feat: add RFC 9989 t= tag support and a config knob to ignore pct= - #434
Merged
thegushi merged 1 commit intoJun 22, 2026
Merged
Conversation
Adds parsing and a fetch accessor for the "t" (test mode) tag RFC 9989 introduces as the replacement for most of "pct"'s former role (Appendix A.6). t=y steps the enforced policy down one level (reject -> quarantine, quarantine -> none) per S 3.2.7, rather than suppressing enforcement outright the way pct=0 does. The step-down is computed into a new local, enforce_policy, instead of overwriting policy: policy is read again later to decide whether to generate a failure report, and RFC 9989 is explicit that t= "does not affect the generation of DMARC reports." Overwriting it in place would have silently changed failure-report eligibility for stepped-down messages. pct= sampling (random() % 100 < pct, gating RejectFailures and HoldQuarantinedMessages) is left completely unchanged by default: real published DMARC records actively use pct=0 and pct=100 today (e.g. Shopify, Oracle, Akamai, Salesforce, several .edu domains, per a local Umbrella top-1M survey), and dropping support for that would start enforcing on traffic those domains do not yet want enforced. A new boolean, DMARCbisIgnorePct (default false), ignores pct= entirely, equivalent to treating every record as pct=100, for sites that want full RFC 9989 compliance now. Out of scope here: wiring t=/np= into the historyfile, DB schema, and opendmarc-reports' XML output for RFC 9990 aggregate reporting -- that is a separate, larger task.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
opendmarc_policy_fetch_t()) for thet(test mode) tag RFC 9989 introduces as the replacement for most ofpct's former role (Appendix A.6).t=ysteps the enforced policy down one level (reject->quarantine,quarantine->none) per S 3.2.7, rather than suppressing enforcement outright the waypct=0does. This is computed into a newenforce_policylocal rather than overwritingpolicy, sincepolicyis read again later to decide failure-report eligibility, and RFC 9989 is explicit thatt="does not affect the generation of DMARC reports."pct=sampling is left completely unchanged by default: real published DMARC records actively usepct=0andpct=100today (Shopify, Oracle, Akamai, Salesforce, several.edudomains, per a local Umbrella top-1M survey), and dropping support would start enforcing on traffic those domains don't yet want enforced.DMARCbisIgnorePct(defaultfalse) ignorespct=entirely, equivalent to treating every record aspct=100, for operators who want full RFC 9989 compliance now.Out of scope here: wiring
t=/np=into the historyfile, DB schema, andopendmarc-reports' XML output for RFC 9990 aggregate reporting -- that's a separate, larger task.Test plan
make checkinlibopendmarc/-- 13/13 pass, including newt=parse/fetch coverage (validy/n, invalid value, default-when-absent)libopendmarc,opendmarc, andopendmarc-checkwith no new compiler warnings