mirror of
https://github.com/pretix/pretix.git
synced 2026-08-06 10:07:50 +00:00
Mail setup: Add DKIM + DMARC validation
This commit is contained in:
Raphael Michel
@@ -50,6 +50,46 @@
|
||||
{% endblocktrans %}
|
||||
</div>
|
||||
{% endif %}
|
||||
{% if dkim_warning %}
|
||||
<div class="alert alert-danger">
|
||||
<p>
|
||||
{{ dkim_warning }}
|
||||
</p>
|
||||
<p>
|
||||
{% trans "Your new DKIM record should be set up as a CNAME record like this:" %}
|
||||
</p>
|
||||
<pre><code>{{ dkim_hostname }} CNAME {{ dkim_cname }}</code></pre>
|
||||
<p>
|
||||
{% trans "Please keep in mind that updates to DNS might require multiple hours to take effect." %}
|
||||
</p>
|
||||
</div>
|
||||
{% elif dkim_cname %}
|
||||
<div class="alert alert-success">
|
||||
{% blocktrans trimmed %}
|
||||
We found a DKIM record on your domain for this system. Great!
|
||||
{% endblocktrans %}
|
||||
</div>
|
||||
{% endif %}
|
||||
{% if dmarc_warning %}
|
||||
<div class="alert alert-danger">
|
||||
<p>
|
||||
{{ dmarc_warning }}
|
||||
</p>
|
||||
<p>
|
||||
{% trans "Your new DMARC record could look like this:" %}
|
||||
</p>
|
||||
<pre><code>_dmarc.{{ hostname }} TXT "v=DMARC1; p=quarantine; sp=none; adkim=r; aspf=r;"</code></pre>
|
||||
<p>
|
||||
{% trans "Please keep in mind that updates to DNS might require multiple hours to take effect." %}
|
||||
</p>
|
||||
</div>
|
||||
{% elif dkim_cname %}
|
||||
<div class="alert alert-success">
|
||||
{% blocktrans trimmed %}
|
||||
We found a DMARC record on your domain for this system. Great!
|
||||
{% endblocktrans %}
|
||||
</div>
|
||||
{% endif %}
|
||||
{% if verification %}
|
||||
<h3>{% trans "Verification" %}</h3>
|
||||
<p>
|
||||
@@ -70,7 +110,7 @@
|
||||
</div>
|
||||
</div>
|
||||
|
||||
{% if spf_warning %}
|
||||
{% if spf_warning or dkim_warning or dmarc_warning %}
|
||||
<div class="form-group submit-group">
|
||||
<a href="" class="btn btn-default btn-save">
|
||||
{% trans "Cancel" %}
|
||||
|
||||
@@ -41,6 +41,30 @@ from pretix.control.forms.mailsetup import SimpleMailForm, SMTPMailForm
|
||||
logger = logging.getLogger(__name__)
|
||||
|
||||
|
||||
def get_cname_record(hostname):
|
||||
try:
|
||||
r = dns.resolver.Resolver()
|
||||
answers = r.resolve(hostname, 'CNAME')
|
||||
answers = list(answers)
|
||||
if len(answers) != 1:
|
||||
logger.exception('Found multiple CNAME records for {}'.format(hostname))
|
||||
return
|
||||
return str(answers[0].target).lower()
|
||||
except:
|
||||
logger.exception('Could not fetch CNAME record for {}'.format(hostname))
|
||||
|
||||
|
||||
def get_dmarc_record(hostname):
|
||||
try:
|
||||
r = dns.resolver.Resolver()
|
||||
for resp in r.resolve("_dmarc." + hostname, 'TXT'):
|
||||
data = b''.join(resp.strings).decode()
|
||||
if 'DMARC1' in data.strip():
|
||||
return data
|
||||
except:
|
||||
logger.exception("Could not fetch DMARC record for {}".format(hostname))
|
||||
|
||||
|
||||
def get_spf_record(hostname):
|
||||
try:
|
||||
r = dns.resolver.Resolver()
|
||||
@@ -49,7 +73,7 @@ def get_spf_record(hostname):
|
||||
if data.lower().strip().startswith('v=spf1 '): # RFC7208, section 4.5
|
||||
return data
|
||||
except:
|
||||
logger.exception("Could not fetch SPF record")
|
||||
logger.exception("Could not fetch SPF record for {}".format(hostname))
|
||||
|
||||
|
||||
def _check_spf_record(not_found_lookup_parts, spf_record, depth):
|
||||
@@ -192,8 +216,8 @@ class MailSettingsSetupView(TemplateView):
|
||||
|
||||
spf_warning = None
|
||||
spf_record = None
|
||||
hostname = self.simple_form.cleaned_data['mail_from'].split('@')[-1]
|
||||
if settings.MAIL_CUSTOM_SENDER_SPF_STRING:
|
||||
hostname = self.simple_form.cleaned_data['mail_from'].split('@')[-1]
|
||||
spf_record = get_spf_record(hostname)
|
||||
if not spf_record:
|
||||
spf_warning = _(
|
||||
@@ -210,7 +234,43 @@ class MailSettingsSetupView(TemplateView):
|
||||
'this system in the SPF record.'
