diff --git a/_modules/index.html b/_modules/index.html
index 5dfccf1..2cce504 100644
--- a/_modules/index.html
+++ b/_modules/index.html
@@ -3,7 +3,7 @@
 <head>
   <meta charset="utf-8" />
   <meta name="viewport" content="width=device-width, initial-scale=1.0" />
-  <title>Overview: module code &mdash; parsedmarc 8.3.0 documentation</title>
+  <title>Overview: module code &mdash; parsedmarc 8.3.1 documentation</title>
       <link rel="stylesheet" href="../_static/pygments.css" type="text/css" />
       <link rel="stylesheet" href="../_static/css/theme.css" type="text/css" />
   <!--[if lt IE 9]>
@@ -28,7 +28,7 @@
             <a href="../index.html" class="icon icon-home"> parsedmarc
           </a>
               <div class="version">
-                8.3.0
+                8.3.1
               </div>
 <div role="search">
   <form id="rtd-search-form" class="wy-form" action="../search.html" method="get">
diff --git a/_modules/parsedmarc.html b/_modules/parsedmarc.html
index 67a6980..9a0e777 100644
--- a/_modules/parsedmarc.html
+++ b/_modules/parsedmarc.html
@@ -3,7 +3,7 @@
 <head>
   <meta charset="utf-8" />
   <meta name="viewport" content="width=device-width, initial-scale=1.0" />
-  <title>parsedmarc &mdash; parsedmarc 8.3.0 documentation</title>
+  <title>parsedmarc &mdash; parsedmarc 8.3.1 documentation</title>
       <link rel="stylesheet" href="../_static/pygments.css" type="text/css" />
       <link rel="stylesheet" href="../_static/css/theme.css" type="text/css" />
   <!--[if lt IE 9]>
@@ -28,7 +28,7 @@
             <a href="../index.html" class="icon icon-home"> parsedmarc
           </a>
               <div class="version">
-                8.3.0
+                8.3.1
               </div>
 <div role="search">
   <form id="rtd-search-form" class="wy-form" action="../search.html" method="get">
@@ -73,7 +73,6 @@
 <span class="kn">import</span> <span class="nn">email</span>
 <span class="kn">import</span> <span class="nn">email.utils</span>
 <span class="kn">import</span> <span class="nn">json</span>
-<span class="kn">import</span> <span class="nn">logging</span>
 <span class="kn">import</span> <span class="nn">mailbox</span>
 <span class="kn">import</span> <span class="nn">os</span>
 <span class="kn">import</span> <span class="nn">re</span>
@@ -95,22 +94,15 @@
 <span class="kn">from</span> <span class="nn">lxml</span> <span class="kn">import</span> <span class="n">etree</span>
 <span class="kn">from</span> <span class="nn">mailsuite.smtp</span> <span class="kn">import</span> <span class="n">send_email</span>
 
+<span class="kn">from</span> <span class="nn">parsedmarc.log</span> <span class="kn">import</span> <span class="n">logger</span>
 <span class="kn">from</span> <span class="nn">parsedmarc.mail</span> <span class="kn">import</span> <span class="n">MailboxConnection</span>
 <span class="kn">from</span> <span class="nn">parsedmarc.utils</span> <span class="kn">import</span> <span class="n">get_base_domain</span><span class="p">,</span> <span class="n">get_ip_address_info</span>
 <span class="kn">from</span> <span class="nn">parsedmarc.utils</span> <span class="kn">import</span> <span class="n">is_outlook_msg</span><span class="p">,</span> <span class="n">convert_outlook_msg</span>
 <span class="kn">from</span> <span class="nn">parsedmarc.utils</span> <span class="kn">import</span> <span class="n">parse_email</span>
 <span class="kn">from</span> <span class="nn">parsedmarc.utils</span> <span class="kn">import</span> <span class="n">timestamp_to_human</span><span class="p">,</span> <span class="n">human_timestamp_to_datetime</span>
 
-<span class="n">__version__</span> <span class="o">=</span> <span class="s2">&quot;8.3.0&quot;</span>
+<span class="n">__version__</span> <span class="o">=</span> <span class="s2">&quot;8.3.1&quot;</span>
 
-<span class="n">formatter</span> <span class="o">=</span> <span class="n">logging</span><span class="o">.</span><span class="n">Formatter</span><span class="p">(</span>
-    <span class="n">fmt</span><span class="o">=</span><span class="s1">&#39;</span><span class="si">%(levelname)8s</span><span class="s1">:</span><span class="si">%(filename)s</span><span class="s1">:</span><span class="si">%(lineno)d</span><span class="s1">:</span><span class="si">%(message)s</span><span class="s1">&#39;</span><span class="p">,</span>
-    <span class="n">datefmt</span><span class="o">=</span><span class="s1">&#39;%Y-%m-</span><span class="si">%d</span><span class="s1">:%H:%M:%S&#39;</span><span class="p">)</span>
-<span class="n">handler</span> <span class="o">=</span> <span class="n">logging</span><span class="o">.</span><span class="n">StreamHandler</span><span class="p">()</span>
-<span class="n">handler</span><span class="o">.</span><span class="n">setFormatter</span><span class="p">(</span><span class="n">formatter</span><span class="p">)</span>
-
-<span class="n">logger</span> <span class="o">=</span> <span class="n">logging</span><span class="o">.</span><span class="n">getLogger</span><span class="p">(</span><span class="s2">&quot;parsedmarc&quot;</span><span class="p">)</span>
-<span class="n">logger</span><span class="o">.</span><span class="n">addHandler</span><span class="p">(</span><span class="n">handler</span><span class="p">)</span>
 <span class="n">logger</span><span class="o">.</span><span class="n">debug</span><span class="p">(</span><span class="s2">&quot;parsedmarc v</span><span class="si">{0}</span><span class="s2">&quot;</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">__version__</span><span class="p">))</span>
 
 <span class="n">feedback_report_regex</span> <span class="o">=</span> <span class="n">re</span><span class="o">.</span><span class="n">compile</span><span class="p">(</span><span class="sa">r</span><span class="s2">&quot;^([\w\-]+): (.+)$&quot;</span><span class="p">,</span> <span class="n">re</span><span class="o">.</span><span class="n">MULTILINE</span><span class="p">)</span>
@@ -297,11 +289,14 @@
         <span class="n">xmltodict</span><span class="o">.</span><span class="n">parse</span><span class="p">(</span><span class="n">xml</span><span class="p">)[</span><span class="s2">&quot;feedback&quot;</span><span class="p">]</span>
     <span class="k">except</span> <span class="ne">Exception</span> <span class="k">as</span> <span class="n">e</span><span class="p">:</span>
         <span class="n">errors</span><span class="o">.</span><span class="n">append</span><span class="p">(</span><span class="s2">&quot;Invalid XML: </span><span class="si">{0}</span><span class="s2">&quot;</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">e</span><span class="o">.</span><span class="fm">__str__</span><span class="p">()))</span>
-        <span class="n">tree</span> <span class="o">=</span> <span class="n">etree</span><span class="o">.</span><span class="n">parse</span><span class="p">(</span>
-            <span class="n">BytesIO</span><span class="p">(</span><span class="n">xml</span><span class="o">.</span><span class="n">encode</span><span class="p">(</span><span class="s1">&#39;utf-8&#39;</span><span class="p">)),</span>
-            <span class="n">etree</span><span class="o">.</span><span class="n">XMLParser</span><span class="p">(</span><span class="n">recover</span><span class="o">=</span><span class="kc">True</span><span class="p">,</span> <span class="n">resolve_entities</span><span class="o">=</span><span class="kc">False</span><span class="p">))</span>
-        <span class="n">s</span> <span class="o">=</span> <span class="n">etree</span><span class="o">.</span><span class="n">tostring</span><span class="p">(</span><span class="n">tree</span><span class="p">)</span>
-        <span class="n">xml</span> <span class="o">=</span> <span class="s1">&#39;&#39;</span> <span class="k">if</span> <span class="n">s</span> <span class="ow">is</span> <span class="kc">None</span> <span class="k">else</span> <span class="n">s</span><span class="o">.</span><span class="n">decode</span><span class="p">(</span><span class="s1">&#39;utf-8&#39;</span><span class="p">)</span>
+        <span class="k">try</span><span class="p">:</span>
+            <span class="n">tree</span> <span class="o">=</span> <span class="n">etree</span><span class="o">.</span><span class="n">parse</span><span class="p">(</span>
+                <span class="n">BytesIO</span><span class="p">(</span><span class="n">xml</span><span class="o">.</span><span class="n">encode</span><span class="p">(</span><span class="s1">&#39;utf-8&#39;</span><span class="p">)),</span>
+                <span class="n">etree</span><span class="o">.</span><span class="n">XMLParser</span><span class="p">(</span><span class="n">recover</span><span class="o">=</span><span class="kc">True</span><span class="p">,</span> <span class="n">resolve_entities</span><span class="o">=</span><span class="kc">False</span><span class="p">))</span>
+            <span class="n">s</span> <span class="o">=</span> <span class="n">etree</span><span class="o">.</span><span class="n">tostring</span><span class="p">(</span><span class="n">tree</span><span class="p">)</span>
+            <span class="n">xml</span> <span class="o">=</span> <span class="s1">&#39;&#39;</span> <span class="k">if</span> <span class="n">s</span> <span class="ow">is</span> <span class="kc">None</span> <span class="k">else</span> <span class="n">s</span><span class="o">.</span><span class="n">decode</span><span class="p">(</span><span class="s1">&#39;utf-8&#39;</span><span class="p">)</span>
+        <span class="k">except</span> <span class="ne">Exception</span><span class="p">:</span>
+            <span class="n">xml</span> <span class="o">=</span> <span class="sa">u</span><span class="s1">&#39;&lt;a/&gt;&#39;</span>
 
