Re: [dmarc-discuss] Metrics on policy actions

[SheridanJ West via dmarc-discuss]

If you get dmarc report emails and extract the source ip and store them in
a file you can have all kinds of fun with policy failures with geoip,
sorting and that kind of stuff, also it could be processed as a firewall
script input.

     1 AR , 200.89.142.106
     1 CN , 101.67.136.137 etc

Most of our failures originated from cn


On Thu, Apr 27, 2017 at 8:33 PM, Sim via dmarc-discuss <
dmarc-discuss@dmarc.org> wrote:

> Am 26.04.2017 um 01:28 schrieb Anthony Purcell via dmarc-discuss:
> > Numbers on policy requested is what I’m after.
>
> You mean something like this (for opendmarc)?
>
> mysql> SELECT requests.policy, count(*)
>     -> from messages
>     -> join requests ON requests.domain = messages.from_domain
>     -> GROUP BY requests.policy;
> +--------+----------+
> | policy | count(*) |
> +--------+----------+
> |      0 |       20 |
> |    110 |     1715 |
> |    113 |       99 |
> |    114 |     1386 |
> +--------+----------+
>
>
> 0 => DNS lookup error
> 110 => none
> 113 => quarantine
> 114 => reject
>
>
> Sim
> >
> >> On Apr 25, 2017, at 9:52 AM, Brandon Long <bl...@google.com
> >> <mailto:bl...@google.com>> wrote:
> >>
> >> Are you looking for the policy applied or the policy requested?
> >> Also, I would imagine this is heavily different depending on the
> >> receiver.
> >>
> >> Brandon
> >>
> >> On Tue, Apr 25, 2017 at 6:23 AM, Anthony Purcell via dmarc-discuss
> >> <dmarc-discuss@dmarc.org <mailto:dmarc-discuss@dmarc.org>> wrote:
> >>
> >>     Hi John,
> >>
> >>     I'm looking for something simpler. A breakdown of how much mail
> >>     was p=reject,accept,quarantine....
> >>
> >>     10% accept
> >>     40% quarantine
> >>
> >>     Make sense?
> >>
> >>     Thanks,
> >>     🐜
> >>
>
>
>
> _______________________________________________
> dmarc-discuss mailing list
> dmarc-discuss@dmarc.org
> http://www.dmarc.org/mailman/listinfo/dmarc-discuss
>
> NOTE: Participating in this list means you agree to the DMARC Note Well
> terms (http://www.dmarc.org/note_well.html)
>

_______________________________________________
dmarc-discuss mailing list
dmarc-discuss@dmarc.org
http://www.dmarc.org/mailman/listinfo/dmarc-discuss

NOTE: Participating in this list means you agree to the DMARC Note Well terms 
(http://www.dmarc.org/note_well.html)