diff --git a/_modules/index.html b/_modules/index.html index 6591586..4f1a5ac 100644 --- a/_modules/index.html +++ b/_modules/index.html @@ -8,7 +8,7 @@ - Overview: module code — parsedmarc 6.1.8 documentation + Overview: module code — parsedmarc 6.2.0 documentation @@ -58,7 +58,7 @@
- 6.1.8 + 6.2.0
diff --git a/_modules/parsedmarc.html b/_modules/parsedmarc.html index fcd70ce..1b037c2 100644 --- a/_modules/parsedmarc.html +++ b/_modules/parsedmarc.html @@ -8,7 +8,7 @@ - parsedmarc — parsedmarc 6.1.8 documentation + parsedmarc — parsedmarc 6.2.0 documentation @@ -58,7 +58,7 @@
- 6.1.8 + 6.2.0
@@ -185,7 +185,7 @@ from parsedmarc.utils import timestamp_to_human, human_timestamp_to_datetime from parsedmarc.utils import parse_email -__version__ = "6.1.8" +__version__ = "6.2.0" logging.basicConfig( format='%(levelname)8s:%(filename)s:%(lineno)d:' @@ -230,7 +230,8 @@ """Raised when an invalid DMARC forensic report is encountered""" -def _parse_report_record(record, nameservers=None, dns_timeout=2.0): +def _parse_report_record(record, nameservers=None, dns_timeout=2.0, + parallel=False): """ Converts a record from a DMARC aggregate report into a more consistent format @@ -253,7 +254,8 @@ new_record_source = get_ip_address_info(record["row"]["source_ip"], cache=IP_ADDRESS_CACHE, nameservers=nameservers, - timeout=dns_timeout) + timeout=dns_timeout, + parallel=parallel) new_record["source"] = new_record_source new_record["count"] = int(record["row"]["count"]) policy_evaluated = record["row"]["policy_evaluated"].copy() @@ -353,7 +355,8 @@ return new_record -
[docs]def parse_aggregate_report_xml(xml, nameservers=None, timeout=2.0): +
[docs]def parse_aggregate_report_xml(xml, nameservers=None, timeout=2.0, + parallel=False): """Parses a DMARC XML report string and returns a consistent OrderedDict Args: @@ -452,13 +455,15 @@ for record in report["record"]: report_record = _parse_report_record(record, nameservers=nameservers, - dns_timeout=timeout) + dns_timeout=timeout, + parallel=parallel) records.append(report_record) else: report_record = _parse_report_record(report["record"], nameservers=nameservers, - dns_timeout=timeout) + dns_timeout=timeout, + parallel=parallel) records.append(report_record) new_report["records"] = records @@ -524,7 +529,8 @@ return xml
-
[docs]def parse_aggregate_report_file(_input, nameservers=None, dns_timeout=2.0): +
[docs]def parse_aggregate_report_file(_input, nameservers=None, dns_timeout=2.0, + parallel=False): """Parses a file at the given path, a file-like object. or bytes as a aggregate DMARC report @@ -541,7 +547,8 @@ return parse_aggregate_report_xml(xml, nameservers=nameservers, - timeout=dns_timeout)
+ timeout=dns_timeout, + parallel=parallel)
[docs]def parsed_aggregate_reports_to_csv(reports): @@ -656,7 +663,8 @@
[docs]def parse_forensic_report(feedback_report, sample, msg_date, nameservers=None, dns_timeout=2.0, - strip_attachment_payloads=False): + strip_attachment_payloads=False, + parallel=False): """ Converts a DMARC forensic report and sample to a ``OrderedDict`` @@ -700,7 +708,8 @@ ip_address = parsed_report["source_ip"] parsed_report_source = get_ip_address_info(ip_address, nameservers=nameservers, - timeout=dns_timeout) + timeout=dns_timeout, + parallel=parallel) parsed_report["source"] = parsed_report_source del parsed_report["source_ip"] @@ -800,7 +809,7 @@
[docs]def parse_report_email(input_, nameservers=None, dns_timeout=2.0, - strip_attachment_payloads=False): + strip_attachment_payloads=False, parallel=False): """ Parses a DMARC report from an email @@ -871,7 +880,8 @@ aggregate_report = parse_aggregate_report_file( payload, nameservers=ns, - dns_timeout=dns_timeout) + dns_timeout=dns_timeout, + parallel=parallel) result = OrderedDict([("report_type", "aggregate"), ("report", aggregate_report)]) return result @@ -898,7 +908,8 @@ date, nameservers=nameservers, dns_timeout=dns_timeout, - strip_attachment_payloads=strip_attachment_payloads) + strip_attachment_payloads=strip_attachment_payloads, + parallel=parallel) except InvalidForensicReport as e: error = 'Message with subject "{0}" ' \ 'is not a valid ' \ @@ -918,7 +929,7 @@
[docs]def parse_report_file(input_, nameservers=None, dns_timeout=2.0, - strip_attachment_payloads=False): + strip_attachment_payloads=False, parallel=False): """Parses a DMARC aggregate or forensic file at the given path, a file-like object. or bytes @@ -943,7 +954,8 @@ content = file_object.read() try: report = parse_aggregate_report_file(content, nameservers=nameservers, - dns_timeout=dns_timeout) + dns_timeout=dns_timeout, + parallel=parallel) results = OrderedDict([("report_type", "aggregate"), ("report", report)]) except InvalidAggregateReport: @@ -952,7 +964,8 @@ results = parse_report_email(content, nameservers=nameservers, dns_timeout=dns_timeout, - strip_attachment_payloads=sa) + strip_attachment_payloads=sa, + parallel=parallel) except InvalidDMARCReport: raise InvalidDMARCReport("Not a valid aggregate or forensic " "report") diff --git a/_modules/parsedmarc/elastic.html b/_modules/parsedmarc/elastic.html index 49ad002..6606b9f 100644 --- a/_modules/parsedmarc/elastic.html +++ b/_modules/parsedmarc/elastic.html @@ -8,7 +8,7 @@ - parsedmarc.elastic — parsedmarc 6.1.8 documentation + parsedmarc.elastic — parsedmarc 6.2.0 documentation @@ -58,7 +58,7 @@
- 6.1.8 + 6.2.0
@@ -251,6 +251,7 @@ class _EmailAttachmentDoc(Document): filename = Text() content_type = Text() + sha256 = Text() class _ForensicSampleDoc(InnerDoc): @@ -284,9 +285,9 @@ self.bcc.append(_EmailAddressDoc(display_name=display_name, address=address)) - def add_attachment(self, filename, content_type): + def add_attachment(self, filename, content_type, sha256): self.attachments.append(_EmailAttachmentDoc(filename=filename, - content_type=content_type)) + content_type=content_type, sha256=sha256)) class _ForensicReportDoc(Document): @@ -616,7 +617,8 @@ address=address["address"]) for attachment in forensic_report["parsed_sample"]["attachments"]: sample.add_attachment(filename=attachment["filename"], - content_type=attachment["mail_content_type"]) + content_type=attachment["mail_content_type"], + sha256=attachment["sha256"]) forensic_doc = _ForensicReportDoc( feedback_type=forensic_report["feedback_type"], diff --git a/_modules/parsedmarc/splunk.html b/_modules/parsedmarc/splunk.html index 975c0fc..c6f0143 100644 --- a/_modules/parsedmarc/splunk.html +++ b/_modules/parsedmarc/splunk.html @@ -8,7 +8,7 @@ - parsedmarc.splunk — parsedmarc 6.1.8 documentation + parsedmarc.splunk — parsedmarc 6.2.0 documentation @@ -58,7 +58,7 @@
- 6.1.8 + 6.2.0
diff --git a/_modules/parsedmarc/utils.html b/_modules/parsedmarc/utils.html index edc6152..273d24b 100644 --- a/_modules/parsedmarc/utils.html +++ b/_modules/parsedmarc/utils.html @@ -8,7 +8,7 @@ - parsedmarc.utils — parsedmarc 6.1.8 documentation + parsedmarc.utils — parsedmarc 6.2.0 documentation @@ -58,7 +58,7 @@
- 6.1.8 + 6.2.0
@@ -399,13 +399,14 @@ return human_timestamp_to_datetime(human_timestamp).timestamp()
-
[docs]def get_ip_address_country(ip_address): +
[docs]def get_ip_address_country(ip_address, parallel=False): """ Uses the MaxMind Geolite2 Country database to return the ISO code for the country associated with the given IPv4 or IPv6 address Args: - ip_address (str): The IP address to query for + ip_address (str): The IP address to query for, + parallel (bool): parallel processing Returns: str: And ISO country code associated with the given IP address @@ -416,6 +417,9 @@ Args: location (str): Local location for the database file """ + if parallel: + logging.warning("Cannot download GeoIP database in parallel mode") + return url = "https://geolite.maxmind.com/download/geoip/database/" \ "GeoLite2-Country.tar.gz" # Use a browser-like user agent string to bypass some proxy blocks @@ -435,11 +439,15 @@ logger.warning("Error downloading {0}: {1}".format(url, e.__str__())) - system_paths = ["/usr/local/share/GeoIP/GeoLite2-Country.mmdb", - "/usr/share/GeoIP/GeoLite2-Country.mmdb", - "/var/lib/GeoIP/GeoLite2-Country.mmdb", - "/var/local/lib/GeoIP/GeoLite2-Country.mmdb", - "C:\\GeoIP\\GeoLite2-Country.mmdb"] + system_paths = [ + "GeoLite2-Country.mmdb", + "/usr/local/share/GeoIP/GeoLite2-Country.mmdb", + "/usr/share/GeoIP/GeoLite2-Country.mmdb", + "/var/lib/GeoIP/GeoLite2-Country.mmdb", + "/var/local/lib/GeoIP/GeoLite2-Country.mmdb", + "C:\\GeoIP\\GeoLite2-Country.mmdb" + ] + db_path = None for system_path in system_paths: @@ -472,7 +480,8 @@ return country
-
[docs]def get_ip_address_info(ip_address, cache=None, nameservers=None, timeout=2.0): +
[docs]def get_ip_address_info(ip_address, cache=None, nameservers=None, + timeout=2.0, parallel=False): """ Returns reverse DNS and country information for the given IP address @@ -482,6 +491,7 @@ nameservers (list): A list of one or more nameservers to use (Cloudflare's public DNS resolvers by default) timeout (float): Sets the DNS timeout in seconds + parallel (bool): parallel processing Returns: OrderedDict: ``ip_address``, ``reverse_dns`` @@ -497,7 +507,7 @@ reverse_dns = get_reverse_dns(ip_address, nameservers=nameservers, timeout=timeout) - country = get_ip_address_country(ip_address) + country = get_ip_address_country(ip_address, parallel=parallel) info["country"] = country info["reverse_dns"] = reverse_dns info["base_domain"] = None diff --git a/_sources/index.rst.txt b/_sources/index.rst.txt index 0d020f6..fa87f5e 100644 --- a/_sources/index.rst.txt +++ b/_sources/index.rst.txt @@ -142,6 +142,8 @@ The full set of configuration options are: - ``debug`` - bool: Print debugging messages - ``silent`` - bool: Only print errors (Default: True) - ``log_file`` - str: Write log messages to a file at this path + - ``n_procs`` - int: Number of process to run in parallel when parsing in CLI mode (Default: 1) + - ``chunk_size`` - int: Number of files to give to each process when running in parallel. Setting this to a number larger than one can improve performance when processing thousands of files - ``imap`` - ``host`` - str: The IMAP server hostname or IP address - ``port`` - int: The IMAP server port (Default: 993) @@ -155,7 +157,10 @@ The full set of configuration options are: - ``delete`` - bool: Delete messages after processing them, instead of archiving them - ``test`` - bool: Do not move or delete messages - ``elasticsearch`` - - ``hosts`` - str: A comma separated list of hostnames and ports or URLs (e.g. ``127.0.0.1:9200`` or https://user:secret@localhost:443) + - ``hosts`` - str: A comma separated list of hostnames and ports or URLs (e.g. ``127.0.0.1:9200`` or ``https://user:secret@localhost``) + + .. note:: + Special characters in the username or password must be `URL encoded`_. - ``ssl`` - bool: Use an encrypted SSL/TLS connection (Default: True) - ``cert_path`` - str: Path to a trusted certificates - ``index_suffix`` - str: A suffix to apply to the index names @@ -197,20 +202,20 @@ The full set of configuration options are: .. warning:: - ``save_aggregate`` and ``save_forensic`` are separate options because - you may not want to save forensic reports (also known as failure reports) - to your Elasticsearch instance, particularly if you are in a - highly-regulated industry that handles sensitive data, such as healthcare - or finance. If your legitimate outgoing email fails DMARC, it is possible - that email may appear later in a forensic report. + ``save_aggregate`` and ``save_forensic`` are separate options because + you may not want to save forensic reports (also known as failure reports) + to your Elasticsearch instance, particularly if you are in a + highly-regulated industry that handles sensitive data, such as healthcare + or finance. If your legitimate outgoing email fails DMARC, it is possible + that email may appear later in a forensic report. - Forensic reports contain the original headers of an email that failed a - DMARC check, and sometimes may also include the full message body, - depending on the policy of the reporting organization. + Forensic reports contain the original headers of an email that failed a + DMARC check, and sometimes may also include the full message body, + depending on the policy of the reporting organization. - Most reporting organizations do not send forensic reports of any kind for - privacy reasons. While aggregate DMARC reports are sent at least daily, - it is normal to receive very few forensic reports. + Most reporting organizations do not send forensic reports of any kind for + privacy reasons. While aggregate DMARC reports are sent at least daily, + it is normal to receive very few forensic reports. An alternative approach is to still collect forensic/failure/ruf reports in your DMARC inbox, but run ``parsedmarc`` with ``save_forensic = True`` @@ -719,17 +724,17 @@ Then, enable the service .. note:: - You must also run the above commands whenever you edit - ``davmail.service``. + You must also run the above commands whenever you edit + ``davmail.service``. .. warning:: - Always restart the service every time you upgrade to a new version of - ``davmail``: + Always restart the service every time you upgrade to a new version of + ``davmail``: - .. code-block:: bash + .. code-block:: bash - sudo service davmail restart + sudo service davmail restart To check the status of the service, run: @@ -1085,12 +1090,12 @@ Then, enable the service .. warning:: - Always restart the service every time you upgrade to a new version of - ``parsedmarc``: + Always restart the service every time you upgrade to a new version of + ``parsedmarc``: - .. code-block:: bash + .. code-block:: bash - sudo service parsedmarc restart + sudo service parsedmarc restart To check the status of the service, run: @@ -1215,20 +1220,20 @@ indicators are also in alignment**. +-----------------------+-----------------------+-----------------------+ | | **DKIM** | **SPF** | +-----------------------+-----------------------+-----------------------+ -| **Passing** | The signature in the | The mail server’s IP | +| **Passing** | The signature in the | The mail server's IP | | | DKIM header is | address is listed in | | | validated using a | the SPF record of the | | | public key that is | domain in the SMTP | -| | published as a DNS | envelope’s mail from | +| | published as a DNS | envelope's mail from | | | record of the domain | header | | | name specified in the | | | | signature | | +-----------------------+-----------------------+-----------------------+ | **Alignment** | The signing domain | The domain in the | -| | aligns with the | SMTP envelope’s mail | +| | aligns with the | SMTP envelope's mail | | | domain in the | from header aligns | -| | message’s from header | with the domain in | -| | | the message’s from | +| | message's from header | with the domain in | +| | | the message's from | | | | header | +-----------------------+-----------------------+-----------------------+ @@ -1236,7 +1241,7 @@ indicators are also in alignment**. What if a sender won't support DKIM/DMARC? ========================================== -#. Some vendors don’t know about DMARC yet; ask about SPF and DKIM/email +#. Some vendors don't know about DMARC yet; ask about SPF and DKIM/email authentication. #. Check if they can send through your email relays instead of theirs. #. Do they really need to spoof your domain? Why not use the display @@ -1246,11 +1251,11 @@ What if a sender won't support DKIM/DMARC? separate SPF and DMARC records on ``news.example.com``, and set ``p=none`` in that DMARC record. - .. warning :: +.. warning :: - Do not alter the ``p`` or ``sp`` values of the DMARC record on the - Top-Level Domain (TLD) – that would leave you vulnerable to spoofing of - your TLD and/or any subdomain. + Do not alter the ``p`` or ``sp`` values of the DMARC record on the + Top-Level Domain (TLD) – that would leave you vulnerable to spoofing of + your TLD and/or any subdomain. What about mailing lists? ========================= @@ -1258,16 +1263,139 @@ What about mailing lists? When you deploy DMARC on your domain, you might find that messages relayed by mailing lists are failing DMARC, most likely because the mailing list is spoofing your from address, and modifying the subject, footer, or other part -of the message. +of the message, thereby breaking the DKIM signature. -To fix this, the mailing list administrator must configure the list to replace -the from address of the message (also known as munging) with the address of -the mailing list, so they no longer spoof email addresses with domains -protected by DMARC. Configuration steps for common mailing list platforms are -listed below. +Mailing list list best practices +-------------------------------- + +Ideally, a mailing list should forward messages without altering the headers +or body content at all. `Joe Nelson`_ does a fantastic job of explaining exactly +what mailing lists should and shouldn't do to be fully DMARC compliant. +Rather than repeat his fine work, here's a summary: + +**Do** + +- Retain headers from the original message +- Add `RFC 2369`_ List-Unsubscribe headers to outgoing messages, instead of + adding unsubscribe links to the body + + :: + + List-Unsubscribe: + +- Add `RFC 2919`_ List-Id headers instead of modifying the subject + + :: + + List-Id: Example Mailing List + +**Do not** + +* Remove or modify any existing headers from the original message, including + From, Date, Subject, etc. +* Add to or remove content from the message body, **including traditional + disclaimers and unsubscribe footers** + +In addition to complying with DMARC, this configuration ensures that Reply +and Reply All actions work like they would with any email message. Reply +replies to the message sender, and Reply All replies to the sender and the +list. + +Configuration steps for common mailing list platforms are listed below. Mailman 2 ----------- +~~~~~~~~~ + +Navigate to General Settings, and configure the settings below + +============================ ========== +**Setting** **Value** +**subject_prefix** +**from_is_list** No +**first_strip_reply_to** No +**reply_goes_to_list** Poster +**include_rfc2369_headers** Yes +**include_list_post_header** Yes +**include_sender_header** No +============================ ========== + +Navigate to Non-digest options, and configure the settings below + +=================== ========== +**Setting** **Value** +**msg_header** +**msg_footer** +**scrub_nondigest** No +=================== ========== + + +Navigate to Privacy Options> Sending Filters, and configure the settings below + +====================================== ========== +**Setting** **Value** +**dmarc_moderation_action** Accept +**dmarc_quarentine_moderation_action** Yes +**dmarc_none_moderation_action** Yes +====================================== ========== + + +Mailman 3 +~~~~~~~~~ + +Navigate to Settings> List Identity + +Make Subject prefix blank. + +Navigate to Settings> Alter Messages + +Configure the settings below + +====================================== ========== +**Setting** **Value** +**Convert html to plaintext** No +**Include RFC2369 headers** Yes +**Include the list post header** Yes +**Explicit reply-to address** +**First strip replyo** No +**Reply goes to list** No munging +====================================== ========== + +Navigate to Settings> DMARC Mitigation + +Configure the settings below + +================================== =============================== +**Setting** **Value** +**DMARC mitigation action** No DMARC mitigations +**DMARC mitigate unconditionally** No +================================== =============================== + +Create a blank footer template for your mailing list to remove the message +footer. Unfortunately, the Postorius mailing list admin UI will not allow you +to create an empty template, so you'll have to create one using the system's +command line instead, for example: + +.. code-block:: bash + + touch var/templates/lists/list.example.com/en/list:member:regular:footer + +Where ``list.example.com`` the list ID, and ``en`` is the language. + +Then restart mailman core. + +Workarounds +----------- + +If a mailing list must go **against** best practices and +modify the message (e.g. to add a required legal footer), the mailing +list administrator must configure the list to replace the From address of the +message (also known as munging) with the address of the mailing list, so they +no longer spoof email addresses with domains protected by DMARC. + +Configuration steps for common mailing list platforms are listed below. + +Mailman 2 +~~~~~~~~~ Navigate to Privacy Options> Sending Filters, and configure the settings below @@ -1278,21 +1406,50 @@ Navigate to Privacy Options> Sending Filters, and configure the settings below **dmarc_none_moderation_action** Yes ====================================== ========== +.. note:: + + Message wrapping could be used as the DMARC mitigation action instead. In + that case, the original message is added as an attachment to the mailing + list message, but that could interfere with inbox searching, or mobile + clients. + + On the other hand, replacing the From address might cause users to + accidentally reply to the entire list, when they only intended to reply to + the original sender. + + Choose the option that best fits your community. + Mailman 3 ---------- +~~~~~~~~~ In the DMARC Mitigations tab of the Settings page, configure the settings below ================================== =============================== **Setting** **Value** **DMARC mitigation action** Replace From: with list address -**DMARC Mitigate unconditionally** No +**DMARC mitigate unconditionally** No ================================== =============================== -LISTSERV --------- +.. note:: -`LISTSERV 16.0-2017a`_ and higher will rewrite the From header. Some additional steps are needed for Linux hosts. + Message wrapping could be used as the DMARC mitigation action instead. In + that case, the original message is added as an attachment to the mailing + list message, but that could interfere with inbox searching, or mobile + clients. + + On the other hand, replacing the From address might cause users to + accidentally reply to the entire list, when they only intended to reply to + the original sender. + + + +LISTSERV +~~~~~~~~ + +`LISTSERV 16.0-2017a`_ and higher will rewrite the From header for domains +that enforce with a DMARC quarantine or reject policy. + +Some additional steps are needed for Linux hosts. API === @@ -1349,6 +1506,8 @@ Indices and tables .. _Cloudflare's public resolvers: https://1.1.1.1/ +.. _URL encoded: https://en.wikipedia.org/wiki/Percent-encoding#Percent-encoding_reserved_characters + .. _Modern Auth/multi-factor authentication: http://davmail.sourceforge.net/faq.html .. _GeoLite2-Country.mmdb: https://geolite.maxmind.com/download/geoip/database/GeoLite2-Country.tar.gz @@ -1369,4 +1528,10 @@ Indices and tables .. _XML files: https://github.com/domainaware/parsedmarc/tree/master/splunk +.. _Joe Nelson: https://begriffs.com/posts/2018-09-18-dmarc-mailing-list.html + +.. _RFC 2369: https://tools.ietf.org/html/rfc2369 + +.. _RFC 2919: https://tools.ietf.org/html/rfc2919 + .. _LISTSERV 16.0-2017a: https://www.lsoft.com/news/dmarc-issue1-2018.asp diff --git a/_static/documentation_options.js b/_static/documentation_options.js index 00f0384..90aae8f 100644 --- a/_static/documentation_options.js +++ b/_static/documentation_options.js @@ -1,6 +1,6 @@ var DOCUMENTATION_OPTIONS = { URL_ROOT: document.getElementById("documentation_options").getAttribute('data-url_root'), - VERSION: '6.1.8', + VERSION: '6.2.0', LANGUAGE: 'None', COLLAPSE_INDEX: false, FILE_SUFFIX: '.html', diff --git a/genindex.html b/genindex.html index 25d4690..acd215a 100644 --- a/genindex.html +++ b/genindex.html @@ -9,7 +9,7 @@ - Index — parsedmarc 6.1.8 documentation + Index — parsedmarc 6.2.0 documentation @@ -59,7 +59,7 @@
- 6.1.8 + 6.2.0
diff --git a/index.html b/index.html index c272186..41d7525 100644 --- a/index.html +++ b/index.html @@ -8,7 +8,7 @@ - parsedmarc documentation - Open source DMARC report analyzer and visualizer — parsedmarc 6.1.8 documentation + parsedmarc documentation - Open source DMARC report analyzer and visualizer — parsedmarc 6.2.0 documentation @@ -58,7 +58,7 @@
- 6.1.8 + 6.2.0
@@ -131,11 +131,19 @@
  • DMARC Alignment Guide
  • What if a sender won’t support DKIM/DMARC?
  • What about mailing lists? +
  • API
  • Warning

    -
    -

    save_aggregate and save_forensic are separate options because +

    save_aggregate and save_forensic are separate options because you may not want to save forensic reports (also known as failure reports) to your Elasticsearch instance, particularly if you are in a highly-regulated industry that handles sensitive data, such as healthcare @@ -436,7 +454,6 @@ depending on the policy of the reporting organization.

    Most reporting organizations do not send forensic reports of any kind for privacy reasons. While aggregate DMARC reports are sent at least daily, it is normal to receive very few forensic reports.

    -

    An alternative approach is to still collect forensic/failure/ruf reports in your DMARC inbox, but run parsedmarc with save_forensic = True manually on a separate IMAP folder (using the reports_folder option), @@ -881,9 +898,8 @@ sudo service davmail restart

    Warning

    -
    -
    Always restart the service every time you upgrade to a new version of -davmail:
    +

    Always restart the service every time you upgrade to a new version of +davmail:

    sudo service davmail restart
     
    @@ -1163,9 +1179,8 @@ sudo service parsedmarc restart

    Warning

    -
    -
    Always restart the service every time you upgrade to a new version of -parsedmarc:
    +

    Always restart the service every time you upgrade to a new version of +parsedmarc:

    sudo service parsedmarc restart
     
    @@ -1326,28 +1341,210 @@ your domain (e.g. n separate SPF and DMARC records on news.example.com, and set p=none in that DMARC record. -
    -
    +

    Warning

    Do not alter the p or sp values of the DMARC record on the Top-Level Domain (TLD) – that would leave you vulnerable to spoofing of your TLD and/or any subdomain.

    -

    What about mailing lists?

    When you deploy DMARC on your domain, you might find that messages relayed by mailing lists are failing DMARC, most likely because the mailing list is spoofing your from address, and modifying the subject, footer, or other part -of the message.

    -

    To fix this, the mailing list administrator must configure the list to replace -the from address of the message (also known as munging) with the address of -the mailing list, so they no longer spoof email addresses with domains -protected by DMARC. Configuration steps for common mailing list platforms are -listed below.

    +of the message, thereby breaking the DKIM signature.

    +
    +

    Mailing list list best practices

    +

    Ideally, a mailing list should forward messages without altering the headers +or body content at all. Joe Nelson does a fantastic job of explaining exactly +what mailing lists should and shouldn’t do to be fully DMARC compliant. +Rather than repeat his fine work, here’s a summary:

    +

    Do

    +
      +
    • Retain headers from the original message

      +
    • +
    • Add RFC 2369 List-Unsubscribe headers to outgoing messages, instead of +adding unsubscribe links to the body

      +
      +
      List-Unsubscribe: <https://list.example.com/unsubscribe-link>
      +
      +
      +
      +
    • +
    • Add RFC 2919 List-Id headers instead of modifying the subject

      +
      +
      List-Id: Example Mailing List <list.example.com>
      +
      +
      +
      +
    • +
    +

    Do not

    +
      +
    • Remove or modify any existing headers from the original message, including +From, Date, Subject, etc.
    • +
    • Add to or remove content from the message body, including traditional +disclaimers and unsubscribe footers
    • +
    +

    In addition to complying with DMARC, this configuration ensures that Reply +and Reply All actions work like they would with any email message. Reply +replies to the message sender, and Reply All replies to the sender and the +list.

    +

    Configuration steps for common mailing list platforms are listed below.

    -

    Mailman 2

    +

    Mailman 2

    +

    Navigate to General Settings, and configure the settings below

    + ++++ + + + + + + + + + + + + + + + + + + + + + + + + + + +
    SettingValue
    subject_prefix 
    from_is_listNo
    first_strip_reply_toNo
    reply_goes_to_listPoster
    include_rfc2369_headersYes
    include_list_post_headerYes
    include_sender_headerNo
    +

    Navigate to Non-digest options, and configure the settings below

    + ++++ + + + + + + + + + + + + + + +
    SettingValue
    msg_header 
    msg_footer 
    scrub_nondigestNo
    +

    Navigate to Privacy Options> Sending Filters, and configure the settings below

    + ++++ + + + + + + + + + + + + + + +
    SettingValue
    dmarc_moderation_actionAccept
    dmarc_quarentine_moderation_actionYes
    dmarc_none_moderation_actionYes
    +
    +
    +

    Mailman 3

    +

    Navigate to Settings> List Identity

    +

    Make Subject prefix blank.

    +

    Navigate to Settings> Alter Messages

    +

    Configure the settings below

    + ++++ + + + + + + + + + + + + + + + + + + + + + + + +
    SettingValue
    Convert html to plaintextNo
    Include RFC2369 headersYes
    Include the list post headerYes
    Explicit reply-to address 
    First strip replyoNo
    Reply goes to listNo munging
    +

    Navigate to Settings> DMARC Mitigation

    +

    Configure the settings below

    + ++++ + + + + + + + + + + + +
    SettingValue
    DMARC mitigation actionNo DMARC mitigations
    DMARC mitigate unconditionallyNo
    +

    Create a blank footer template for your mailing list to remove the message +footer. Unfortunately, the Postorius mailing list admin UI will not allow you +to create an empty template, so you’ll have to create one using the system’s +command line instead, for example:

    +
    touch var/templates/lists/list.example.com/en/list:member:regular:footer
    +
    +
    +

    Where list.example.com the list ID, and en is the language.

