23 lines
627 B
YAML
23 lines
627 B
YAML
|
id: dmarc-detect
|
||
|
|
||
|
|
info:
|
||
|
|
name: DNS DMARC Detection
|
||
|
|
author: juliosmelo
|
||
|
|
severity: info
|
||
|
|
description: |
|
||
|
|
DMARC is an open email authentication protocol that provides domain-level protection of the email channel. DMARC authentication detects and prevents email spoofing techniques used in phishing, business email compromise (BEC) and other email-based attacks.
|
||
|
|
reference:
|
||
|
|
- https://dmarc.org/
|
||
|
|
- https://dmarc.org/wiki/FAQ#Why_is_DMARC_important.3F
|
||
|
|
tags: dns,dmarc
|
||
|
|
|
||
|
|
dns:
|
||
|
|
- name: "_dmarc.{{FQDN}}"
|
||
|
|
type: TXT
|
||
|
|
|
||
|
|
extractors:
|
||
|
|
- type: regex
|
||
|
|
group: 1
|
||
|
|
regex:
|
||
|
|
- "IN\tTXT\t(.+)"
|