;
  }

  const ruaDomain = parseRuaDomain(dmarcRecords[0]);
  if (ruaDomain === null) {
    console.warn(`No rua tag found in DMARC record at ${dmarcName}`);
    return;
  }

  console.log(`Policy domain ${policyDomain} reports to rua domain ${ruaDomain}`);

  const authName = `${policyDomain}._report._dmarc.${ruaDomain}`;
  const wildcardName = `*._report._dmarc.${ruaDomain}`;
  const authRecords = await txtValues(authName);
  const wildcardRecords = await txtValues(wildcardName);

  if (!needsThirdPartyAuth(policyDomain, ruaDomain, authRecords, wildcardRecords)) {
    console.log("Authorization already satisfied, or same-domain rua. Nothing to do.");
    return;
  }

  console.warn(`Missing authorization record at ${authName}. Reports are being silently dropped.`);
  console.log(`${dryRun ? "Would" : "Will"} create TXT ${authName} = v=DMARC1`);
  if (dryRun) return;

  const res = await fetch(
    `https://api.cloudflare.com/client/v4/zones/${zoneId}/dns_records`,
    {
      method: "POST",
      headers: { Authorization: `Bearer ${apiToken}`, "Content-Type": "application/json" },
      body: JSON.stringify({ type: "TXT", name: authName, content: "v=DMARC1", ttl: 3600 }),
    },
  );
  if (!res.ok) throw new Error(`Cloudflare API returned ${res.status}`);
  console.log(`Created authorization record at ${authName}`);
}

if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {
  run().catch((err) => { console.error(err); process.exit(1); });
}

from dmarc_rua_auth_check import needs_third_party_auth, parse_rua_domain


def test_no_auth_needed_when_same_domain():
    assert needs_third_party_auth("example.com", "example.com", [], []) is False


def test_no_auth_needed_when_rua_is_subdomain():
    assert needs_third_party_auth("example.com", "mail.example.com", [], []) is False


def test_auth_needed_when_different_domain_and_missing():
    assert needs_third_party_auth("example.com", "reports.example.net", [], []) is True


def test_no_auth_needed_when_specific_record_present():
    result = needs_third_party_auth(
        "example.com", "reports.example.net", ["v=DMARC1"], []
    )
    assert result is False


def test_no_auth_needed_when_wildcard_record_present():
    result = needs_third_party_auth(
        "example.com", "reports.example.net", [], ["v=DMARC1"]
    )
    assert result is False


def test_parse_rua_domain_from_record():
    record = "v=DMARC1; p=quarantine; rua=mailto:agg@reports.example.net"
    assert parse_rua_domain(record) == "reports.example.net"


def test_parse_rua_domain_returns_none_without_rua():
    assert parse_rua_domain("v=DMARC1; p=none") is None

import { test } from "node:test";
import assert from "node:assert/strict";
import { needsThirdPartyAuth, parseRuaDomain } from "./dmarc-rua-auth-check.js";

test("no auth needed when same domain", () => {
  assert.equal(needsThirdPartyAuth("example.com", "example.com", [], []), false);
});

test("no auth needed when rua is subdomain", () => {
  assert.equal(needsThirdPartyAuth("example.com", "mail.example.com", [], []), false);
});

test("auth needed when different domain and missing", () => {
  assert.equal(needsThirdPartyAuth("example.com", "reports.example.net", [], []), true);
});

test("no auth needed when specific record present", () => {
  const result = needsThirdPartyAuth("example.com", "reports.example.net", ["v=DMARC1"], []);
  assert.equal(result, false);
});

test("no auth needed when wildcard record present", () => {
  const result = needsThirdPartyAuth("example.com", "reports.example.net", [], ["v=DMARC1"]);
  assert.equal(result, false);
});

test("parse rua domain from record", () => {
  const record = "v=DMARC1; p=quarantine; rua=mailto:agg@reports.example.net";
  assert.equal(parseRuaDomain(record), "reports.example.net");
});

test("parse rua domain returns null without rua", () => {
  assert.equal(parseRuaDomain("v=DMARC1; p=none"), null);
});