|
||||
)
|
||||
|
||||
verification = settings.MAIL_CUSTOM_SENDER_VERIFICATION_REQUIRED and not spf_warning
|
||||
dkim_warning = None
|
||||
dkim_hostname = None
|
||||
dkim_cname = None
|
||||
if settings.MAIL_CUSTOM_SENDER_DKIM_CNAME and settings.MAIL_CUSTOM_SENDER_DKIM_SELECTOR:
|
||||
dkim_hostname = settings.MAIL_CUSTOM_SENDER_DKIM_SELECTOR + '.domainkey.' + hostname
|
||||
cname_target = get_cname_record(dkim_hostname)
|
||||
dkim_cname = settings.MAIL_CUSTOM_SENDER_DKIM_CNAME
|
||||
if not dkim_cname.endswith("."):
|
||||
dkim_cname += "."
|
||||
if "%s" in dkim_cname:
|
||||
dkim_cname = dkim_cname.replace("%s", hostname.replace(".", "-").lower())
|
||||
if not cname_target:
|
||||
dkim_warning = _(
|
||||
'We could not find a CNAME record pointing to our DKIM key for domain you are trying to use. '
|
||||
'This means that there is a very high change most of the emails will be rejected or marked as '
|
||||
'spam. We strongly recommend setting up DKIM through a CNAME record. You can do so through the '
|
||||
'DNS settings at the provider you registered your domain with.'
|
||||
)
|
||||
elif cname_target != settings.MAIL_CUSTOM_SENDER_DKIM_CNAME:
|
||||
dkim_warning = _(
|
||||
'We found a CNAME record for a DKIM key, but it is not pointing to the right location. '
|
||||
'This means that there is a very high chance most of the emails will be rejected or marked as '
|
||||
'spam. You should update the DNS settings of your domain.'
|
||||
)
|
||||
|
||||
dmarc_warning = None
|
||||
dmarc_record = None
|
||||
if settings.MAIL_CUSTOM_SENDER_DMARC_REQUIRED:
|
||||
dmarc_record = get_dmarc_record(hostname)
|
||||
if not dmarc_record:
|
||||
spf_warning = _(
|
||||
'We did not find DMARC record for your domain. This means that there is a very high chance '
|
||||
'most of the emails will be rejected or marked as spam. You should update the DNS settings '
|
||||
'of your domain.'
|
||||
)
|
||||
|
||||
verification = settings.MAIL_CUSTOM_SENDER_VERIFICATION_REQUIRED and not spf_warning and not dkim_warning and not dmarc_warning
|
||||
if verification:
|
||||
if 'verification' in self.request.POST:
|
||||
messages.error(request, _('The verification code was incorrect, please try again.'))
|
||||
@@ -240,6 +300,12 @@ class MailSettingsSetupView(TemplateView):
|
||||
'spf_warning': spf_warning,
|
||||
'spf_record': spf_record,
|
||||
'spf_key': settings.MAIL_CUSTOM_SENDER_SPF_STRING,
|
||||
'dkim_warning': dkim_warning,
|
||||
'dkim_hostname': dkim_hostname,
|
||||
'dkim_cname': dkim_cname,
|
||||
'dmarc_warning': dmarc_warning,
|
||||
'dmarc_record': dmarc_record,
|
||||
'hostname': hostname,
|
||||
'recp': self.simple_form.cleaned_data.get('mail_from')
|
||||
},
|
||||
using=self.template_engine,
|
||||
|
||||
@@ -257,6 +257,9 @@ MAIL_FROM_NOTIFICATIONS = config.get('mail', 'from_notifications', fallback=MAIL
|
||||
MAIL_FROM_ORGANIZERS = config.get('mail', 'from_organizers', fallback=MAIL_FROM)
|
||||
MAIL_CUSTOM_SENDER_VERIFICATION_REQUIRED = config.getboolean('mail', 'custom_sender_verification_required', fallback=True)
|
||||
MAIL_CUSTOM_SENDER_SPF_STRING = config.get('mail', 'custom_sender_spf_string', fallback='')
|
||||
MAIL_CUSTOM_SENDER_DKIM_SELECTOR = config.get('mail', 'custom_sender_dkim_selector', fallback='')
|
||||
MAIL_CUSTOM_SENDER_DKIM_CNAME = config.get('mail', 'custom_sender_dkim_cname', fallback='')
|
||||
MAIL_CUSTOM_SENDER_DMARC_REQUIRED = config.getboolean('mail', 'custom_sender_dmarc_required', fallback=False)
|
||||
MAIL_CUSTOM_SMTP_ALLOW_PRIVATE_NETWORKS = config.getboolean('mail', 'custom_smtp_allow_private_networks', fallback=DEBUG)
|
||||
EMAIL_HOST = config.get('mail', 'host', fallback='localhost')
|
||||
EMAIL_PORT = config.getint('mail', 'port', fallback=25)
|
||||
|
||||
Reference in New Issue
Block a user