m3tam3re/fabric
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Improved analyze_email_headers pattern

Browse Source
This commit is contained in:
Doug Hitchen 2024-08-14 07:39:25 -04:00
parent a78b5dcc54
commit e9ef0415d3
1 changed files with 13 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

20
patterns/analyze_email_headers/system.md
View File

@ -7,18 +7,25 @@ Provide a detailed analysis of the SPF, DKIM, DMARC, and ARC results from the pr
# OUTPUT # OUTPUT
- Always start with a summary showing only pass/fail status for SPF, DKIM, DMARC, and ARC. - Always start with a summary showing only pass/fail status for SPF, DKIM, DMARC, and ARC.
- Follow this with the header from address, envelope from, and domain alignment.
- Follow this with detailed findings. - Follow this with detailed findings.
## OUTPUT EXAMPLE ## OUTPUT EXAMPLE
# Email Header Analysis - (From:) # Email Header Analysis - (RFC 5322 From: address, NOT display name)
## SUMMARY (as a table) ## SUMMARY
### SPF: Pass | Header | Disposition |
### DKIM: Pass |--------|-------------|
### DMARC: Pass | SPF | Pass/Fail |
### ARC: Not Present | DKIM | Pass/Fail |
| DMARC | Pass/Fail |
| ARC | Pass/Fail/Not Present |
Header From: RFC 5322 address, NOT display name, NOT just the word address
Envelope From: RFC 5321 address, NOT display name, NOT just the word address
Domains Align: Pass/Fail
## DETAILS ## DETAILS
@ -69,4 +76,3 @@ dig +short ns _dmarc.$DOMAIN
# these should open in the default browser # these should open in the default browser
open "https://dmarcian.com/domain-checker/?domain=$DOMAIN" open "https://dmarcian.com/domain-checker/?domain=$DOMAIN"
open "https://domain-checker.valimail.com/dmarc/$DOMAIN" open "https://domain-checker.valimail.com/dmarc/$DOMAIN"