     <span class="k">try</span><span class="p">:</span>
         <span class="c1"># Replace XML header (sometimes they are invalid)</span>
@@ -473,7 +468,7 @@
                                 <span class="n">dns_timeout</span><span class="o">=</span><span class="mf">2.0</span><span class="p">,</span>
                                 <span class="n">parallel</span><span class="o">=</span><span class="kc">False</span><span class="p">,</span>
                                 <span class="n">keep_alive</span><span class="o">=</span><span class="kc">None</span><span class="p">):</span>
-    <span class="sd">&quot;&quot;&quot;Parses a file at the given path, a file-like object. or bytes as a</span>
+    <span class="sd">&quot;&quot;&quot;Parses a file at the given path, a file-like object. or bytes as an</span>
 <span class="sd">    aggregate DMARC report</span>
 
 <span class="sd">    Args:</span>
@@ -557,11 +552,11 @@
             <span class="n">row</span><span class="p">[</span><span class="s2">&quot;dmarc_aligned&quot;</span><span class="p">]</span> <span class="o">=</span> <span class="n">record</span><span class="p">[</span><span class="s2">&quot;alignment&quot;</span><span class="p">][</span><span class="s2">&quot;dmarc&quot;</span><span class="p">]</span>
             <span class="n">row</span><span class="p">[</span><span class="s2">&quot;disposition&quot;</span><span class="p">]</span> <span class="o">=</span> <span class="n">record</span><span class="p">[</span><span class="s2">&quot;policy_evaluated&quot;</span><span class="p">][</span><span class="s2">&quot;disposition&quot;</span><span class="p">]</span>
             <span class="n">policy_override_reasons</span> <span class="o">=</span> <span class="nb">list</span><span class="p">(</span><span class="nb">map</span><span class="p">(</span>
-                <span class="k">lambda</span> <span class="n">r</span><span class="p">:</span> <span class="n">r</span><span class="p">[</span><span class="s2">&quot;type&quot;</span><span class="p">],</span>
+                <span class="k">lambda</span> <span class="n">r_</span><span class="p">:</span> <span class="n">r_</span><span class="p">[</span><span class="s2">&quot;type&quot;</span><span class="p">],</span>
                 <span class="n">record</span><span class="p">[</span><span class="s2">&quot;policy_evaluated&quot;</span><span class="p">]</span>
                 <span class="p">[</span><span class="s2">&quot;policy_override_reasons&quot;</span><span class="p">]))</span>
             <span class="n">policy_override_comments</span> <span class="o">=</span> <span class="nb">list</span><span class="p">(</span><span class="nb">map</span><span class="p">(</span>
-                <span class="k">lambda</span> <span class="n">r</span><span class="p">:</span> <span class="n">r</span><span class="p">[</span><span class="s2">&quot;comment&quot;</span><span class="p">]</span> <span class="ow">or</span> <span class="s2">&quot;none&quot;</span><span class="p">,</span>
+                <span class="k">lambda</span> <span class="n">r_</span><span class="p">:</span> <span class="n">r_</span><span class="p">[</span><span class="s2">&quot;comment&quot;</span><span class="p">]</span> <span class="ow">or</span> <span class="s2">&quot;none&quot;</span><span class="p">,</span>
                 <span class="n">record</span><span class="p">[</span><span class="s2">&quot;policy_evaluated&quot;</span><span class="p">]</span>
                 <span class="p">[</span><span class="s2">&quot;policy_override_reasons&quot;</span><span class="p">]))</span>
             <span class="n">row</span><span class="p">[</span><span class="s2">&quot;policy_override_reasons&quot;</span><span class="p">]</span> <span class="o">=</span> <span class="s2">&quot;,&quot;</span><span class="o">.</span><span class="n">join</span><span class="p">(</span>
@@ -1154,7 +1149,7 @@
         <span class="n">connection</span><span class="o">.</span><span class="n">create_folder</span><span class="p">(</span><span class="n">forensic_reports_folder</span><span class="p">)</span>
         <span class="n">connection</span><span class="o">.</span><span class="n">create_folder</span><span class="p">(</span><span class="n">invalid_reports_folder</span><span class="p">)</span>
 