    +

    Then restart mailman core.

    +
    +
    +
    +

    Workarounds

    +

    If a mailing list must go against best practices and +modify the message (e.g. to add a required legal footer), the mailing +list administrator must configure the list to replace the From address of the +message (also known as munging) with the address of the mailing list, so they +no longer spoof email addresses with domains protected by DMARC.

    +

    Configuration steps for common mailing list platforms are listed below.

    +
    +

    Mailman 2

    Navigate to Privacy Options> Sending Filters, and configure the settings below

    @@ -1369,9 +1566,20 @@ listed below.

    +
    +

    Note

    +

    Message wrapping could be used as the DMARC mitigation action instead. In +that case, the original message is added as an attachment to the mailing +list message, but that could interfere with inbox searching, or mobile +clients.

    +

    On the other hand, replacing the From address might cause users to +accidentally reply to the entire list, when they only intended to reply to +the original sender.

    +

    Choose the option that best fits your community.

    -
    -

    Mailman 3

    +
    +
    +

    Mailman 3

    In the DMARC Mitigations tab of the Settings page, configure the settings below

    @@ -1385,15 +1593,28 @@ listed below.

    - +
    DMARC mitigation action Replace From: with list address
    DMARC Mitigate unconditionally
    DMARC mitigate unconditionally No
    +
    +

    Note

    +

    Message wrapping could be used as the DMARC mitigation action instead. In +that case, the original message is added as an attachment to the mailing +list message, but that could interfere with inbox searching, or mobile +clients.

    +

    On the other hand, replacing the From address might cause users to +accidentally reply to the entire list, when they only intended to reply to +the original sender.

    +
    -

    LISTSERV

    -

    LISTSERV 16.0-2017a and higher will rewrite the From header. Some additional steps are needed for Linux hosts.

    +

    LISTSERV

    +

    LISTSERV 16.0-2017a and higher will rewrite the From header for domains +that enforce with a DMARC quarantine or reject policy.

    +

    Some additional steps are needed for Linux hosts.

    +
    @@ -1557,7 +1778,7 @@ or bytes.

    -parsedmarc.parse_aggregate_report_file(_input, nameservers=None, dns_timeout=2.0)[source]
    +parsedmarc.parse_aggregate_report_file(_input, nameservers=None, dns_timeout=2.0, parallel=False)[source]

    Parses a file at the given path, a file-like object. or bytes as a aggregate DMARC report

    @@ -1584,7 +1805,7 @@ aggregate DMARC report

    -parsedmarc.parse_aggregate_report_xml(xml, nameservers=None, timeout=2.0)[source]
    +parsedmarc.parse_aggregate_report_xml(xml, nameservers=None, timeout=2.0, parallel=False)[source]

    Parses a DMARC XML report string and returns a consistent OrderedDict

    @@ -1610,7 +1831,7 @@ aggregate DMARC report

    -parsedmarc.parse_forensic_report(feedback_report, sample, msg_date, nameservers=None, dns_timeout=2.0, strip_attachment_payloads=False)[source]
    +parsedmarc.parse_forensic_report(feedback_report, sample, msg_date, nameservers=None, dns_timeout=2.0, strip_attachment_payloads=False, parallel=False)[source]

    Converts a DMARC forensic report and sample to a OrderedDict

    @@ -1640,7 +1861,7 @@ aggregate DMARC report

    -parsedmarc.parse_report_email(input_, nameservers=None, dns_timeout=2.0, strip_attachment_payloads=False)[source]
    +parsedmarc.parse_report_email(input_, nameservers=None, dns_timeout=2.0, strip_attachment_payloads=False, parallel=False)[source]

    Parses a DMARC report from an email

    @@ -1671,7 +1892,7 @@ aggregate DMARC report

    -parsedmarc.parse_report_file(input_, nameservers=None, dns_timeout=2.0, strip_attachment_payloads=False)[source]
    +parsedmarc.parse_report_file(input_, nameservers=None, dns_timeout=2.0, strip_attachment_payloads=False, parallel=False)[source]

    Parses a DMARC aggregate or forensic file at the given path, a file-like object. or bytes

    @@ -2053,18 +2274,24 @@ standard RFC 822 format

    -parsedmarc.utils.get_ip_address_country(ip_address)[source]
    +parsedmarc.utils.get_ip_address_country(ip_address, parallel=False)[source]

    Uses the MaxMind Geolite2 Country database to return the ISO code for the country associated with the given IPv4 or IPv6 address

    - + - + - +
    Parameters:ip_address (str) – The IP address to query for
    Parameters:
      +
    • ip_address (str) – The IP address to query for,
    • +
    • parallel (bool) – parallel processing
    • +
    +
    Returns:And ISO country code associated with the given IP address
    Returns:

    And ISO country code associated with the given IP address

    +
    Return type:str
    Return type:

    str

    +
    @@ -2072,7 +2299,7 @@ country associated with the given IPv4 or IPv6 address

    -parsedmarc.utils.get_ip_address_info(ip_address, cache=None, nameservers=None, timeout=2.0)[source]
    +parsedmarc.utils.get_ip_address_info(ip_address, cache=None, nameservers=None, timeout=2.0, parallel=False)[source]

