Re: [dmarc-discuss] Metrics on policy actions

[SheridanJ West via dmarc-discuss]

If you get dmarc report emails and extract the source ip and store them in
a file you can have all kinds of fun with policy failures with geoip,
sorting and that kind of stuff, also it could be processed as a firewall
script input.

 1 AR , 200.89.142.106
 1 CN , 101.67.136.137 etc

Most of our failures originated from cn


On Thu, Apr 27, 2017 at 8:33 PM, Sim via dmarc-discuss <
dmarc-discuss@dmarc.org> wrote:

> Am 26.04.2017 um 01:28 schrieb Anthony Purcell via dmarc-discuss:
> > Numbers on policy requested is what I’m after.
>
> You mean something like this (for opendmarc)?
>
> mysql> SELECT requests.policy, count(*)
> -> from messages
> -> join requests ON requests.domain = messages.from_domain
> -> GROUP BY requests.policy;
> ++--+
> | policy | count(*) |
> ++--+
> |  0 |   20 |
> |110 | 1715 |
> |113 |   99 |
> |114 | 1386 |
> ++--+
>
>
> 0 => DNS lookup error
> 110 => none
> 113 => quarantine
> 114 => reject
>
>
> Sim
> >
> >> On Apr 25, 2017, at 9:52 AM, Brandon Long  >> > wrote:
> >>
> >> Are you looking for the policy applied or the policy requested?
> >> Also, I would imagine this is heavily different depending on the
> >> receiver.
> >>
> >> Brandon
> >>
> >> On Tue, Apr 25, 2017 at 6:23 AM, Anthony Purcell via dmarc-discuss
> >> > wrote:
> >>
> >> Hi John,
> >>
> >> I'm looking for something simpler. A breakdown of how much mail
> >> was p=reject,accept,quarantine
> >>
> >> 10% accept
> >> 40% quarantine
> >>
> >> Make sense?
> >>
> >> Thanks,
> >> 
> >>
>
>
>
> ___
> dmarc-discuss mailing list
> dmarc-discuss@dmarc.org
> http://www.dmarc.org/mailman/listinfo/dmarc-discuss
>
> NOTE: Participating in this list means you agree to the DMARC Note Well
> terms (http://www.dmarc.org/note_well.html)
>
___
dmarc-discuss mailing list
dmarc-discuss@dmarc.org
http://www.dmarc.org/mailman/listinfo/dmarc-discuss

NOTE: Participating in this list means you agree to the DMARC Note Well terms 
(http://www.dmarc.org/note_well.html)

Re: [dmarc-discuss] Metrics on policy actions

[Sim via dmarc-discuss]

Am 26.04.2017 um 01:28 schrieb Anthony Purcell via dmarc-discuss:
> Numbers on policy requested is what I’m after. 

You mean something like this (for opendmarc)?

mysql> SELECT requests.policy, count(*)
-> from messages
-> join requests ON requests.domain = messages.from_domain
-> GROUP BY requests.policy;
++--+
| policy | count(*) |
++--+
|  0 |   20 |
|110 | 1715 |
|113 |   99 |
|114 | 1386 |
++--+


0 => DNS lookup error
110 => none
113 => quarantine
114 => reject


Sim
>
>> On Apr 25, 2017, at 9:52 AM, Brandon Long > > wrote:
>>
>> Are you looking for the policy applied or the policy requested? 
>> Also, I would imagine this is heavily different depending on the
>> receiver.
>>
>> Brandon
>>
>> On Tue, Apr 25, 2017 at 6:23 AM, Anthony Purcell via dmarc-discuss
>> > wrote:
>>
>> Hi John,
>>
>> I'm looking for something simpler. A breakdown of how much mail
>> was p=reject,accept,quarantine
>>
>> 10% accept 
>> 40% quarantine 
>>
>> Make sense?
>>
>> Thanks,
>> 
>>



___
dmarc-discuss mailing list
dmarc-discuss@dmarc.org
http://www.dmarc.org/mailman/listinfo/dmarc-discuss

NOTE: Participating in this list means you agree to the DMARC Note Well terms 
(http://www.dmarc.org/note_well.html)

Re: [dmarc-discuss] Metrics on policy actions

[Anthony Purcell via dmarc-discuss]

Numbers on policy requested is what I’m after. 

Thanks,
Anthony

> On Apr 25, 2017, at 9:52 AM, Brandon Long  wrote:
> 
> Are you looking for the policy applied or the policy requested?  Also, I 
> would imagine this is heavily different depending on the receiver.
> 
> Brandon
> 
> On Tue, Apr 25, 2017 at 6:23 AM, Anthony Purcell via dmarc-discuss 
> > wrote:
> Hi John,
> 
> I'm looking for something simpler. A breakdown of how much mail was 
> p=reject,accept,quarantine
> 
> 10% accept 
> 40% quarantine 
> 
> Make sense?
> 
> Thanks,
> 
> 
> On Apr 24, 2017, at 17:12, John Wilson  > wrote:
> 
>> Anthony,
>> 
>> Do you mean "versus local policy-overrides"?
>> 
>> John
>> 
>> On Mon, Apr 24, 2017 at 4:33 PM, Anthony Purcell via dmarc-discuss 
>> > wrote:
>> Hello,
>> 
>> I was wondering if any dmarc implementors had any stats on what percentage 
>> of your mail stream matches the various polices? Or if there is a maawg doc 
>> out there someone could point me to that would be great.
>> ___
>> dmarc-discuss mailing list
>> dmarc-discuss@dmarc.org 
>> http://www.dmarc.org/mailman/listinfo/dmarc-discuss 
>> 
>> 
>> NOTE: Participating in this list means you agree to the DMARC Note Well 
>> terms (http://www.dmarc.org/note_well.html 
>> )
>> 
> 
> ___
> dmarc-discuss mailing list
> dmarc-discuss@dmarc.org 
> http://www.dmarc.org/mailman/listinfo/dmarc-discuss 
> 
> 
> NOTE: Participating in this list means you agree to the DMARC Note Well terms 
> (http://www.dmarc.org/note_well.html )
> 

