Merge branch 'develop' into improvement/better_handling_of_servfail

cisagov · Jan 8, 2018 · 5cc7447 · 5cc7447
2 parents baaf564 + a7689cc
commit 5cc7447
Showing 1 changed file with 12 additions and 6 deletions.
diff --git a/trustymail/trustymail.py b/trustymail/trustymail.py
@@ -369,8 +369,10 @@ def dmarc_scan(resolver, domain):
                 tag_dict[tag] = value
 
             if 'p' not in tag_dict:
-                tag_dict['p'] = 'none'
-            if 'sp' not in tag_dict:
+                msg = 'Record missing required policy (p) tag'
+                handle_syntax_error('[DMARC]', domain, '{0}'.format(msg))
+                domain.valid_dmarc = False
+            elif 'sp' not in tag_dict:
                 tag_dict['sp'] = tag_dict['p']
             if 'ri' not in tag_dict:
                 tag_dict['ri'] = 86400
@@ -439,6 +441,10 @@ def dmarc_scan(resolver, domain):
                             handle_syntax_error('[DMARC]', domain, '{0}'.format(msg))
                             domain.valid_dmarc = False
                         domain.dmarc_pct = pct
+                        if pct < 100:
+                            handle_syntax_error("Error: The DMARC pct tag value must not be less than 100 "
+                                                "(the implicit default), so that the policy applies to all mail")
+                            domain.valid_dmarc = False
                     except ValueError:
                         msg = 'invalid DMARC pct tag value: {0} - must be an integer'.format(tag_dict[tag])
                         handle_syntax_error('[DMARC]', domain, '{0}'.format(msg))
@@ -471,15 +477,15 @@ def dmarc_scan(resolver, domain):
                                         handle_error('[DMARC]', domain, '{0}'.format(error_message))
                                         domain.valid_dmarc = False
                                 except (dns.resolver.NXDOMAIN, dns.resolver.NoAnswer):
-                                    handle_error('[DMARC]', domain, '{0}'.format(error_message))
+                                    handle_syntax_error('[DMARC]', domain, '{0}'.format(error_message))
                                     domain.valid_dmarc = False
                                 try:
                                     # Ensure ruf/rua/email domains have MX records
                                     resolver.query(email_domain, 'MX', tcp=True)
                                 except (dns.resolver.NXDOMAIN, dns.resolver.NoAnswer):
-                                    handle_error('[DMARC]', domain, 'The domain for reporting '
-                                                                    'address {0} does not have any '
-                                                                    'MX records'.format(email_address))
+                                    handle_syntax_error('[DMARC]', domain, 'The domain for reporting '
+                                                                           'address {0} does not have any '
+                                                                           'MX records'.format(email_address))
                                     domain.valid_dmarc = False
 
         domain.dmarc_has_aggregate_uri = len(domain.dmarc_aggregate_uris) > 0