File tree Expand file tree Collapse file tree 1 file changed +25
-3
lines changed
keep/providers/mailgun_provider Expand file tree Collapse file tree 1 file changed +25
-3
lines changed Original file line number Diff line number Diff line change @@ -287,11 +287,33 @@ def _format_alert(
287287 message = event .get ("stripped-text" , body_plain )
288288 raw_content = event .get ("raw_content" )
289289
290+ # Check for DMARC reports in multiple ways
291+ is_dmarc_report = False
292+
293+ # Check raw_content if available
290294 if isinstance (raw_content , bytes ) and b"dmarc" in raw_content .lower ():
291- logger .warning ("DMARC alert detected, skipping" )
292- return None
295+ is_dmarc_report = True
293296 elif isinstance (raw_content , str ) and "dmarc" in raw_content .lower ():
294- logger .warning ("DMARC alert detected, skipping" )
297+ is_dmarc_report = True
298+
299+ # Check subject for DMARC report patterns
300+ if name and ("dmarc" in name .lower () or "report domain:" in name .lower ()):
301+ is_dmarc_report = True
302+
303+ # Check sender for DMARC report senders
304+ if source and any (dmarc_sender in source .lower () for dmarc_sender in [
305+ "noreply-dmarc-support@google.com" ,
306+ "dmarc-support@google.com" ,
307+ "dmarc@" ,
308+ "postmaster@"
309+ ]):
310+ is_dmarc_report = True
311+
312+ if is_dmarc_report :
313+ logger .warning ("DMARC alert detected, skipping" , extra = {
314+ "from" : source ,
315+ "subject" : name
316+ })
295317 return None
296318
297319 if not name or not message :
You can’t perform that action at this time.
0 commit comments