Skip to content

Create link_email_only_contains_free_subdomain_host_links_from_unsoli…#3961

Closed
hadojae wants to merge 2 commits intomainfrom
hadojae.fn.na.link_email_only_contains_free_subdomain_host_links_from_unsolicited_sender
Closed

Create link_email_only_contains_free_subdomain_host_links_from_unsoli…#3961
hadojae wants to merge 2 commits intomainfrom
hadojae.fn.na.link_email_only_contains_free_subdomain_host_links_from_unsolicited_sender

Conversation

@hadojae
Copy link
Copy Markdown
Member

@hadojae hadojae commented Feb 4, 2026

…cited_sender.yml

Description

This is a good catchall for unsolicited emails that only contain links to free subdomain hosts

Associated hunts

@hadojae hadojae requested a review from a team February 4, 2026 21:31
@hadojae hadojae requested a review from a team as a code owner February 4, 2026 21:31
@github-actions github-actions Bot added the in-test-rules PR is in our testing suite to collect telemetry label Feb 4, 2026
github-actions Bot added a commit that referenced this pull request Feb 4, 2026
Comment on lines +20 to +27
// negate highly trusted sender domains unless they fail DMARC authentication
and (
coalesce(sender.email.domain.root_domain in $high_trust_sender_root_domains
and not headers.auth_summary.dmarc.pass,
false
)
or sender.email.domain.root_domain not in $high_trust_sender_root_domains
)
Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
// negate highly trusted sender domains unless they fail DMARC authentication
and (
coalesce(sender.email.domain.root_domain in $high_trust_sender_root_domains
and not headers.auth_summary.dmarc.pass,
false
)
or sender.email.domain.root_domain not in $high_trust_sender_root_domains
)
// negate highly trusted sender domains unless they fail DMARC authentication
and not (
sender.email.domain.root_domain in $high_trust_sender_root_domains
and coalesce(headers.auth_summary.dmarc.pass, false)
)

@hadojae
Copy link
Copy Markdown
Member Author

hadojae commented Feb 9, 2026

too generic, closing

@hadojae hadojae closed this Feb 9, 2026
github-actions Bot added a commit that referenced this pull request Feb 9, 2026
github-actions Bot added a commit that referenced this pull request Feb 9, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

in-test-rules PR is in our testing suite to collect telemetry

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants