SES passes SPF and DKIM but DMARC still fails

"""Report SES identities whose Return-Path is not aligned with the From domain.

DMARC passes only if SPF or DKIM passes AND aligns with the From domain. Without a
custom MAIL FROM, SES uses an amazonses.com subdomain, so the SPF leg never aligns
and DMARC rests entirely on DKIM -- which breaks the first time a forwarder rewrites
the message.
"""
import argparse
import logging
import sys

import boto3

logging.basicConfig(level=logging.INFO, format="%(asctime)s %(levelname)s %(message)s")
log = logging.getLogger("ses_mail_from_audit")


def alignment_problem(identity, attrs):
    """Pure decision function over GetEmailIdentity's MailFromAttributes.

    Three distinct states matter, and only one of them is fine.
    """
    domain = (attrs or {}).get("MailFromDomain")
    status = (attrs or {}).get("MailFromDomainStatus")
    if not domain:
        return f"{identity}: no custom MAIL FROM, so SPF aligns to amazonses.com and DMARC rests on DKIM alone"
    if status != "SUCCESS":
        return f"{identity}: MAIL FROM {domain} is {status}, so SES is still using the default"
    if not domain.endswith(identity) and identity not in domain:
        return f"{identity}: MAIL FROM {domain} is not a subdomain of the identity, so it does not align"
    return None


def main():
    ap = argparse.ArgumentParser()
    ap.add_argument("--region", default="us-east-1")
    ap.add_argument("--set-on", help="identity to configure")
    ap.add_argument("--subdomain", help="e.g. mail.yourdomain.com")
    ap.add_argument("--apply", action="store_true")
    args = ap.parse_args()

    ses = boto3.client("sesv2", region_name=args.region)

    problems = 0
    for ident in ses.list_email_identities().get("EmailIdentities", []):
        name = ident["IdentityName"]
        detail = ses.get_email_identity(EmailIdentity=name)
        problem = alignment_problem(name, detail.get("MailFromAttributes"))
        if problem:
            problems += 1
            log.error(problem)
        else:
            log.info("%s: MAIL FROM aligned", name)

    if args.set_on and args.subdomain:
        if args.apply:
            ses.put_email_identity_mail_from_attributes(
                EmailIdentity=args.set_on,
                MailFromDomain=args.subdomain,
                BehaviorOnMxFailure="USE_DEFAULT_VALUE",
            )
            log.info("set MAIL FROM %s on %s", args.subdomain, args.set_on)
        else:
            log.info("WOULD set MAIL FROM %s on %s -- pass --apply", args.subdomain, args.set_on)
        log.info("now publish, in the %s zone:", args.subdomain)
        log.info("  MX  10 feedback-smtp.%s.amazonses.com", args.region)
        log.info('  TXT "v=spf1 include:amazonses.com ~all"')
    return 1 if problems else 0


if __name__ == "__main__":
    sys.exit(main())

/**
 * Report SES identities whose Return-Path is not aligned with the From domain.
 *
 * DMARC passes only if SPF or DKIM passes AND aligns with the From domain. Without
 * a custom MAIL FROM, SES uses an amazonses.com subdomain, so the SPF leg never
 * aligns and DMARC rests entirely on DKIM.
 */
import {
  SESv2Client,
  ListEmailIdentitiesCommand,
  GetEmailIdentityCommand,
  PutEmailIdentityMailFromAttributesCommand,
} from '@aws-sdk/client-sesv2';