    Returns reverse DNS and country information for the given IP address

    @@ -2084,6 +2311,7 @@ country associated with the given IPv4 or IPv6 address

  • nameservers (list) – A list of one or more nameservers to use
  • public DNS resolvers by default) ((Cloudflare's) –
  • timeout (float) – Sets the DNS timeout in seconds
  • +
  • parallel (bool) – parallel processing
  • diff --git a/objects.inv b/objects.inv index 0d270ee..96c8f32 100644 Binary files a/objects.inv and b/objects.inv differ diff --git a/py-modindex.html b/py-modindex.html index 30f9f2f..75aa703 100644 --- a/py-modindex.html +++ b/py-modindex.html @@ -8,7 +8,7 @@ - Python Module Index — parsedmarc 6.1.8 documentation + Python Module Index — parsedmarc 6.2.0 documentation @@ -61,7 +61,7 @@
    - 6.1.8 + 6.2.0
    diff --git a/search.html b/search.html index 04eb757..552c444 100644 --- a/search.html +++ b/search.html @@ -8,7 +8,7 @@ - Search — parsedmarc 6.1.8 documentation + Search — parsedmarc 6.2.0 documentation @@ -59,7 +59,7 @@
    - 6.1.8 + 6.2.0
    diff --git a/searchindex.js b/searchindex.js index b352bf6..d971c75 100644 --- a/searchindex.js +++ b/searchindex.js @@ -1 +1 @@ -Search.setIndex({docnames:["index"],envversion:{"sphinx.domains.c":1,"sphinx.domains.changeset":1,"sphinx.domains.cpp":1,"sphinx.domains.javascript":1,"sphinx.domains.math":2,"sphinx.domains.python":1,"sphinx.domains.rst":1,"sphinx.domains.std":1,"sphinx.ext.todo":1,"sphinx.ext.viewcode":1,sphinx:55},filenames:["index.rst"],objects:{"":{parsedmarc:[0,0,0,"-"]},"parsedmarc.elastic":{AlreadySaved:[0,1,1,""],ElasticsearchError:[0,1,1,""],create_indexes:[0,2,1,""],migrate_indexes:[0,2,1,""],save_aggregate_report_to_elasticsearch:[0,2,1,""],save_forensic_report_to_elasticsearch:[0,2,1,""],set_hosts:[0,2,1,""]},"parsedmarc.splunk":{HECClient:[0,3,1,""],SplunkError:[0,1,1,""]},"parsedmarc.splunk.HECClient":{save_aggregate_reports_to_splunk:[0,4,1,""],save_forensic_reports_to_splunk:[0,4,1,""]},"parsedmarc.utils":{EmailParserError:[0,1,1,""],convert_outlook_msg:[0,2,1,""],decode_base64:[0,2,1,""],get_base_domain:[0,2,1,""],get_filename_safe_string:[0,2,1,""],get_ip_address_country:[0,2,1,""],get_ip_address_info:[0,2,1,""],get_reverse_dns:[0,2,1,""],human_timestamp_to_datetime:[0,2,1,""],human_timestamp_to_timestamp:[0,2,1,""],is_outlook_msg:[0,2,1,""],parse_email:[0,2,1,""],query_dns:[0,2,1,""],timestamp_to_datetime:[0,2,1,""],timestamp_to_human:[0,2,1,""]},parsedmarc:{IMAPError:[0,1,1,""],InvalidAggregateReport:[0,1,1,""],InvalidDMARCReport:[0,1,1,""],InvalidForensicReport:[0,1,1,""],ParserError:[0,1,1,""],SMTPError:[0,1,1,""],elastic:[0,0,0,"-"],email_results:[0,2,1,""],extract_xml:[0,2,1,""],get_dmarc_reports_from_inbox:[0,2,1,""],get_imap_capabilities:[0,2,1,""],get_report_zip:[0,2,1,""],parse_aggregate_report_file:[0,2,1,""],parse_aggregate_report_xml:[0,2,1,""],parse_forensic_report:[0,2,1,""],parse_report_email:[0,2,1,""],parse_report_file:[0,2,1,""],parsed_aggregate_reports_to_csv:[0,2,1,""],parsed_forensic_reports_to_csv:[0,2,1,""],save_output:[0,2,1,""],splunk:[0,0,0,"-"],utils:[0,0,0,"-"],watch_inbox:[0,2,1,""]}},objnames:{"0":["py","module","Python module"],"1":["py","exception","Python exception"],"2":["py","function","Python function"],"3":["py","class","Python class"],"4":["py","method","Python method"]},objtypes:{"0":"py:module","1":"py:exception","2":"py:function","3":"py:class","4":"py:method"},terms:{"2017a":0,"50m":0,"\u00fcbersicht":0,"break":0,"byte":0,"case":0,"class":0,"default":0,"float":0,"function":0,"import":0,"int":0,"long":0,"new":0,"null":0,"public":0,"return":0,"switch":0,"true":0,"while":0,And:0,DNS:0,For:0,OLE:0,One:[],TLS:0,That:0,The:0,Then:0,These:0,Use:0,Uses:0,With:0,Yes:0,_input:0,abl:0,about:[],abov:0,access_token:0,account:0,acm:0,across:0,action:0,actual:0,add:0,add_head:0,adding:[],addit:0,address:0,addresse:0,adkim:0,administr:0,adsl:0,aes128:0,aes256:0,after:0,against:0,agari:0,age:0,aggregate_index:0,aggregate_report:0,aggregate_top:0,all:0,allow:0,allowremot:0,along:[],alreadysav:0,also:0,alter:0,altern:0,although:0,alwai:0,ani:0,anonym:0,anoth:0,answer:0,apach:0,apache2:0,appear:0,append:[],appendix:0,appli:0,approach:0,approxim:0,apt:0,archiv:0,archive_fold:0,argument:0,arriv:0,arrival_d:0,arrival_date_utc:0,artifact:0,ask:0,asmx:0,aspf:0,assign:0,associ:0,attach:0,attachment_filenam:0,auth:0,auth_bas:0,auth_basic_user_fil:0,auth_failur:0,auth_result:0,authent:0,authentication_mechan:0,authentication_result:0,author:[],auto:0,autodetect:0,avail:0,avoid:0,b2c:0,backward:[],base64:0,base:0,base_domain:0,basic:0,bcc:0,bd6e1bb5:0,becaus:0,been:0,befor:[],begin_d:0,behind:0,being:0,bellsouth:0,below:0,best:0,between:0,bin:0,binari:0,bind:0,bindaddress:0,bitbucket:0,block:0,bodi:0,bool:0,brand:0,busi:0,bz2:0,cach:0,call:0,callback:0,can:0,capabl:0,caus:0,center:0,cento:0,cert:0,cert_path:0,certif:0,cest:0,chacha20:0,chain:0,chang:0,charact:0,charset:0,chart:0,check:0,checkbox:0,checkdmarc:0,chines:0,chmod:0,chown:0,cisco:0,click:0,client:0,clientsotimeout:0,cloudflar:0,code:0,collect:0,collector:0,com:0,come:0,comma:0,command:0,comment:0,commerci:0,common:0,comon:[],compat:[],complet:0,compli:0,compliant:[],compress:0,config:0,config_fil:0,configur:[],conform:0,connect:0,consid:0,consist:0,consolid:0,consum:0,contact:0,contain:0,content:0,context:0,control:0,convert:0,convert_outlook_msg:0,copi:0,correctli:0,could:0,count:0,countri:0,crash:0,creat:0,create_index:0,credenti:0,crt:0,csr:0,cumul:0,current:0,custom:0,daemon:0,dai:0,daili:0,dat:0,data:0,databas:0,date:0,date_utc:0,datetim:0,davmail:[],deb:0,debian:0,debug:0,decod:0,decode_base64:0,defens:0,delai:0,delet:0,delivery_result:0,demystifi:0,deploi:0,describ:0,descript:0,detail:0,develop:0,dict:0,dictionari:0,differ:0,directli:0,directori:0,dis:0,disabl:0,disclaim:[],displai:0,display_nam:0,disposit:0,dkim_align:0,dkim_domain:0,dkim_result:0,dkim_selector:0,dkm:0,dmarc_aggreg:0,dmarc_forens:0,dmarc_moderation_act:0,dmarc_none_moderation_act:0,dmarc_quarentine_moderation_act:0,dmarcian:0,dmarcresport:0,dns_timeout:0,doctyp:0,doe:0,domainawar:0,don:0,done:[],down:0,download:0,draft:0,dtd:0,dure:0,each:0,earlier:0,easi:0,easier:0,easy_instal:0,ecdh:0,ecdsa:0,echo:0,edit:0,editor:0,effici:0,elasticsearch_host:[],elasticsearch_index_suffix:[],elasticsearch_ssl_cert_path:[],elasticsearcherror:0,els:0,email:0,email_result:0,emailparsererror:0,enabl:0,enableew:0,enablekeepal:0,enableproxi:0,encod:0,encount:0,encrypt:0,end:0,end_dat:0,ensur:0,entir:0,envelop:0,envelope_from:0,envelope_to:0,environ:0,error:0,especi:0,etc:0,even:0,event:0,everi:0,exactli:[],exampl:0,exampleus:0,except:0,exchang:0,exclud:0,execstart:0,exist:0,exit:0,expiringdict:0,explain:[],extract:0,extract_xml:0,eyes:0,factor:0,fail:0,failur:0,fals:0,fantast:[],faster:0,feedback:0,feedback_report:0,feedback_typ:0,fetch:0,few:0,field:0,file:[],file_path:0,filenam:0,filename_safe_subject:0,fill:0,filter:0,financ:0,find:0,fine:[],first:0,fix:0,flag:0,flat:0,flexibl:0,folder:0,foldersizelimit:0,follow:0,foobar:[],footer:0,fore:0,forensic_index:0,forensic_report:0,forensic_top:0,format:0,forward:0,found:0,foundat:0,fqdn:0,frame:0,fraud:0,free:0,fresh:0,friendli:0,from:0,ftp_proxi:0,full:0,further:0,gatewai:0,gcm:0,gdpr:0,gener:0,geoip:0,geoipupd:0,geolite2:0,get:0,get_base_domain:0,get_dmarc_reports_from_inbox:0,get_filename_safe_str:0,get_imap_cap:0,get_ip_address_countri:0,get_ip_address_info:0,get_report_zip:0,get_reverse_dn:0,git:0,github:0,give:0,given:0,glass:0,global:0,gmail:0,googl:0,gpg:0,graph:0,group:0,gzip:0,handl:0,has:0,has_defect:0,have:0,head:0,header:0,header