From fa4c6ca43c15bdb30ed9cecfec07ee42a4755cb4 Mon Sep 17 00:00:00 2001 From: Wouter Kobes Date: Wed, 17 Jun 2026 17:20:45 +0200 Subject: [PATCH] mention license, fix links --- DMARC-how-to.md | 2 +- README.md | 2 ++ example-configs/STARTTLS-how-to.md | 2 +- 3 files changed, 4 insertions(+), 2 deletions(-) diff --git a/DMARC-how-to.md b/DMARC-how-to.md index b906739..04f4204 100644 --- a/DMARC-how-to.md +++ b/DMARC-how-to.md @@ -35,7 +35,7 @@ DMARC addresses this problem and enables the owner of a domain to take explicit * DMARC does not require both DKIM or SPF. But implementation of both is strongly advised. * DMARC is about aligning the domain in the DKIM header (the "d=" value) and SPF header (*a.k.a. RFC5321.MailFrom, Return-Path, Envelope Sender, Envelope From*) with the organizational domain in the message From header (*a.k.a. RFC5322.From, Header From, Message From*) which is visible to the user. * If these values do not align this could mean for example, that an attacker placed a valid DKIM signature header in an email with a "d=" value that points to a domain the attacker controls, allowing DKIM to pass while still spoofing the From address to the user. -* Parked domain: “DMARC p=reject”. Make sure to include rua and ruf addresses, since this allows monitoring of possible abuse attempts. Implement additional records (SPF, DKIM, NullMX) if possible, see also our [Parked domain how-to](https://github.com/internetstandards/toolbox-wiki/blob/master/parked-domain-how-to.md). +* Parked domain: “DMARC p=reject”. Make sure to include rua and ruf addresses, since this allows monitoring of possible abuse attempts. Implement additional records (SPF, DKIM, NullMX) if possible, see also our [Parked domain how-to](https://github.com/internetstandards/toolbox-wiki/blob/main/parked-domain-how-to.md). * RFC 7489 [states](https://tools.ietf.org/html/rfc7489#section-6.4) that the tags dmarc-version ("v=") and dmarc-request ("p=") should be on the first and second position of the DMARC record. The order of the other tags does not matter: "components other than dmarc-version and dmarc-request may appear in any order". * The verified [erratum 5440 of RFC 7489](https://www.rfc-editor.org/errata_search.php?rfc=7489) states that a semicolon should be included in the DMARC version tag. Correct: "v=DMARC1;". Incorrect: "v=DMARC1". * When using office 365, the forwarding of calendar appointments from a DMARC projected domain fails. This is a known issue. Read more on the [Office 365 UserVoice forum](https://office365.uservoice.com/forums/264636-general/suggestions/34012756-forwarding-of-calendar-appointments-from-a-dmarc-p) and don't forget to submit your vote! diff --git a/README.md b/README.md index c501a38..8eec003 100644 --- a/README.md +++ b/README.md @@ -6,6 +6,8 @@ This GitHub repository contains several how-to's for providing practical informa Feedback and/or contributions are much appreciated and welcome through issues, pull requests or via [question@internet.nl](mailto:question@internet.nl). +This repository and all contributions to it are licensed under CC BY 4.0, with the exception of the Internet.nl trademark and logo. + # Quick access [DANE how-to](https://github.com/internetstandards/toolbox-wiki/blob/main/DANE-for-SMTP-how-to.md) [DKIM how-to](https://github.com/internetstandards/toolbox-wiki/blob/main/DKIM-how-to.md) diff --git a/example-configs/STARTTLS-how-to.md b/example-configs/STARTTLS-how-to.md index 81885fa..04dc04f 100644 --- a/example-configs/STARTTLS-how-to.md +++ b/example-configs/STARTTLS-how-to.md @@ -16,7 +16,7 @@ Under construction # Tips, tricks and notices for implementation * http://postfix.1071664.n5.nabble.com/Disable-SSL-TLS-renegotiation-td96864.html#a96871 -* Use the RFC 7919 defined DH groups: https://raw.githubusercontent.com/internetstandards/dhe_groups/master/ffdhe4096.pem) +* Use the RFC 7919 defined DH groups: https://raw.githubusercontent.com/internetstandards/dhe_groups/main/ffdhe4096.pem) ## Implementing STARTTLS in Postfix **Specifics for this setup**