install_opendmarc.sh: set PublicSuffixList/UserID, drop HistoryFile, SPFIgnoreResults true

- Set PublicSuffixList and UserID explicitly instead of relying on the package config.
- Do not use HistoryFile (no aggregate reports); comment out an active setting.
- Set SPFIgnoreResults to true.
- Update comment in ignore.hosts to reflect the current milter setup.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

install_opendmarc.sh

@@ -23,9 +23,17 @@ postfix_spool_dir="/var/spool/postfix"
 opendmarc_socket_dir="${postfix_spool_dir}/opendmarc"
 opendmarc_socket_file="${opendmarc_socket_dir}/opendmarc.sock"
 
+# - HistoryFile is intentionally NOT set: it is only useful if the records are
+# - imported regularly with opendmarc-importstats(8) to generate DMARC aggregate
+# - reports. We do not generate such reports, so the file would only grow and,
+# - located in /run, be lost at every reboot. An active setting is commented out
+# - further below.
+# -
 config_file_name_value_parameters="
    AuthservID|HOSTNAME
    TrustedAuthservIDs|HOSTNAME
+   PublicSuffixList|/usr/share/publicsuffix/public_suffix_list.dat
+   UserID|opendmarc
    PidFile|/run/opendmarc/opendmarc.pid"
 if which sympa ; then
    config_file_name_value_parameters="$config_file_name_value_parameters
@@ -44,8 +52,7 @@ config_file_name_value_parameters="$config_file_name_value_parameters
    UMask|002
    FailureReports|false
    AutoRestart|true
-  HistoryFile|/run/opendmarc/opendmarc.dat
+   SPFIgnoreResults|true
-   SPFIgnoreResults|false
    SPFSelfValidate|true
    Socket|${opendmarc_socket_file}
 "
@@ -468,27 +475,17 @@ else
 fi
 
 
-# - Add 'HistoryFile' with default value to the original opendmarc.conf file
+# - Do not use 'HistoryFile': see the note at the parameter list on top of this
+# - script. Comment out an active setting, e.g. left over from a previous version
+# - of this script.
 #
 _param="HistoryFile"
-echononl " Add '${_param}' with default value to the opendmarc.conf file.."
+echononl " Deactivate '${_param}' in the opendmarc.conf file.."
-if ! $(grep -q -E "^${_param}\s+" ${opendmarc_conf_file} 2> /dev/null) ; then
+if grep -q -E "^\s*${_param}\s+" ${opendmarc_conf_file} 2> /dev/null ; then
-   cat << EOF >> ${opendmarc_conf_file}
+   perl -i -p -e 's/^(\s*HistoryFile\s)/#$1/' ${opendmarc_conf_file} > "$log_file" 2>&1
-
-## HistoryFile (string)
-##
-## If set, specifies the location of a text file to which records are written
-## that can be used to generate DMARC aggregate reports. Records are batches of
-## rows containing information about a single received message, and include all
-## relevant information needed to generate a DMARC aggregate report. It is
-## expected that this will not be used in its raw form, but rather periodically
-## imported into a relational database from which the aggregate reports can be
-## extracted using opendmarc-importstats(8).
-#
-#HistoryFile /run/opendmarc/opendmarc.dat
-EOF
    if [[ $? -eq 0 ]] ; then
       echo_ok
+      opendmarc_needs_restart=true
    else
       echo_failed
       error "$(cat $log_file)"
@@ -509,7 +506,7 @@ if ! $(grep -q -E "^${_param}\s+" ${opendmarc_conf_file} 2> /dev/null) ; then
 ## is useful if you want the filter to perform SPF checks itself, or because you
 ## don't trust the arriving header. The default is "false".
 #
-SPFIgnoreResults false
+SPFIgnoreResults true
 EOF
    if [[ $? -eq 0 ]] ; then
       echo_ok
@@ -547,6 +544,60 @@ else
 fi
 
 
+# - Add 'PublicSuffixList' with default value to the original opendmarc.conf file
+#
+_param="PublicSuffixList"
+echononl " Add '${_param}' with default value to the opendmarc.conf file.."
+if ! $(grep -q -E "^${_param}\s+" ${opendmarc_conf_file} 2> /dev/null) ; then
+   cat << EOF >> ${opendmarc_conf_file}
+
+## PublicSuffixList (string)
+##
+## Specifies the path to a file that contains top-level domains (TLDs) that
+## will be used to compute the Organizational Domain for a given domain name,
+## as described in the DMARC specification. If not provided, the filter will
+## not be able to determine the Organizational Domain and only the presented
+## domain will be evaluated.
+#
+PublicSuffixList /usr/share/publicsuffix/public_suffix_list.dat
+EOF
+   if [[ $? -eq 0 ]] ; then
+      echo_ok
+   else
+      echo_failed
+      error "$(cat $log_file)"
+   fi
+else
+   echo_skipped
+fi
+
+
+# - Add 'UserID' with default value to the original opendmarc.conf file
+#
+_param="UserID"
+echononl " Add '${_param}' with default value to the opendmarc.conf file.."
+if ! $(grep -q -E "^${_param}\s+" ${opendmarc_conf_file} 2> /dev/null) ; then
+   cat << EOF >> ${opendmarc_conf_file}
+
+## UserID (string)
+##
+## Attempts to become the specified userid before starting operations.
+## The process will be assigned all of the groups and primary group ID of
+## the named userid unless an alternate group is specified.
+#
+UserID opendmarc
+EOF
+   if [[ $? -eq 0 ]] ; then
+      echo_ok
+   else
+      echo_failed
+      error "$(cat $log_file)"
+   fi
+else
+   echo_skipped
+fi
+
+
 # - Save configuration file from distribution
 # -
 echononl "   Save configuration file from distribution"
@@ -746,22 +797,18 @@ else
    cat <<EOF > ${opendmarc_base_dir}/ignore.hosts 2> $log_file
 # /etc/opendmarc/ignore.hosts
 #
-# Aktuell hat OpenDMARC seinen Milter nur am Dienst
+# OpenDMARC haengt als Milter an den SMTP-Diensten von Postfix
-# 'localhost:10025' hängen. Dort ist der Client
+# (smtpd_milters in main.cf), also vor Amavis. Er sieht dort die
-# immer 127.0.0.1, nicht die externe Gegenstelle.
+# echte Client-IP. An 'localhost:10025' laeuft kein Milter.
 #
-# Deshalb macht es in diesem Setup keinen Sinn,
+# Eingetragene Hostnamen, IP-Adressen oder CIDR-Netze werden von
-# hier IP-Adressen von externen Diensten (CRSend etc.)
+# OpenDMARC nicht geprueft. Ein Eintrag wirkt also tatsaechlich:
-# einzutragen – sie würden nie matchen.
+# fuer solche Clients werden DMARC-Richtlinien nicht durchgesetzt.
 #
-# WICHTIG:
+# Eigene Listen- und Relay-Server gehoeren nicht hierher: sie werden
-#  - KEIN 127.0.0.1
+# mit /etc/postfix/smtpd_milter_map von allen Miltern ausgenommen.
-#  - KEIN localhost
-#  - KEIN ::1
 #
-# Eintrag dieser Adressen würde DMARC komplett deaktivieren.
+# ==> Datei bleibt absichtlich leer, solange keine Ausnahme noetig ist.
-#
-# ==> Datei bleibt absichtlich leer.
 EOF
    opendmarc_needs_restart=true
    if [[ $? -eq 0 ]] ; then