DMARC reports and out-of-office replies: the header the RFCs never mention
DMARC aggregate reports are mail sent by a machine, on a schedule, to whatever address a domain owner put in rua=. Nobody reads them as they arrive. That makes them exactly the kind of message an out-of-office reply should never answer, and the standard way to say so is one header: Auto-Submitted: auto-generated. The DMARC RFCs never mention it. Two open-source report generators set it anyway. This post is the check behind those two sentences, plus a short script that shows what happens to a rep
🎯 Vulnerability: Remote Code Execution (RCE)
💡 Defense Fix: Avoid executing shell commands via system(). Use parameterized APIs and strict input sanitization.