If a message is held for header_filter_rules and subsequently approved, dmarc_moderation_action is bypassed.

[Mark Sapiro]

Messages which are pre-approved with an Approved: header or held by a pipeline handler earlier than Moderate and accepted by a moderator will bypass the dmarc_moderation_action test and applicable action.

Clearly Munge From or Wrap Message actions should be done in this case. What to do in a case of a dmarc_moderation_action of Reject or Discard is not so clear, but either they should be honored or at least the Wrap Message action should be applied.

Given that a moderator likely approved the message based on content without considering DMARC, probably Reject and Discard actions should be honored.

[Jim Popovitch (jimpop)]

IMO, if dmarc_moderation_action is Reject/Discard, then the moderator queue should be empty. Otherwise Munge/Wrap should still occur (based on dmarc_moderation_action) once a pending message is approved.

[Mark Sapiro (msapiro)]

On 06/25/2014 03:43 PM, jimpop wrote:
> IMO, if dmarc_moderation_action is Reject/Discard, then the moderator
> queue should be empty. Otherwise Munge/Wrap should still occur (based
> on dmarc_moderation_action) once a pending message is approved.

The issue is that the message is held by SpamDetect because of a
header_filter_rules action. It is then approved by a moderator and
processed through the remainder of the pipeline, but because it had
already been approved, Moderate.process returned without ever checking
dmarc_moderate_action.

So even though dmarc_moderation should have applied to this message, it
didn't because the message was held by a prior handler and approved and
the moderator's approval overrode any dmarc_moderation_action.

--
Mark Sapiro <email address hidden> The highway is for gamblers,
San Francisco Bay Area, California better use your sense - B. Dylan

[Mark Sapiro (msapiro)]

Moved the dmarc_moderation_action checks from the Moderate handler to the SpamDetect handler so that the Reject and Discard actions will be done before the message might be held by header_filter_rules, and the Wrap Message and Munge From actions will be done on messages held by header_filter_rules if the message is approved.