fix dmarc_status condition documentation

[users/jgh/exim.git] / doc / doc-txt / experimental-spec.txt

diff --git a/doc/doc-txt/experimental-spec.txt b/doc/doc-txt/experimental-spec.txt
index d58f3961b46040270babf67781ff6aca758161e9..f9be19cf701841d6434fe84c6337ea3384b1c188 100644 (file)
--- a/doc/doc-txt/experimental-spec.txt
+++ b/doc/doc-txt/experimental-spec.txt
@@ -92,10 +92,25 @@ is requested and required for the connection to proceed.  The host(s)
 should also be in "hosts_require_tls", and "tls_verify_certificates"
 configured for the transport.
 
+For the client to be able to verify the stapled OCSP the server must
+also supply, in its stapled information, any intermediate
+certificates for the chain leading to the OCSP proof from the signer
+of the server certificate.  There may be zero or one such. These
+intermediate certificates should be added to the server OCSP stapling
+file (named by tls_ocsp_file).
+
 At this point in time, we're gathering feedback on use, to determine if
 it's worth adding complexity to the Exim daemon to periodically re-fetch
 OCSP files and somehow handling multiple files.
 
+  A helper script "ocsp_fetch.pl" for fetching a proof from a CA
+  OCSP server is supplied.  The server URL may be included in the
+  server certificate, if the CA is helpful.
+
+  One fail mode seen was the OCSP Signer cert expiring before the end
+  of vailidity of the OCSP proof. The checking done by Exim/OpenSSL
+  noted this as invalid overall, but the re-fetch script did not.
+
 
 
 
@@ -697,7 +712,7 @@ use standard conditions such as hosts, senders, etc, to decide that
 DMARC verification should *not* be performed for them and disable
 DMARC with a control setting:
 
-  control = dmarc_verify_disable
+  control = dmarc_disable_verify
 
 A DMARC record can also specify a "forensic address", which gives
 exim an email address to submit reports about failed alignment.
@@ -740,11 +755,13 @@ mean, refer to the DMARC website above.  Valid strings are:
                 rejecting the email.
   o quarantine  The DMARC check failed and the library recommends
                 keeping it for further inspection.
+  o none        The DMARC check passed and the library recommends
+                no specific action, neutral.
   o norecord    No policy section in the DMARC record for this
                 sender domain.
   o nofrom      Unable to determine the domain of the sender.
-  o none        There is no DMARC record for this sender domain.
-  o error       Library error or dns error.
+  o temperror   Library error or dns error.
+  o off         The DMARC check was disable for this email.
 
 You can prefix each string with an exclamation mark to invert its
 meaning, for example "!accept" will match all results but
@@ -803,7 +820,7 @@ b. Configure, somewhere before the DATA ACL, the control option to
 (RCPT ACL)
   warn    domains        = +local_domains
           hosts          = +local_hosts
-          control        = dmarc_verify_disable
+          control        = dmarc_disable_verify
 
   warn    !domains       = +screwed_up_dmarc_records
           control        = dmarc_enable_forensic