--- title: Action plan description: What is done, what is gated on a date, and what is proposed next. icon: ListChecks verified: 2026-08-19 --- The living plan for the advmfr.net mail protection. Three sections: done, scheduled behind a gate, and proposed. Nothing moves from one section to the next without its gate being met, and every executed step gets a dated entry in the [log](/docs/it/email/log). ## Done - Backscatter filters removed; four quarantine-only rules live ([current configuration](/docs/it/email/current-configuration)). - Central Quarantine folder catching traffic since 2026-08-17, reviewed daily. - DMARC reporting live: `rua` → `dmarc@advmfr.net`, weekly local digest with a per-domain breakdown and a ≥ 98% alignment gate. - Outbound rules established after the 17 August incident: no bulk mail from any `@advmfr.net` mailbox; company-wide mailings go through the Google side. - Self-spoof phishing wave countered (rule `30-self-spoof`, staff notice). - Conditional whitelists `00-04` live and verified 2026-08-24 (design below): internal `@advmfr.com` mail with `SPF_PASS` skips all rules — including the attachment rules that were the main false-positive source — while forgeries without `SPF_PASS` fall through to the normal chain. ## Scheduled: behind gates | Step | Gate | What happens | |---|---|---| | Rule 3 graduates to permanent deletion | 7 consecutive clean days of Quarantine (earliest 21 Aug 2026) | `10-quarantine-score10` action changes from Deliver to Folder to Discard Message | | SPF hardening | Ships **together** with the `SPF_FAIL` companion rule (see proposals below), never alone | `~all` becomes `-all` in the SPF record; external forgeries hard-fail | | Whitelist for external partners | Critical external senders list still pending | Added alongside the internal whitelists, `Stop Processing Rules` | | DMARC ladder, advmfr.net | Two consecutive weekly digests ≥ 98% aligned, then one clean week per further step | `p=none` → `p=quarantine` pct 25 → 50 → 100 → `p=reject; sp=reject` | | advmfr.com DMARC fix | Option chosen by management (centralized reports recommended) | Three conflicting records collapsed into one; cross-domain authorization record on the .net zone; Bluehost SPF cleanup | | Steady state | After graduation | Checks drop to twice a week; quarterly purge and rules review | ## Internal whitelist design (list received 2026-08-19) The senders that must never be filtered turn out to be mostly the company's own `@advmfr.com` addresses (Google side) plus four company-practice Gmail accounts. A plain From whitelist would be an open door while advmfr.com's DMARC is still broken, so every entry is **conditional on `SPF_PASS`**: genuine Google mail passes SPF, a forger does not. | Filter | Rules (all with **and** `Spam Status` contains `SPF_PASS`) | Action | |---|---|---| | `00-wl-advmfr-com` | `From` contains `@advmfr.com` | Stop Processing Rules | | `01-wl-advance-manufacturers` | `From` contains `advance.manufacturers@gmail.com` | Stop Processing Rules | | `02-wl-export-advmfr` | `From` contains `export.advmfr@gmail.com` | Stop Processing Rules | | `03-wl-jiraporn-advmfr` | `From` contains `jiraporn.advmfr@gmail.com` | Stop Processing Rules | | `04-wl-purchase-advmfr` | `From` contains `purchase.advmfr@gmail.com` | Stop Processing Rules | All five sit **above every other rule** — order is the whitelist. Accepted trade-offs, stated plainly: - A whitelisted colleague's `.xls` attachment now bypasses the macro rule. That is the point (it was the main false-positive source), but it means a **compromised** real account delivers straight to inboxes — which is why the advmfr.com hygiene (DMARC fix, 2FA on Google accounts) matters. - Until the Bluehost IP is removed from advmfr.com's SPF (fix step C), tenants of `box574.bluehost.com` technically pass its SPF. One more reason to execute that cleanup promptly. ## Proposed next filters All follow the standing pattern: **quarantine first, observe, only then graduate**. None of these is in place yet. ### 31-self-spoof-hardfail: required companion of the SPF hardening | | | |---|---| | Rules | `From` contains `@advmfr.net` **and** `Spam Status` contains `SPF_FAIL` | | Action | Deliver to Folder `/.Quarantine` | | False-positive risk | Very low: legitimate senders pass SPF | | Observation | 7 days | Without it, the `-all` hardening silently disables rule 4 (which matches `SPF_SOFTFAIL`). Create 31 first, then flip the SPF record; rule 30 stays as a harmless second net for softfail edge cases such as third-party forwarders. ### 32-lookalike-freemail: the BEC twin pattern | | | |---|---| | Rules | `From` matches regex `(?i)advmfr[^@]*@(gmail|googlemail|hotmail|outlook|yahoo)\.` | | Action | Deliver to Folder `/.Quarantine` | | False-positive risk | Now handled structurally: the four known company-practice Gmail accounts are whitelisted **above** this rule (see the whitelist design), so it only ever sees unknown look-alikes | | Observation | 14 days | Catches **new, unknown** members of the `something.advmfr@gmail.com` address family — the pattern the [watchlist](/docs/it/email/suspicious-indicators) tracks as the standard Business Email Compromise setup. The 2026-08-19 sender list confirmed the pattern is also a company practice, which is exactly why only the known addresses are whitelisted and any new one lands in Quarantine for a human decision. ### 33-exec-impersonation: display-name spoofing | | | |---|---| | Rules | `From` contains `Kulisra` **and** `From` does not contain `advmfr` | | Action | Deliver to Folder `/.Quarantine` | | False-positive risk | Low, the surname is rare and the condition exempts both company domains | | Observation | 7 days | The From header carries the display name, so this catches "Narin Kulisra <random@gmail.com>" style impersonation, the inbound variant already seen as `narinsoda33@gmail.com` on the watchlist. Extendable to other executives later, one rule per surname. ### 34-verify-phish-subjects: optional, wider net | | | |---|---| | Rules | `Subject` matches regex `(?i)(verify (your )?(account|mailbox|webmail)|account.*(suspended|blocked|deactivat)|password.*(expir|reset))` | | Action | Deliver to Folder `/.Quarantine` | | False-positive risk | Moderate, legitimate service notifications can match. Longest observation of the set | | Observation | 14 days minimum, graduate only if the quarantine stays clean | Aims at the credential-phishing subject family ("your account will be blocked, verify now") regardless of sender tricks. ## Standing staff notice No email will ever ask anyone to "verify your webmail account". Whoever clicked such a link says so immediately, without blame, and the mailbox password is changed on the spot.