There's an option on import

U

Unsmart•3/5/24, 4:38 PM

Cloudflare Access pay-go has no limit but its $7/user/mo.

You probably want to remove cloudflare access and use your own auth, which I assume you probably already have in some way given its a discord bot.

CChaika There's an option on import

T

threekat•3/5/24, 4:40 PM

omg thank you

T

threekat•3/5/24, 4:41 PM

sorry lol

Original message was deleted

C

ChaikaOP•3/5/24, 4:42 PM

technically from that description it appears that is right if its really strict

C

ChaikaOP•3/5/24, 4:42 PM

It says its looking for a 301 and a redirect to the https url

C

ChaikaOP•3/5/24, 4:43 PM

but if you try it yourself, you can see it 302's to a different site (ryder.link)

C

ChaikaOP•3/5/24, 4:43 PM

it's stupid but not wrong if you take it as face value lol

C

ChaikaOP•3/5/24, 4:43 PM

security center is broken in a lot of other ways though, I'd just ignore it for now

U

Unsmart•3/5/24, 4:50 PM

Then you need to upgrade to pay-go and pay $7/user/mo

C

ChaikaOP•3/5/24, 4:52 PM

I think you could just do Access at 3/user/mo but eitherway prohibitively expensive. It's made to be used by employees, not generic access for users/like a normal signup system

B

bkyerv•3/5/24, 7:01 PM

who is the best person to report spamming users/bots on this server?

Bbkyerv who is the best person to report spamming users/bots on this server?

V

Vero•3/5/24, 7:08 PM

Hey, you can DM me

Original message was deleted

D

DarkDeviL•3/5/24, 7:27 PM

1. Your DMARC record is quite long, and goes over the 255 byte limit, which, depending on the implementation, MAY be able to break the parsing of the record.

;; ANSWER SECTION:
_dmarc.rydercragie.com. 300     IN      TXT     "v=DMARC1; p=reject; sp=reject; rua=mailto:ac916a4e488c43058046889432174d68@dmarc-reports.cloudflare.net,mailto:n8dvgnuk@ag.eu.dmarcadvisor.com,mailto:DMARC+RUA@RyderCragie.com; ruf=mailto:ac916a4e488c43058046889432174d68@dmarc-reports.cloudflare.net,mailt" "o:n8dvgnuk@fr.eu.dmarcadvisor.com,mailto:DMARC+RUF@RyderCragie.com; fo=0:1:d:s; pct=100; adkim=s; aspf=s"

;; ANSWER SECTION:
_dmarc.rydercragie.com. 300     IN      TXT     "v=DMARC1; p=reject; sp=reject; rua=mailto:ac916a4e488c43058046889432174d68@dmarc-reports.cloudflare.net,mailto:n8dvgnuk@ag.eu.dmarcadvisor.com,mailto:DMARC+RUA@RyderCragie.com; ruf=mailto:ac916a4e488c43058046889432174d68@dmarc-reports.cloudflare.net,mailt" "o:n8dvgnuk@fr.eu.dmarcadvisor.com,mailto:DMARC+RUF@RyderCragie.com; fo=0:1:d:s; pct=100; adkim=s; aspf=s"

;; ANSWER SECTION:
_dmarc.rydercragie.com. 300     IN      TXT     "v=DMARC1; p=reject; sp=reject; rua=mailto:ac916a4e488c43058046889432174d68@dmarc-reports.cloudflare.net,mailto:n8dvgnuk@ag.eu.dmarcadvisor.com,mailto:DMARC+RUA@RyderCragie.com; ruf=mailto:ac916a4e488c43058046889432174d68@dmarc-reports.cloudflare.net,mailt" "o:n8dvgnuk@fr.eu.dmarcadvisor.com,mailto:DMARC+RUF@RyderCragie.com; fo=0:1:d:s; pct=100; adkim=s; aspf=s"

;; ANSWER SECTION:
_dmarc.rydercragie.com. 300     IN      TXT     "v=DMARC1; p=reject; sp=reject; rua=mailto:ac916a4e488c43058046889432174d68@dmarc-reports.cloudflare.net,mailto:n8dvgnuk@ag.eu.dmarcadvisor.com,mailto:DMARC+RUA@RyderCragie.com; ruf=mailto:ac916a4e488c43058046889432174d68@dmarc-reports.cloudflare.net,mailt" "o:n8dvgnuk@fr.eu.dmarcadvisor.com,mailto:DMARC+RUF@RyderCragie.com; fo=0:1:d:s; pct=100; adkim=s; aspf=s"

For

without sense for details: It splits within the RUF tag, between Cloudflare and DMARC Advisor.

Such length (and splitting) have been known to cause trouble with some implementations.

2. Your DMARC record does not have

np=reject;

np=reject;

np=reject;

np=reject;, however, proper implementations should fall back to

p=

p=

p=

p= for both

sp=

sp=

sp=

sp= and

np=

np=

np=

np=, if they are omitted.
np? -> https://discord.com/channels/595317990191398933/812577823599755274/1214278578842107995

3. Your

mail

mail

mail

mail is a CNAME, although I highly doubt it, depending on the implementation, a potentially badly coded implementation could maybe be thinking that it should follow the CNAME for the DMARC record.