/**
 * Pure decision function over GetEmailIdentity's MailFromAttributes.
 * Three distinct states matter, and only one of them is fine.
 */
export function alignmentProblem(identity, attrs) {
  const domain = attrs?.MailFromDomain;
  const status = attrs?.MailFromDomainStatus;
  if (!domain) {
    return `${identity}: no custom MAIL FROM, so SPF aligns to amazonses.com and DMARC rests on DKIM alone`;
  }
  if (status !== 'SUCCESS') {
    return `${identity}: MAIL FROM ${domain} is ${status}, so SES is still using the default`;
  }
  if (!domain.endsWith(identity) && !domain.includes(identity)) {
    return `${identity}: MAIL FROM ${domain} is not a subdomain of the identity, so it does not align`;
  }
  return null;
}

async function main() {
  const region = process.env.AWS_REGION ?? 'us-east-1';
  const apply = process.argv.includes('--apply');
  const setOn = process.argv[process.argv.indexOf('--set-on') + 1];
  const subdomain = process.argv[process.argv.indexOf('--subdomain') + 1];
  const ses = new SESv2Client({ region });

  let problems = 0;
  const { EmailIdentities = [] } = await ses.send(new ListEmailIdentitiesCommand({}));
  for (const ident of EmailIdentities) {
    const name = ident.IdentityName;
    const detail = await ses.send(new GetEmailIdentityCommand({ EmailIdentity: name }));
    const problem = alignmentProblem(name, detail.MailFromAttributes);
    if (problem) { problems += 1; console.error(problem); }
    else console.log(`${name}: MAIL FROM aligned`);
  }

  if (process.argv.includes('--set-on') && subdomain) {
    if (apply) {
      await ses.send(new PutEmailIdentityMailFromAttributesCommand({
        EmailIdentity: setOn, MailFromDomain: subdomain,
        BehaviorOnMxFailure: 'USE_DEFAULT_VALUE',
      }));
      console.log(`set MAIL FROM ${subdomain} on ${setOn}`);
    } else {
      console.log(`WOULD set MAIL FROM ${subdomain} on ${setOn} -- pass --apply`);
    }
    console.log(`now publish, in the ${subdomain} zone:`);
    console.log(`  MX  10 feedback-smtp.${region}.amazonses.com`);
    console.log('  TXT "v=spf1 include:amazonses.com ~all"');
  }
  process.exit(problems ? 1 : 0);
}

if (import.meta.url === `file://${process.argv[1]}`) main();

from ses_mail_from_audit import alignment_problem


def test_no_mail_from_is_a_problem():
    assert "amazonses.com" in alignment_problem("example.com", None)


def test_empty_attributes_are_treated_as_absent():
    assert alignment_problem("example.com", {}) is not None


def test_pending_status_is_still_a_problem():
    """SES has not verified the DNS yet, so it is still using the default."""
    out = alignment_problem("example.com",
                            {"MailFromDomain": "mail.example.com",
                             "MailFromDomainStatus": "PENDING"})
    assert "PENDING" in out


def test_aligned_subdomain_is_clean():
    assert alignment_problem("example.com",
                             {"MailFromDomain": "mail.example.com",
                              "MailFromDomainStatus": "SUCCESS"}) is None


def test_unrelated_domain_does_not_align():
    out = alignment_problem("example.com",
                            {"MailFromDomain": "mail.other.net",
                             "MailFromDomainStatus": "SUCCESS"})
    assert "does not align" in out

import { test } from 'node:test';
import assert from 'node:assert/strict';
import { alignmentProblem } from './ses-mail-from-audit.mjs';

test('no MAIL FROM is a problem', () => {
  assert.match(alignmentProblem('example.com', undefined), /amazonses\.com/);
});

test('pending status is still a problem', () => {
  const out = alignmentProblem('example.com',
    { MailFromDomain: 'mail.example.com', MailFromDomainStatus: 'PENDING' });
  assert.match(out, /PENDING/);
});

test('an aligned subdomain is clean', () => {
  assert.equal(alignmentProblem('example.com',
    { MailFromDomain: 'mail.example.com', MailFromDomainStatus: 'SUCCESS' }), null);
});

test('an unrelated domain does not align', () => {
  const out = alignmentProblem('example.com',
    { MailFromDomain: 'mail.other.net', MailFromDomainStatus: 'SUCCESS' });
  assert.match(out, /does not align/);
});