# Phase 0 Baseline Audit — advmfr.net

Date: 2026-08-14
Auditor: Claude (read-only, via browser on the live cPanel session + DNS lookups)
Account: `sc6mixq8738` on `arome.o2switch.net` (o2switch shared hosting)

## Scope determination

| Domain | Hosting | In scope |
|---|---|---|
| **advmfr.net** | o2switch, this account (MX `arome.o2switch.net`, A `109.234.162.168`) | ✅ Yes |
| advmfr.com | Google Workspace (Google MX/SPF) | ❌ No — filtering happens in Gmail/Google Admin |
| elevaseo.com | o2switch, **different** cPanel account (login `mixq8738`), DNS on Cloudflare | ❌ Not now |

## Inventory

- **Mailboxes**: 87, all `@advmfr.net`. Notable:
  - `quarantine@advmfr.net` already exists (0 bytes) → will be the observation quarantine.
  - Dead/test candidates (0 bytes, cleanup candidates for a later phase): `test@`, `test111@`,
    `bhtest@`, `narincopy@`, `njoi@`, `anut@`, `arunrot@`, `documents@`, `kanyaphon@`,
    `kanyarat@`, `mcd@`, `parichat@`, `pheeriya@`, `saowalak@`, `sathit@`, `sunicha@`,
    `suthum@`, `suveera@`, `thanabat@`, `vinod@`, `wasan@`, `narin.bb@`.
- **Forwarders**: none (checked "All Domains") → no spam-relay risk, Phase 2b not needed.
- **Autoresponders**: none (checked "All Domains") → no backscatter from auto-replies.
- **BoxTrapper**: disabled on all 87 accounts. ✅
- **Spam Filters (o2switch antispam behavior)**: filtering ON + Spam Box ON
  (detected spam sorted into each mailbox's Spam subfolder). ✅ Recommended mode.

## DNS / authentication (advmfr.net)

Nameservers: `ns1/ns2.o2switch.net` → zone editable in cPanel Zone Editor.

| Record | Value | Verdict |
|---|---|---|
| SPF | `v=spf1 ip4:109.234.162.168 +a +mx +include:spf.jabatus.fr ~all` | ✅ Jabatus include present. `~all` (softfail) — hardening to `-all` possible later (elevaseo.com already uses `-all`). |
| DKIM | `default._domainkey` RSA key published | ✅ |
| DMARC | `v=DMARC1; p=none;` | ⚠️ No `rua` tag → no aggregate reports collected, so the policy can never be safely hardened. Fix pending. |

Side finding (out of scope, worth flagging to whoever runs advmfr.com): advmfr.com publishes
**three simultaneous DMARC records** (`p=quarantine` ×2 + `p=none`) — multiple DMARC records
are invalid and receivers ignore DMARC entirely for that domain.

## 🚨 Critical finding: 3 pre-existing global email filters, all harmful

All three use the **"Fail With Message"** action — every match sends a failure notice back to
the (almost always spoofed) sender. That is textbook **backscatter**: the server bombards
innocent third parties and burns its own sending reputation.

| Filter | Condition | Action | Problems |
|---|---|---|---|
| `X-Spam-Flag: YES` | Any Header contains `X-Spam-Flag: YES` | Fail With Message | Backscatter on **every** detected spam; fully redundant with the Spam Box sorting. |
| `Executables & scripts` | Body matches regex | Fail With Message ("FAIL VIRUS Executables & scripts") | Body matching is blind to Base64-encoded bodies (most malware), and when it does fire it backscatters. |
| `EXEC` | Body matches regex | Fail With Message ("Macros POTENTIAL VIRUS") | Same as above. |

These filters likely explain the current situation: detection rests on the undecodable body,
and the only action that fires sends bounces.

## Remediation decided (executed via runbook.md)

1. Delete `X-Spam-Flag: YES`.
2. Convert `EXEC` and `Executables & scripts`: keep conditions, action → `Redirect to Email`
   `quarantine@advmfr.net` (keeps the detection, kills the backscatter).
3. Create `10-quarantine-score10` (Spam Bar contains `++++++++++` → Redirect to quarantine).
4. Create `00-whitelist-critical` (Stop Processing Rules) once the critical-sender list is provided,
   and keep it in position 1.
5. Add `rua=` to the DMARC record (reporting mailbox to be chosen).