D

DarkDeviL•3/5/24, 7:30 PM

Re. first things first, they are also written in the order of how I would be looking at them.

D

DarkDeviL•3/5/24, 7:31 PM

I am also under the impression that Cloudflare doesn't parse RUF, so yeah, removing that could take a bit off the DMARC record, although, I don't think it will be enough.

D

DarkDeviL•3/5/24, 7:32 PM

Still splitting, now here:

.com; f" "o=0:1:d:s; pct=100; adkim=s; aspf=s"

.com; f" "o=0:1:d:s; pct=100; adkim=s; aspf=s"

.com; f" "o=0:1:d:s; pct=100; adkim=s; aspf=s"

.com; f" "o=0:1:d:s; pct=100; adkim=s; aspf=s"

D

DarkDeviL•3/5/24, 7:32 PM

Can you add forwarders within your Zoho?

D

DarkDeviL•3/5/24, 7:33 PM

If so, remove DMARC Advisor, and make Zoho forward from your DMARC+RUA and DMARC+RUF to DMARC Advisor.

D

DarkDeviL•3/5/24, 7:33 PM

(How Zoho works that way, whether it will both deliver to you AND forward, or only just forward, ... is a different story though)

Original message was deleted

D

DarkDeviL•3/5/24, 7:57 PM

According to the specs, 0 indicates the default, 1 should literally be the same as "d:s", so replacing it with 1 should literally be doing it all.

Original message was deleted

D

DarkDeviL•3/5/24, 7:57 PM

pct is indeed 100 if omitted, so that can be removed as well.

D

DarkDeviL•3/5/24, 7:59 PM

And re. sp/np: Some people likes to explicitly be specifying such things (e.g. having them all, even though things should fall back).

D

DarkDeviL•3/5/24, 7:59 PM

You can leave

p=reject;

p=reject;

p=reject;

p=reject;, but remove the others (sp/np), if you wish.

D

DarkDeviL•3/5/24, 8:00 PM

Thing is just, you don't know what kind of broken implementations you may see out there.

DDarkDeviL 1. Your DMARC record is quite long, and goes over the 255 byte limit, which, dep...

D

DarkDeviL•3/5/24, 8:03 PM

np? -> https://discord.com/channels/595317990191398933/812577823599755274/1214278578842107995

D

DarkDeviL•3/5/24, 8:04 PM

DNS code 3 (NXDOMAIN).

D

DarkDeviL•3/5/24, 8:05 PM

p=reject;

p=reject;

p=reject;

p=reject; alone, if you don't care about being explicit.

D

DarkDeviL•3/5/24, 8:05 PM

Otherwise

p=reject; sp=reject; np=reject;

p=reject; sp=reject; np=reject;

p=reject; sp=reject; np=reject;

p=reject; sp=reject; np=reject;.

D

DarkDeviL•3/5/24, 8:06 PM

The

p=

p=

p=

p= should be enough according to the specs.

D

DarkDeviL•3/5/24, 8:06 PM

Exactly.

D

DarkDeviL•3/5/24, 8:11 PM

adkim/aspf has nothing to do with the p/sp/np policies and their fallback.

D

DarkDeviL•3/5/24, 8:12 PM

All they control is whether the alignment to the original domain must be exact, or can be a sub-domain thereof.

D

DarkDeviL•3/5/24, 8:12 PM

The default is r, relaxed.

D

DarkDeviL•3/5/24, 8:12 PM

If you want them to remain strict, yes, then you need to keep them.

D

DarkDeviL•3/5/24, 8:14 PM

If you look at the <policy_published></policy_published> sections from the DMARC reports you receive, you will see what the other end claims to see your current DMARC record as.

D

DarkDeviL•3/5/24, 8:21 PM

That is one sent by Google, right?

D

DarkDeviL•3/5/24, 8:22 PM

Yep, there you see it.

D

DarkDeviL•3/5/24, 8:22 PM

Google lists "

np=

np=

np=

np=", but not

fo=

fo=

fo=

fo=.

D

DarkDeviL•3/5/24, 8:22 PM

Microsoft lists "

fo=

fo=

fo=

fo=", but not

np=

np=

np=

np=.

D

DarkDeviL•3/5/24, 8:23 PM

Point is here the implementations as mentioned above.

D

DarkDeviL•3/5/24, 8:23 PM

Two different implementations doesn't necessarily do the same.

D

DarkDeviL•3/5/24, 8:23 PM

D

DarkDeviL•3/5/24, 8:23 PM

D

DarkDeviL•3/5/24, 8:24 PM

Not necessarily.

D

DarkDeviL•3/5/24, 8:24 PM

Google said since the beginning they wouldn't do RUF reporting.

Similar Threads

Similar Threads

Similar Threads