opendmarc(8)

💌 opendmarc — the DMARC email policy filter for MTAs (yes, that opendmarc, from section 8 of your System Manager's Manual bestie)

okay so first things first, the whole vibe: this is opendmarc(8), it lives in the System Manager's Manual, and it's the DMARC email policy filter for MTAs. that's the name, that's the game. let's go 💅

---

✨ SYNOPSIS ✨

opendmarc [-A] [-c configfile] [-f] [-l] [-n] [-p socketspec] [-P pidfile] [-t file[,file[...]]] [-u userid[:group]] [-v] [-V]

that's it. that's the whole invocation. look at her go 🎀

---

🌸 DESCRIPTION 🌸

so opendmarc implements the proposed DMARC specification — for authentication of message and for reporting of observed traffic. two jobs, both iconic, no notes.

the way it works is it uses the milter interface (which, fun fact, was originally distributed as part of version 8.11 of sendmail(8)), so it can provide a DMARC processing service for mail transiting a milter-aware MTA. she's a guest star in your MTA's little ecosystem, not the main character of the MTA itself. respect.

most — probably all, honestly — of the command line options down below can also be set using a configuration file. wanna know how? peep the -c option, i got you.

and here's the thing you need to internalize: opendmarc relies on the addition of Authentication-Results fields by upstream filters on trusted hosts to collect input to the DMARC algorithm. it does not do DKIM or SPF evaluation itself. like, it's not out here doing everyone's homework. it reads the receipts, it doesn't write them. periodt. 😤

---

✨ OPTIONS ✨

• -A — automatically re-start on failures. use with caution bestie, fr fr: if the filter fails instantly after it starts, this can cause a tight fork(2) loop. 😭 this can be mitigated using some values in the configuration file to limit restarting. see opendmarc.conf(5).
• -c configfile — read the named configuration file. see the opendmarc.conf(5) man page for the details, she has lore. values in the configuration file are overridden when their equivalents are provided on the command line — until a configuration reload occurs, at which point the vibes reset. the OPERATION section describes how reloads are triggered. default behavior: read a configuration file from /etc/opendmarc.conf if one exists, or otherwise just apply defaults to all values. simple as.
• -f — normally opendmarc forks and exits immediately, leaving the service running in the background (living her life, unbothered). this flag suppresses that behaviour so that it runs in the foreground. clingy mode. i respect it.
• -l — log via calls to syslog(3) any interesting activity. gossip, but make it syslog. 💬
• -n — parse the configuration file and command line arguments, report any errors found, and then exit. basically a dry run / vibe check. the exit value will be 0 if the filter would start up without complaint, or non-zero otherwise. no surprises, no drama (well, maybe a little drama if something's wrong).
• -p socketspec — specifies the socket that should be established by the filter to receive connections from sendmail(8) in order to provide service. socketspec comes in one of two forms:
  • local:path — which creates a UNIX domain socket at the specified path, or
  • inet:port[@host] or inet6:port[@host] — which creates a TCP socket on the specified port within the specified protocol family.

if the host is not given as either a hostname or an IP address, the socket will be listening on all interfaces (she's everywhere, she contains multitudes ✨). if neither socket type is specified, local is assumed, meaning the parameter is interpreted as a path at which the socket should be created. if an IP address is used, it must be enclosed in square brackets. this parameter is mandatory. no socket, no service, no cap. 🫶

• -P pidfile — specifies a file into which the filter should write its process ID at startup. leaving a little note so you know where she is.
• -t file[,file[,...]] — reads email messages from the named files and processes them as if they were received by the filter. the service is not started, and actions normally sent back to the MTA will instead be printed on standard output. test mode, basically. controlled environment, same energy. 🧚
• -u userid[:group] — attempts to become the specified userid before starting operations. yes it says "be come", that's the original wording, and honestly, manifestation. the process will be assigned all of the groups and primary group ID of the named userid unless an alternate group is specified. see the FILE PERMISSIONS section for more information.
• -v — increase verbose output during test mode (see -t above). may be specified more than once to request increasing amounts of output. stack it. more -v, more words, more insight. 🔥
• -V — print the version number and supported canonicalization and signature algorithms, and then exit without doing anything else. she's just introducing herself and dipping. 👑

---

🦋 SIGNALS 🦋

upon receiving SIGUSR1, if the filter was started with a configuration file, it will be re-read and the new values used. glow-up via signal. ✨

but listen: any command line overrides provided at startup time will be lost when this is done. gone. bye. 🙈

also, the following configuration file values (and their corresponding command line items, if any) are not reloaded through this process:

• AutoRestart (-A)
• AutoRestartCount
• AutoRestartRate
• Background
• MilterDebug
• PidFile (-P)
• Socket (-p)
• UMask
• UserID (-u)

and one more thing: the filter does not automatically check the configuration file for changes and reload. it's not out here refreshing the page every five seconds. you have to tell it. communicate with your filter, bestie. 💖

---

🌈 VERSION 🌈

this man page covers version 1.4.2 of opendmarc. write that down. 📝

---

👑 COPYRIGHT 👑

Copyright (c) 2012, The Trusted Domain Project. All rights reserved.

---

💜 SEE ALSO 💜

• opendmarc.conf(5), sendmail(8)
• Sendmail Operations Guide
• RFC4408 - Sender Policy Framework
• RFC5321 - Simple Mail Transfer Protocol
• RFC5322 - Internet Messages
• RFC5451 - Message Header Field for Indicating Message Authentication Status
• RFC6376 - DomainKeys Identified Mail
• RFC6591 - Authentication Failure Reporting Using the Abuse Reporting Format

iykyk — that's a whole reading list, but it's worth it. go read, you'll be smarter, slay. 📚

---

and that's the whole page, bestie 💖 brought to you by The Trusted Domain Project, filed under opendmarc(8) in your System Manager's Manual. go forth and DMARC responsibly. 🌸🦋✨