_from:0,headless:0,healthcar:0,heap:0,heavi:0,hec:0,hec_index:[],hec_token:[],hecclient:0,hectokengoesher:0,here:0,high:0,higher:0,highli:0,his:[],hop:0,host:0,hostnam:0,hour:[],hover:0,href:0,html:0,htpasswd:0,http2:0,http:0,http_proxi:0,httpasswd:0,httpd:0,https_proxi:0,human:0,human_timestamp:0,human_timestamp_to_datetim:0,human_timestamp_to_timestamp:0,icon:0,identifi:0,idl:0,imap:0,imap_port:[],imapalwaysapproxmsgs:0,imapautoexpung:0,imapcli:0,imaperror:0,imapidledelai:0,imapport:0,immedi:0,impli:0,improv:[],includ:0,includesubdomain:0,incom:0,increas:0,index_suffix:0,industri:0,inform:0,ini:0,input:0,input_:0,insid:0,instanc:0,instead:0,interact:0,interakt:0,invalid:0,invalidaggregatereport:0,invaliddmarcreport:0,invalidforensicreport:0,ip_address:0,ipv4:0,ipv6:0,is_outlook_msg:0,iso:0,issu:0,its:0,java:0,job:[],joe:[],join:[],journalctl:0,jre:0,just:0,jvm:0,jxf:0,kafka:0,kafka_aggregate_top:[],kafka_forensic_top:[],kafka_host:[],kafka_password:[],kafka_usernam:[],kb4099855:0,kb4134118:0,kb4295699:0,keepal:0,kei:0,keyout:0,kibana_saved_object:0,kind:0,know:0,known:0,larg:0,later:0,latest:0,layout:0,leak:0,least:0,leav:0,left:0,legitim:0,level:0,libemail:0,like:0,limit:0,line:0,link:0,linux:0,linux_x86_64:0,list:[],listen:0,load:0,local:0,localhost:0,locat:0,log:0,log_fil:0,login:0,longer:0,look:0,loopback:0,lot:0,lua:0,maco:0,magnifi:0,mai:0,mail:[],mail_from:0,mail_to:0,mailbox:0,mailer:0,mailrelai:0,mailto:0,main:0,maintain:[],make:0,malici:0,manag:0,manual:0,map:0,market:0,match:0,max:0,maximum:0,maxmind:0,mechan:0,mention:0,menu:0,messag:0,message_id:0,meta:0,mfrom:0,microsoft:0,might:0,migrate_index:0,mime:0,minimum:0,minut:0,mitag:[],mitig:0,mkdir:0,mmdb:0,mode:0,modern:0,modifi:0,modul:0,mon:0,monitor:0,monthli:0,monthly_index:0,more:0,most:0,mous:0,move:0,move_support:0,msg:0,msg_byte:0,msg_date:0,msgconvert:0,much:0,multi:0,mung:0,must:0,name:0,nameserv:0,nano:0,navig:0,ncontent:0,ndate:0,need:0,neeed:0,nelson:[],net:0,network:0,newest:0,newkei:0,next:0,nfrom:0,nginx:0,nmessag:0,nmime:0,node:0,non:0,none:0,noproxyfor:0,norepli:0,normal:0,nosecureimap:0,nosniff:0,notabl:0,now:0,nsubject:0,nto:0,number:0,nwettbewerb:0,object:0,observ:0,occur:0,occurr:0,oct:0,off:0,office365:0,often:0,old:0,older:0,oldest:0,ondmarc:0,one:0,onli:0,onlin:0,opendn:0,openssl:0,opt:0,ordereddict:0,org:0,org_email:0,org_extra_contact_info:0,org_nam:0,organ:0,organis:0,origin:0,original_envelope_id:0,original_mail_from:0,original_rcpt_to:0,other:0,our:0,out:0,outdat:0,outgo:0,outgoing_attach:[],outgoing_from:[],outgoing_host:[],outgoing_messag:[],outgoing_password:[],outgoing_port:[],outgoing_ssl:[],outgoing_subject:[],outgoing_to:[],outgoing_us:[],outlook:0,output_directori:0,outsid:0,over:0,overrid:0,overwrit:0,own:0,pack:0,packag:0,pad:0,page:0,pan:0,param:0,paramet:0,parent:0,pars:0,parse_aggregate_report_fil:0,parse_aggregate_report_xml:0,parse_email:0,parse_forensic_report:0,parse_report_email:0,parse_report_fil:0,parsed_aggregate_reports_to_csv:0,parsed_forensic_reports_to_csv:0,parsed_sampl:0,parser:0,parsererror:0,part:0,particular:0,particularli:0,pass:0,passag:0,passsword:0,password:0,past:0,patch:0,path:0,payload:0,pct:0,percentag:0,perform:0,period:0,perl:0,permiss:0,peter:0,pie:0,pip3:0,pip:0,place:0,plain:0,platform:0,pleas:0,plu:0,polici:0,policy_evalu:0,policy_override_com:0,policy_override_reason:0,policy_publish:0,poll:0,poly1305:0,port:0,portabl:0,posit:0,possibl:0,preload:0,premad:0,previou:0,previous:0,print:0,printabl:0,privaci:0,process:0,produc:0,product:0,program:0,project:0,prom:[],prompt:0,proofpoint:0,properti:0,protect:0,provid:0,prox:0,proxi:0,proxy_add_x_forwarded_for:0,proxy_pass:0,proxy_set_head:0,proxyhost:0,proxypassword:0,proxyport:0,proxyus:0,pry:0,public_suffix_list:0,publicsuffix:0,publish:0,pypi:0,python34:0,python3:0,python:0,queri:0,query_dn:0,quot:0,rais:0,ram:0,rather:[],readabl:0,readonlyrest:0,real:0,realli:0,reason:0,receiv:0,recipi:0,recogn:0,recommend:0,record_typ:0,refer:0,regardless:0,regul:0,regulatori:[],relai:0,relat:0,releas:0,reli:0,reliabl:0,reload:0,remain:0,remot:0,remote_addr:0,remov:0,repeat:[],replac:0,repli:0,reply_to:0,report_id:0,report_metadata:0,report_typ:0,reported_domain:0,reports_fold:0,repositori:0,req:0,request:0,request_uri:0,requir:0,resolv:0,respons:0,restart:0,restartsec:0,restor:0,result:0,retain:[],retriev:0,reus:0,revers:0,reverse_dn:0,review:0,rewrit:0,rfc822:0,rfc:0,rhel:0,right:0,rollup:0,root:0,rpm:0,rsa:0,rua:0,ruf:0,rule:0,safe:0,same:0,sameorigin:0,sample_headers_onli:0,save:0,save_aggreg:0,save_aggregate_report_to_elasticsearch:0,save_aggregate_reports_to_splunk:0,save_forens:0,save_forensic_report_to_elasticsearch:0,save_forensic_reports_to_splunk:0,save_output:0,schema:0,scope:0,search:0,second:0,secret:0,secur:0,see:0,segment:0,selector:0,self:0,send:0,sensit:0,sent:0,separ:0,server:0,servernameon:0,session:0,set:0,set_host:0,setuptool:0,sha256:0,sha384:0,share:0,sharepoint:0,should:0,shouldn:[],show:0,shv:0,side:0,sign:0,signatur:0,silent:0,similar:0,simpl:0,simpli:[],simplifi:0,singl:0,sister:0,site:0,situat:[],size:0,skip:0,skip_certificate_verif:0,slightli:0,small:0,smg:0,smtp:0,smtperror:0,socket:0,solut:0,some:0,someon:0,sometim:0,sort:0,source_base_domain:0,source_countri:0,source_ip_address:0,source_reverse_dn:0,sourceforg:0,specif:0,specifi:0,speed:0,spf_align:0,spf_domain:0,spf_result:0,spf_scope:0,splunk_hec:0,splunkerror:0,splunkhec:0,spoof:0,squeaki:0,ssl:0,ssl_cert_path:0,ssl_certif:0,ssl_certificate_kei:0,ssl_cipher:0,ssl_context:0,ssl_prefer_server_ciph:0,ssl_protocol:0,ssl_session_cach:0,ssl_session_ticket:0,ssl_session_timeout:0,sslcontext:0,stabl:0,standard:0,start:0,starttl:0,statu:0,step:0,still:0,storag:0,store:0,str:0,strict:0,string:0,strip:0,strip_attachment_payload:0,strip_attachments_payload:[],strongli:0,structur:0,subdomain:0,subject:0,subsidiari:0,substitut:0,sudo:0,suffix:0,suggest:0,suit:[],suppli:0,sure:0,sw50zxjha3rpdmugv2v0dgjld2vyymvylcocymvyc2ljahq:0,symlink:0,syslog:0,system:0,systemctl:0,tab:0,tag:0,tar:0,target:0,tby:0,tee:0,tell:0,temporari:0,text:0,than:0,thank:0,thei:0,theirs:0,them:0,thi:0,those:[],three:0,through:0,time:0,timeout:0,timestamp:0,timestamp_to_datetim:0,timestamp_to_human:0,timezon:0,tld:0,tlsv1:0,to_domain:0,to_utc:0,token:0,tool:0,top:0,topic:0,tracker:0,tradit:[],transfer:0,transpar:0,transport:0,trust:0,tweak:0,two:0,type:0,ubuntu:0,uncom:0,uncondition:0,under:0,underneath:0,understand:0,une:[],uninstal:0,unit:0,unix:0,unsubscrib:[],unzip:0,updat:0,upersecur:0,upper:0,uri:0,url:0,usag:0,use:0,use_fresh_psl:0,use_ssl:0,used:0,useful:0,user:0,user_ag:0,useradd:0,usernam:0,uses:0,usesystemproxi:0,usr:0,utc:0,utf:0,valimail:0,valu:0,vendor:0,venv:0,veri:0,verif:0,verifi:0,version:0,vew:0,view:0,virtualenv:0,volum:0,vulner:0,w3c:0,wai:0,wait:0,want:0,wantedbi:0,warn:0,watch:0,watch_inbox:0,watcher:0,web:0,webdav:0,webmail:0,well:0,were:0,wettbewerb:0,wget:0,when:0,whenev:0,where:0,wherea:0,which:0,who:0,why:0,wide:0,wiki:0,window:0,without:0,work:0,workstat:0,worst:0,would:0,write:0,www:0,x509:0,xennn:0,xml:0,xml_schema:0,xms4g:0,xmx4g:0,yahoo:0,yet:0,you:0,your:0,yum:0,yyyi:0,zip:0},titles:["parsedmarc documentation - Open source DMARC report analyzer and visualizer"],titleterms:{DNS:[],EWS:0,Using:0,about:0,access:0,aggreg:0,align:0,analyz:0,api:0,bug:0,cli:0,configur:0,csv:0,dashboard:0,davmail:0,depend:0,dkim:0,dmarc:0,document:0,domain:0,elast:0,elasticsearch:0,featur:0,file:0,forens:0,guid:0,help:0,inbox:0,index:0,indic:0,instal:0,json:0,kibana:0,list:0,listserv:0,lookalik:0,mail:0,mailman:0,multipl:0,open:0,option:0,output:0,owa:0,parsedmarc:0,pattern:0,perform:[],pypy3:0,record:0,report:0,resourc:0,retent:0,run:0,sampl:0,sender:0,servic:0,sourc:0,spf:0,splunk:0,summari:0,support:0,systemd:0,tabl:0,test:0,upgrad:0,using:0,util:0,valid:0,visual:0,what:0,won:0,you:[]}}) \ No newline at end of file +Search.setIndex({docnames:["index"],envversion:{"sphinx.domains.c":1,"sphinx.domains.changeset":1,"sphinx.domains.cpp":1,"sphinx.domains.javascript":1,"sphinx.domains.math":2,"sphinx.domains.python":1,"sphinx.domains.rst":1,"sphinx.domains.std":1,"sphinx.ext.todo":1,"sphinx.ext.viewcode":1,sphinx:55},filenames:["index.rst"],objects:{"":{parsedmarc:[0,0,0,"-"]},"parsedmarc.elastic":{AlreadySaved:[0,1,1,""],ElasticsearchError:[0,1,1,""],create_indexes:[0,2,1,""],migrate_indexes:[0,2,1,""],save_aggregate_report_to_elasticsearch:[0,2,1,""],save_forensic_report_to_elasticsearch:[0,2,1,""],set_hosts:[0,2,1,""]},"parsedmarc.splunk":{HECClient:[0,3,1,""],SplunkError:[0,1,1,""]},"parsedmarc.splunk.HECClient":{save_aggregate_reports_to_splunk:[0,4,1,""],save_forensic_reports_to_splunk:[0,4,1,""]},"parsedmarc.utils":{EmailParserError:[0,1,1,""],convert_outlook_msg:[0,2,1,""],decode_base64:[0,2,1,""],get_base_domain:[0,2,1,""],get_filename_safe_string:[0,2,1,""],get_ip_address_country:[0,2,1,""],get_ip_address_info:[0,2,1,""],get_reverse_dns:[0,2,1,""],human_timestamp_to_datetime:[0,2,1,""],human_timestamp_to_timestamp:[0,2,1,""],is_outlook_msg:[0,2,1,""],parse_email:[0,2,1,""],query_dns:[0,2,1,""],timestamp_to_datetime:[0,2,1,""],timestamp_to_human:[0,2,1,""]},parsedmarc:{IMAPError:[0,1,1,""],InvalidAggregateReport:[0,1,1,""],InvalidDMARCReport:[0,1,1,""],InvalidForensicReport:[0,1,1,""],ParserError:[0,1,1,""],SMTPError:[0,1,1,""],elastic:[0,0,0,"-"],email_results:[0,2,1,""],extract_xml:[0,2,1,""],get_dmarc_reports_from_inbox:[0,2,1,""],get_imap_capabilities:[0,2,1,""],get_report_zip:[0,2,1,""],parse_aggregate_report_file:[0,2,1,""],parse_aggregate_report_xml:[0,2,1,""],parse_forensic_report:[0,2,1,""],parse_report_email:[0,2,1,""],parse_report_file:[0,2,1,""],parsed_aggregate_reports_to_csv:[0,2,1,""],parsed_forensic_reports_to_csv:[0,2,1,""],save_output:[0,2,1,""],splunk:[0,0,0,"-"],utils:[0,0,0,"-"],watch_inbox:[0,2,1,""]}},objnames:{"0":["py","module","Python module"],"1":["py","exception","Python exception"],"2":["py","function","Python function"],"3":["py","class","Python class"],"4":["py","method","Python method"]},objtypes:{"0":"py:module","1":"py:exception","2":"py:function","3":"py:class","4":"py:method"},terms:{"2017a":0,"50m":0,"\u00fcbersicht":0,"break":0,"byte":0,"case":0,"class":0,"default":0,"float":0,"function":0,"import":0,"int":0,"long":0,"new":0,"null":0,"public":0,"return":0,"switch":0,"true":0,"var":0,"while":0,And:0,DNS:0,For:0,OLE:0,One:[],TLS:0,That:0,The:0,Then:0,These:0,Use:0,Uses:0,With:0,Yes:0,_input:0,abl:0,about:[],abov:0,accept:0,access_token:0,accident:0,account:0,acm:0,across:0,action:0,actual:0,add:0,add_head:0,added:0,adding:0,addit:0,address:0,addresse:0,adkim:0,admin:0,administr:0,adsl:0,aes128:0,aes256:0,after:0,against:0,agari:0,age:0,aggregate_index:0,aggregate_report:0,aggregate_top:0,all:0,allow:0,allowremot:0,along:[],alreadysav:0,also:0,alter:0,altern:0,although:0,alwai:0,ani:0,anonym:0,anoth:0,answer:0,apach:0,apache2:0,appear:0,append:[],appendix:0,appli:0,approach:0,approxim:0,apt:0,archiv:0,archive_fold:0,argument:0,arriv:0,arrival_d:0,arrival_date_utc:0,artifact:0,ask:0,asmx:0,aspf:0,assign:0,associ:0,attach:0,attachment_filenam:0,auth:0,auth_bas:0,auth_basic_user_fil:0,auth_failur:0,auth_result:0,authent:0,authentication_mechan:0,authentication_result:0,author:[],auto:0,autodetect:0,avail:0,avoid:0,b2c:0,backward:[],base64:0,base:0,base_domain:0,basic:0,bcc:0,bd6e1bb5:0,becaus:0,been:0,befor:[],begin_d:0,behind:0,being:0,bellsouth:0,below:0,best:[],between:0,bin:0,binari:0,bind:0,bindaddress:0,bitbucket:0,blank:0,block:0,bodi:0,bool:0,brand:0,busi:0,bz2:0,cach:0,call:0,callback:0,can:0,capabl:0,caus:0,center:0,cento:0,cert:0,cert_path:0,certif:0,cest:0,chacha20:0,chain:0,chang:0,charact:0,charset:0,chart:0,check:0,checkbox:0,checkdmarc:0,chines:0,chmod:0,choos:0,chown:0,chunk_siz:0,cisco:0,click:0,client:0,clientsotimeout:0,cloudflar:0,code:0,collect:0,collector:0,com:0,come:0,comma:0,command:0,comment:0,commerci:0,common:0,commun:0,comon:[],compat:[],complet:0,compli:0,compliant:0,compress:0,config:0,config_fil:0,configur:[],conform:0,connect:0,consid:0,consist:0,consolid:0,consum:0,contact:0,contain:0,content:0,context:0,control:0,convert:0,convert_outlook_msg:0,copi:0,core:0,correctli:0,could:0,count:0,countri:0,crash:0,creat:0,create_index:0,credenti:0,crt:0,csr:0,cumul:0,current:0,custom:0,daemon:0,dai:0,daili:0,dat:0,data:0,databas:0,date:0,date_utc:0,datetim:0,davmail:[],deb:0,debian:0,debug:0,decod:0,decode_base64:0,defens:0,delai:0,delet:0,delivery_result:0,demystifi:0,deploi:0,describ:0,descript:0,detail:0,develop:0,dict:0,dictionari:0,differ:0,digest:0,directli:0,directori:0,dis:0,disabl:0,disclaim:0,displai:0,display_nam:0,disposit:0,dkim_align:0,dkim_domain:0,dkim_result:0,dkim_selector:0,dkm:0,dmarc_aggreg:0,dmarc_forens:0,dmarc_moderation_act:0,dmarc_none_moderation_act:0,dmarc_quarentine_moderation_act:0,dmarcian:0,dmarcresport:0,dns_timeout:0,doctyp:0,doe:0,domainawar:0,don:0,done:[],down:0,download:0,draft:0,dtd:0,dure:0,each:0,earlier:0,easi:0,easier:0,easy_instal:0,ecdh:0,ecdsa:0,echo:0,edit:0,editor:0,effici:0,elasticsearch_host:[],elasticsearch_index_suffix:[],elasticsearch_ssl_cert_path:[],elasticsearcherror:0,els:0,email:0,email_result:0,emailparsererror:0,empti:0,enabl:0,enableew:0,enablekeepal:0,enableproxi:0,encod:0,encount:0,encrypt:0,end:0,end_dat:0,enforc:0,ensur:0,entir:0,envelop:0,envelope_from:0,envelope_to:0,environ:0,error:0,especi:0,etc:0,even:0,event:0,everi:0,exactli:0,exampl:0,exampleus:0,except:0,exchang:0,exclud:0,execstart:0,exist:0,exit:0,expiringdict:0,explain:0,explicit:0,extract:0,extract_xml:0,eyes:0,factor:0,fail:0,failur:0,fals:0,fantast:0,faster:0,feedback:0,feedback_report:0,feedback_typ:0,fetch:0,few:0,field:0,file:[],file_path:0,filenam:0,filename_safe_subject:0,fill:0,filter:0,financ:0,find:0,fine:0,first:0,first_strip_reply_to:0,fit:0,fix:0,flag:0,flat:0,flexibl:0,folder:0,foldersizelimit:0,follow:0,foobar:[],footer:0,fore:0,forensic_index:0,forensic_report:0,forensic_top:0,format:0,forward:0,found:0,foundat:0,fqdn:0,frame:0,fraud:0,free:0,fresh:0,friendli:0,from:0,from_is_list:0,ftp_proxi:0,full:0,fulli:0,further:0,gatewai:0,gcm:0,gdpr:0,gener:0,geoip:0,geoipupd:0,geolite2:0,get:0,get_base_domain:0,get_dmarc_reports_from_inbox:0,get_filename_safe_str:0,get_imap_cap:0,get_ip_address_countri:0,get_ip_address_info:0,get_report_zip:0,get_reverse_dn:0,git:0,github:0,give:0,given:0,glass:0,global:0,gmail:0,goe:0,googl:0,gpg:0,graph:0,group:0,gzip:0,hand:0,handl:0,has:0,has_defect:0,have:0,head:0,header:0,header_from:0,headless:0,healthcar:0,heap:0,heavi:0,hec:0,hec_index:[],hec_token:[],hecclient:0,hectokengoesher:0,here:0,high:0,higher:0,highli:0,his:0,hop:0,host:0,hostnam:0,hour:[],hover:0,href:0,html:0,htpasswd:0,http2:0,http:0,http_proxi:0,httpasswd:0,httpd:0,https_proxi:0,human:0,human_timestamp:0,human_timestamp_to_datetim:0,human_timestamp_to_timestamp:0,icon:0,ideal:0,ident:0,identifi:0,idl:0,imap:0,imap_port:[],imapalwaysapproxmsgs:0,imapautoexpung:0,imapcli:0,imaperror:0,imapidledelai:0,imapport:0,immedi:0,impli:0,improv:0,includ:0,include_list_post_head:0,include_rfc2369_head:0,include_sender_head:0,includesubdomain:0,incom:0,increas:0,index_suffix:0,industri:0,inform:0,ini:0,input:0,input_:0,insid:0,instanc:0,instead:0,intend:0,interact:0,interakt:0,interfer:0,invalid:0,invalidaggregatereport:0,invaliddmarcreport:0,invalidforensicreport:0,ip_address:0,ipv4:0,ipv6:0,is_outlook_msg:0,iso:0,issu:0,its:0,java:0,job:0,joe:0,join:[],journalctl:0,jre:0,just:0,jvm:0,jxf:0,kafka:0,kafka_aggregate_top:[],kafka_forensic_top:[],kafka_host:[],kafka_password:[],kafka_usernam:[],kb4099855:0,kb4134118:0,kb4295699:0,keepal:0,kei:0,keyout:0,kibana_saved_object:0,kind:0,know:0,known:0,languag:0,larg:0,larger:0,later:0,latest:0,layout:0,leak:0,least:0,leav:0,left:0,legal:0,legitim:0,level:0,libemail:0,like:0,limit:0,line:0,link:0,linux:0,linux_x86_64:0,list:[],listen:0,load:0,local:0,localhost:0,locat:0,log:0,log_fil:0,login:0,longer:0,look:0,loopback:0,lot:0,lua:0,maco:0,magnifi:0,mai:0,mail:[],mail_from:0,mail_to:0,mailbox:0,mailer:0,mailrelai:0,mailto:0,main:0,maintain:[],make:0,malici:0,manag:0,manual:0,map:0,market:0,match:0,max:0,maximum:0,maxmind:0,mechan:0,member:0,mention:0,menu:0,messag:0,message_id:0,meta:0,mfrom:0,microsoft:0,might:0,migrate_index:0,mime:0,minimum:0,minut:0,mitag:[],mitig:0,mkdir:0,mmdb:0,mobil:0,mode:0,modern:0,modifi:0,modul:0,mon:0,monitor:0,monthli:0,monthly_index:0,more:0,most:0,mous:0,move:0,move_support:0,msg:0,msg_byte:0,msg_date:0,msg_footer:0,msg_header:0,msgconvert:0,much:0,multi:0,mung:0,must:0,n_proc:0,name:0,nameserv:0,nano:0,navig:0,ncontent:0,ndate:0,need:0,neeed:0,nelson:0,net:0,network:0,newest:0,newkei:0,next:0,nfrom:0,nginx:0,nmessag:0,nmime:0,node:0,non:0,none:0,noproxyfor:0,norepli:0,normal:0,nosecureimap:0,nosniff:0,notabl:0,now:0,nsubject:0,nto:0,number:0,nwettbewerb:0,object:0,observ:0,occur:0,occurr:0,oct:0,off:0,office365:0,often:0,old:0,older:0,oldest:0,ondmarc:0,one:0,onli:0,onlin:0,opendn:0,openssl:0,opt:0,ordereddict:0,org:0,org_email:0,org_extra_contact_info:0,org_nam:0,organ:0,organis:0,origin:0,original_envelope_id:0,original_mail_from:0,original_rcpt_to:0,other:0,our:0,out:0,outdat:0,outgo:0,outgoing_attach:[],outgoing_from:[],outgoing_host:[],outgoing_messag:[],outgoing_password:[],outgoing_port:[],outgoing_ssl:[],outgoing_subject:[],outgoing_to:[],outgoing_us:[],outlook:0,output_directori:0,outsid:0,over:0,overrid:0,overwrit:0,own:0,pack:0,packag:0,pad:0,page:0,pan:0,parallel:0,param:0,paramet:0,parent:0,pars:0,parse_aggregate_report_fil:0,parse_aggregate_report_xml:0,parse_email:0,parse_forensic_report:0,parse_report_email:0,parse_report_fil:0,parsed_aggregate_reports_to_csv:0,parsed_forensic_reports_to_csv:0,parsed_sampl:0,parser:0,parsererror:0,part:0,particular:0,particularli:0,pass:0,passag:0,passsword:0,password:0,past:0,patch:0,path:0,payload:0,pct:0,percentag:0,perform:0,period:0,perl:0,permiss:0,peter:0,pie:0,pip3:0,pip:0,place:0,plain:0,plaintext:0,platform:0,pleas:0,plu:0,polici:0,policy_evalu:0,policy_override_com:0,policy_override_reason:0,policy_publish:0,poll:0,poly1305:0,port:0,portabl:0,posit:0,possibl:0,post:0,poster:0,postoriu:0,prefix:0,preload:0,premad:0,previou:0,previous:0,print:0,printabl:0,privaci:0,process:0,produc:0,product:0,program:0,project:0,prom:[],prompt:0,proofpoint:0,properti:0,protect:0,provid:0,prox:0,proxi:0,proxy_add_x_forwarded_for:0,proxy_pass:0,proxy_set_head:0,proxyhost:0,proxypassword:0,proxyport:0,proxyus:0,pry:0,public_suffix_list:0,publicsuffix:0,publish:0,pypi:0,python34:0,python3:0,python:0,quarantin:0,queri:0,query_dn:0,quot:0,rais:0,ram:0,rather:0,readabl:0,readonlyrest:0,real:0,realli:0,reason:0,receiv:0,recipi:0,recogn:0,recommend:0,record_typ:0,refer:0,regardless:0,regul:0,regular:0,regulatori:[],reject:0,relai:0,relat:0,releas:0,reli:0,reliabl:0,reload:0,remain:0,remot:0,remote_addr:0,remov:0,repeat:0,replac:0,repli:0,reply_goes_to_list:0,reply_to:0,replyo:0,report_id:0,report_metadata:0,report_typ:0,reported_domain:0,reports_fold:0,repositori:0,req:0,request:0,request_uri:0,requir:0,resolv:0,respons:0,restart:0,restartsec:0,restor:0,result:0,retain:0,retriev:0,reus:0,revers:0,reverse_dn:0,review:0,rewrit:0,rfc2369:0,rfc822:0,rfc:0,rhel:0,right:0,rollup:0,root:0,rpm:0,rsa:0,rua:0,ruf:0,rule:0,safe:0,same:0,sameorigin:0,sample_headers_onli:0,save:0,save_aggreg:0,save_aggregate_report_to_elasticsearch:0,save_aggregate_reports_to_splunk:0,save_forens:0,save_forensic_report_to_elasticsearch:0,save_forensic_reports_to_splunk:0,save_output:0,schema:0,scope:0,scrub_nondigest:0,search:0,second:0,secret:0,secur:0,see:0,segment:0,selector:0,self:0,send:0,sensit:0,sent:0,separ:0,server:0,servernameon:0,session:0,set:0,set_host:0,setuptool:0,sha256:0,sha384:0,share:0,sharepoint:0,should:0,shouldn:0,show:0,shv:0,side:0,sign:0,signatur:0,silent:0,similar:0,simpl:0,simpli:[],simplifi:0,singl:0,sister:0,site:0,situat:[],size:0,skip:0,skip_certificate_verif:0,slightli:0,small:0,smg:0,smtp:0,smtperror:0,socket:0,solut:0,some:0,someon:0,sometim:0,sort:0,source_base_domain:0,source_countri:0,source_ip_address:0,source_reverse_dn:0,sourceforg:0,special:0,specif:0,specifi:0,speed:0,spf_align:0,spf_domain:0,spf_result:0,spf_scope:0,splunk_hec:0,splunkerror:0,splunkhec:0,spoof:0,squeaki:0,ssl:0,ssl_cert_path:0,ssl_certif:0,ssl_certificate_kei:0,ssl_cipher:0,ssl_context:0,ssl_prefer_server_ciph:0,ssl_protocol:0,ssl_session_cach:0,ssl_session_ticket:0,ssl_session_timeout:0,sslcontext:0,stabl:0,standard:0,start:0,starttl:0,statu:0,step:0,still:0,storag:0,store:0,str:0,strict:0,string:0,strip:0,strip_attachment_payload:0,strip_attachments_payload:[],strongli:0,structur:0,subdomain:0,subject:0,subject_prefix:0,subsidiari:0,substitut:0,sudo:0,suffix:0,suggest:0,suit:[],suppli:0,sure:0,sw50zxjha3rpdmugv2v0dgjld2vyymvylcocymvyc2ljahq:0,symlink:0,syslog:0,system:0,systemctl:0,tab:0,tag:0,tar:0,target:0,tby:0,tee:0,tell:0,templat:0,temporari:0,text:0,than:0,thank:0,thei:0,theirs:0,them:0,therebi:0,thi:0,those:[],thousand:0,three:0,through:0,time:0,timeout:0,timestamp:0,timestamp_to_datetim:0,timestamp_to_human:0,timezon:0,tld:0,tlsv1:0,to_domain:0,to_utc:0,token:0,tool:0,top:0,topic:0,touch:0,tracker:0,tradit:0,transfer:0,transpar:0,transport:0,trust:0,tweak:0,two:0,type:0,ubuntu:0,uncom:0,uncondition:0,under:0,underneath:0,understand:0,une:[],unfortun:0,uninstal:0,unit:0,unix:0,unsubscrib:0,unzip:0,updat:0,upersecur:0,upper:0,uri:0,url:0,usag:0,use:0,use_fresh_psl:0,use_ssl:0,used:0,useful:0,user:0,user_ag:0,useradd:0,usernam:0,uses:0,usesystemproxi:0,usr:0,utc:0,utf:0,valimail:0,valu:0,vendor:0,venv:0,veri:0,verif:0,verifi:0,version:0,vew:0,view:0,virtualenv:0,volum:0,vulner:0,w3c:0,wai:0,wait:0,want:0,wantedbi:0,warn:0,watch:0,watch_inbox:0,watcher:0,web:0,webdav:0,webmail:0,well:0,were:0,wettbewerb:0,wget:0,when:0,whenev:0,where:0,wherea:0,which:0,who:0,why:0,wide:0,wiki:0,window:0,without:0,work:0,workstat:0,worst:0,would:0,wrap:0,write:0,www:0,x509:0,xennn:0,xml:0,xml_schema:0,xms4g:0,xmx4g:0,yahoo:0,yet:0,you:0,your:0,yum:0,yyyi:0,zip:0},titles:["parsedmarc documentation - Open source DMARC report analyzer and visualizer"],titleterms:{DNS:[],EWS:0,Using:0,about:0,access:0,aggreg:0,align:0,analyz:0,api:0,best:0,bug:0,cli:0,configur:0,csv:0,dashboard:0,davmail:0,depend:0,dkim:0,dmarc:0,document:0,domain:0,elast:0,elasticsearch:0,featur:0,file:0,forens:0,guid:0,help:0,inbox:0,index:0,indic:0,instal:0,json:0,kibana:0,list:0,listserv:0,lookalik:0,mail:0,mailman:0,multipl:0,open:0,option:0,output:0,owa:0,parsedmarc:0,pattern:0,perform:[],practic:0,pypy3:0,record:0,report:0,resourc:0,retent:0,run:0,sampl:0,sender:0,servic:0,sourc:0,spf:0,splunk:0,summari:0,support:0,systemd:0,tabl:0,test:0,upgrad:0,using:0,util:0,valid:0,visual:0,what:0,won:0,workaround:0,you:[]}}) \ No newline at end of file