Repository navigation
Approved Campaign Classification
Navigation guide, not a versioned contract. This page tracks
dmarcgov3. The linked repository guides and Go documentation define behavior.
Security teams that run approved phishing simulations and need to compare a reported message or lower-confidence aggregate evidence with an externally maintained campaign inventory.
Does bounded message-header evidence match an active, explicitly configured security-simulation campaign strongly enough for the caller's review policy?
Strict campaign YAML or JSON supplied through explicit byte, file, directory, environment, HTTPS, or custom sources; a completed immutable campaign snapshot; and normalized header-focused reported-message evidence or completed aggregate report evidence.
Configuration normalization and classification are pure. Source resolution is explicit and bounded. Classification retrieves no body, performs no DNS, sends no response, and takes no enforcement action.
-
LoadCampaignConfiguration,NormalizeCampaignConfiguration, orResolveCampaignConfiguration NormalizeReportedMessageEvidence-
ClassifyReportedMessagefor an individual report -
CorrelateCampaignReportEvidencefor aggregate review -
WriteCampaignClassificationOutputwith an explicit privacy view
Deterministic classification evidence, source freshness and provenance, privileged or disclosure-safe views, and neutral response-routing information.
A provider, domain, or source address is not an allowlist. Aggregate evidence cannot prove that one individual message belongs to a campaign. Automatic disposition requires deliberate caller policy and all required opt-ins.
Campaign names, infrastructure, windows, recipients, and operator notes may be highly sensitive. Do not publish real inventories. Default to the disclosure-safe view outside the privileged security boundary.
Resolve required sources before a review window, fail closed when required data is stale or unavailable, and route employee responses without disclosing campaign details unless the caller explicitly authorizes that disclosure.
This wiki is a navigation layer for the current dmarcgo v3 line. Repository documentation is authoritative.