DMARC validation and reporting

[borbelyr-mentorit]

Dear MailKit Team,

We are looking for a .Net implementation for validating DMARC and reporting it via email. We have already using MailKit in our application, so it would be very easy for us to use, once available.

Do you have adding DMARC handling on your roadmap? If so, when?

Thank you,
Roland Borbély

[jstedfast]

DMARC isn't something that is on the current roadmap. I'm not sure what would even be involved.

[borbelyr-mentorit]

Hi Jeffrey,

Thanks for your quick reply.
What a pity.
DMARC is basically validation of DKIM and SPF records against the domain name (plus reporting via email). So MimeKit library is just one step from supporting DMARC as a library.

Anyway, please let me know, when DMARC is put on your roadmap.

Thank you,
Roland

[jstedfast]

Are you writing a mail server using MimeKit?

I had originally written MimeKit with the intention of writing a mail client so these weren't things that were on my radar.

That said, I recently joined the Office365 Exchange team at Microsoft and my job there has been to take ownership of their MIME parser implementation (with the side goal of replacing it with MimeKit).

There are already areas that have switched to MimeKit, including (I believe), the DKIM/SPF/DMARC implementation. I'll have to double-check that... (I wasn't involved in these efforts).

Anyway, kinda crazy that the original direction has changed.

Most of the things I've been working on I've been trying to "backport" to MimeKit including the hardware acceleration stuff I've been doing as I reimplement parts of their MIME parser/base64 encoder/decoder, etc.

The main set of changes that I haven't backported (yet) are the non-compliance detection and reporting functionality that I implemented which is how I got started with the hardware acceleration stuff because the parser is having to do so much extra work that I needed to take advantage of hwaccel or the parser would have gotten bogged down. The reason I haven't backported these features yet are that I need to find a way to optionally disable them since they have a performance cost and to design a cleaner API (my Exchange API is quick & dirty and there's obviously no need to disable it).

The downside to joining the Exchange team is that I've had less free time to work on MimeKit because I've been working long hours on Exchange.

[borbelyr-mentorit]

Hi Jeffrey,

Our product is an email secure gateway, responsible for accepting emails, scan them for malicious content, then forward them to the recipients. So it includes a mail client and server, but those are only little part of the whole feature set. We use MailKit to parse and prepare emails as well.

It would be great, if you could double-check the DMARC implementation state and give us a feedback.

Thank you,
R

[jstedfast]

Unfortunately even if Exchange has implemented SPF and DMARC on top of MimeKit, it would be proprietary code that I couldn't share.

[jstedfast]

Turns out none of DKIM, SPF or DMARC are implemented on top of the MimeKit parser - they are built on top of the other MIME parser in Exchange that I have been working on.

[borbelyr-mentorit]

Unfortunately even if Exchange has implemented SPF and DMARC on top of MimeKit, it would be proprietary code that I couldn't share.

Sure.

[jstedfast]

Looks like SPF (which is a requirement of DMARC) really needs to be implemented at the SMTP server level because all of the info needed to make this calculation are things like the HELO/EHLO domain and the MAIL FROM command arguments which isn't really something MimeKit would have access to.

[jstedfast]

Okay, so my previous comment was me (slightly) misunderstanding things.

This is the DMARC specification: https://www.rfc-editor.org/rfc/rfc7489

My updated understanding of DMARC is that it is validation of the email address domains in the From header.

I'll have to think about this, but contrary to my initial thoughts, DMARC could actually make sense for MimeKit to support.

Yes, it still depends on DKIM (already supported by MimeKit) and SPF (not something MimeKit could do), but if the API allows for passing in an SPF evaluation status (including the MAIL FROM and/or EHLO domain used to do the evaluation), it might be possible to add DMARC support to MimeKit.

At the very least, it might make sense to add some APIs that could help facilitate DMARC implementations and make them simpler.

I'm just not sure how this API would look.

[borbelyr-mentorit]

Hi Jeff,
Exactly, passing only an SPF evaluation status to the API would be enough.

We appreciate your consideration, adding DMARC to MimeKit, at least DMARC enforcement. 👍

Adding DMARC reporting feature is another story. It requires storing the metrics (or allowing to feed MimeKit with the data through an API) and then sending email. Emailing can be problematic, because may require too much configuration options to let the emails through a network safely, not detecting as spam, and so on...