AWS ses: Fix DMARC reject policy check in Lambda example
Summary
Corrected the DMARC enforcement logic so the bounce is triggered when the DMARC verdict is FAIL and the policy is 'reject' (previously incorrectly checked receipt.dmarcPolicy.status === 'REJECT').
Security assessment
The prior example compared a non-existent nested field (dmarcPolicy.status) against 'REJECT', so the DMARC reject enforcement would never fire, potentially allowing spoofed mail to be accepted. The fix aligns the check with the actual field/value, restoring intended email authentication enforcement.
Evidence
+ && receipt.dmarcPolicy === 'reject') {
Diff
diff --git a/ses/latest/dg/receiving-email-action-lambda-example-functions.md b/ses/latest/dg/receiving-email-action-lambda-example-functions.md index 83c3cd1..4c2c212 100644 --- a//ses/latest/dg/receiving-email-action-lambda-example-functions.md +++ b//ses/latest/dg/receiving-email-action-lambda-example-functions.md @@ -138 +138 @@ This examples sends a bounce message if an incoming email fails DMARC authentica - // If DMARC verdict is FAIL and the sending domain's policy is REJECT + // If DMARC verdict is FAIL and the sending domain's policy is reject @@ -141 +141 @@ This examples sends a bounce message if an incoming email fails DMARC authentica - && receipt.dmarcPolicy.status === 'REJECT') { + && receipt.dmarcPolicy === 'reject') { @@ -179,2 +179,2 @@ This examples sends a bounce message if an incoming email fails DMARC authentica - // If the DMARC verdict is anything else (PASS, QUARANTINE or GRAY), accept - // the message and process remaining receipt rules in the rule set. + // Otherwise (the DMARC verdict is not FAIL, or the policy is not reject), + // accept the message and process remaining receipt rules in the rule set.