___
dmarc-discuss mailing list
dmarc-discuss@dmarc.org
http://www.dmarc.org/mailman/listinfo/dmarc-discuss

NOTE: Participating in this list means you agree to the DMARC Note Well terms 
(http://www.dmarc.org/note_well.html)

Re: [dmarc-discuss] Metrics on policy actions

[Brandon Long via dmarc-discuss]

Are you looking for the policy applied or the policy requested?  Also, I
would imagine this is heavily different depending on the receiver.

Brandon

On Tue, Apr 25, 2017 at 6:23 AM, Anthony Purcell via dmarc-discuss <
dmarc-discuss@dmarc.org> wrote:

> Hi John,
>
> I'm looking for something simpler. A breakdown of how much mail was
> p=reject,accept,quarantine
>
> 10% accept
> 40% quarantine
>
> Make sense?
>
> Thanks,
> 
>
> On Apr 24, 2017, at 17:12, John Wilson  wrote:
>
> Anthony,
>
> Do you mean "versus local policy-overrides"?
>
> John
>
> On Mon, Apr 24, 2017 at 4:33 PM, Anthony Purcell via dmarc-discuss <
> dmarc-discuss@dmarc.org> wrote:
>
>> Hello,
>>
>> I was wondering if any dmarc implementors had any stats on what
>> percentage of your mail stream matches the various polices? Or if there is
>> a maawg doc out there someone could point me to that would be great.
>> ___
>> dmarc-discuss mailing list
>> dmarc-discuss@dmarc.org
>> http://www.dmarc.org/mailman/listinfo/dmarc-discuss
>>
>> NOTE: Participating in this list means you agree to the DMARC Note Well
>> terms (http://www.dmarc.org/note_well.html)
>>
>
>
> ___
> dmarc-discuss mailing list
> dmarc-discuss@dmarc.org
> http://www.dmarc.org/mailman/listinfo/dmarc-discuss
>
> NOTE: Participating in this list means you agree to the DMARC Note Well
> terms (http://www.dmarc.org/note_well.html)
>
___
dmarc-discuss mailing list
dmarc-discuss@dmarc.org
http://www.dmarc.org/mailman/listinfo/dmarc-discuss

NOTE: Participating in this list means you agree to the DMARC Note Well terms 
(http://www.dmarc.org/note_well.html)

Re: [dmarc-discuss] Metrics on policy actions

[Anthony Purcell via dmarc-discuss]

Hi John,

I'm looking for something simpler. A breakdown of how much mail was 
p=reject,accept,quarantine

10% accept 
40% quarantine 

Make sense?

Thanks,


> On Apr 24, 2017, at 17:12, John Wilson  wrote:
> 
> Anthony,
> 
> Do you mean "versus local policy-overrides"?
> 
> John
> 
>> On Mon, Apr 24, 2017 at 4:33 PM, Anthony Purcell via dmarc-discuss 
>>  wrote:
>> Hello,
>> 
>> I was wondering if any dmarc implementors had any stats on what percentage 
>> of your mail stream matches the various polices? Or if there is a maawg doc 
>> out there someone could point me to that would be great.
>> ___
>> dmarc-discuss mailing list
>> dmarc-discuss@dmarc.org
>> http://www.dmarc.org/mailman/listinfo/dmarc-discuss
>> 
>> NOTE: Participating in this list means you agree to the DMARC Note Well 
>> terms (http://www.dmarc.org/note_well.html)
> 
___
dmarc-discuss mailing list
dmarc-discuss@dmarc.org
http://www.dmarc.org/mailman/listinfo/dmarc-discuss

NOTE: Participating in this list means you agree to the DMARC Note Well terms 
(http://www.dmarc.org/note_well.html)

Re: [dmarc-discuss] Metrics on policy actions

[John Wilson via dmarc-discuss]

Anthony,

Do you mean "versus local policy-overrides"?

John

On Mon, Apr 24, 2017 at 4:33 PM, Anthony Purcell via dmarc-discuss <
dmarc-discuss@dmarc.org> wrote:

> Hello,
>
> I was wondering if any dmarc implementors had any stats on what percentage
> of your mail stream matches the various polices? Or if there is a maawg doc
> out there someone could point me to that would be great.
> ___
> dmarc-discuss mailing list
> dmarc-discuss@dmarc.org
> http://www.dmarc.org/mailman/listinfo/dmarc-discuss
>
> NOTE: Participating in this list means you agree to the DMARC Note Well
> terms (http://www.dmarc.org/note_well.html)
>
___
dmarc-discuss mailing list
dmarc-discuss@dmarc.org
http://www.dmarc.org/mailman/listinfo/dmarc-discuss

NOTE: Participating in this list means you agree to the DMARC Note Well terms 
(http://www.dmarc.org/note_well.html)