-    <span class="n">messages</span> <span class="o">=</span> <span class="n">connection</span><span class="o">.</span><span class="n">fetch_messages</span><span class="p">(</span><span class="n">reports_folder</span><span class="p">)</span>
+    <span class="n">messages</span> <span class="o">=</span> <span class="n">connection</span><span class="o">.</span><span class="n">fetch_messages</span><span class="p">(</span><span class="n">reports_folder</span><span class="p">,</span> <span class="n">batch_size</span><span class="o">=</span><span class="n">batch_size</span><span class="p">)</span>
     <span class="n">total_messages</span> <span class="o">=</span> <span class="nb">len</span><span class="p">(</span><span class="n">messages</span><span class="p">)</span>
     <span class="n">logger</span><span class="o">.</span><span class="n">debug</span><span class="p">(</span><span class="s2">&quot;Found </span><span class="si">{0}</span><span class="s2"> messages in </span><span class="si">{1}</span><span class="s2">&quot;</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="nb">len</span><span class="p">(</span><span class="n">messages</span><span class="p">),</span>
                                                     <span class="n">reports_folder</span><span class="p">))</span>
@@ -1333,6 +1328,41 @@
                              <span class="n">check_timeout</span><span class="o">=</span><span class="n">check_timeout</span><span class="p">)</span></div>
 
 
+<span class="k">def</span> <span class="nf">append_json</span><span class="p">(</span><span class="n">filename</span><span class="p">,</span> <span class="n">reports</span><span class="p">):</span>
+    <span class="k">with</span> <span class="nb">open</span><span class="p">(</span><span class="n">filename</span><span class="p">,</span> <span class="s2">&quot;r+&quot;</span><span class="p">,</span> <span class="n">newline</span><span class="o">=</span><span class="s2">&quot;</span><span class="se">\n</span><span class="s2">&quot;</span><span class="p">,</span> <span class="n">encoding</span><span class="o">=</span><span class="s2">&quot;utf-8&quot;</span><span class="p">)</span> <span class="k">as</span> <span class="n">output</span><span class="p">:</span>
+        <span class="n">output_json</span> <span class="o">=</span> <span class="n">json</span><span class="o">.</span><span class="n">dumps</span><span class="p">(</span><span class="n">reports</span><span class="p">,</span> <span class="n">ensure_ascii</span><span class="o">=</span><span class="kc">False</span><span class="p">,</span> <span class="n">indent</span><span class="o">=</span><span class="mi">2</span><span class="p">)</span>
+        <span class="k">if</span> <span class="n">output</span><span class="o">.</span><span class="n">seek</span><span class="p">(</span><span class="mi">0</span><span class="p">,</span> <span class="n">os</span><span class="o">.</span><span class="n">SEEK_END</span><span class="p">)</span> <span class="o">!=</span> <span class="mi">0</span><span class="p">:</span>
+            <span class="k">if</span> <span class="nb">len</span><span class="p">(</span><span class="n">reports</span><span class="p">)</span> <span class="o">==</span> <span class="mi">0</span><span class="p">:</span>
+                <span class="c1"># not appending anything, don&#39;t do any dance to append it</span>
+                <span class="c1"># correctly</span>
+                <span class="k">return</span>
+            <span class="n">output</span><span class="o">.</span><span class="n">seek</span><span class="p">(</span><span class="n">output</span><span class="o">.</span><span class="n">tell</span><span class="p">()</span> <span class="o">-</span> <span class="mi">1</span><span class="p">)</span>
+            <span class="n">last_char</span> <span class="o">=</span> <span class="n">output</span><span class="o">.</span><span class="n">read</span><span class="p">(</span><span class="mi">1</span><span class="p">)</span>
+            <span class="k">if</span> <span class="n">last_char</span> <span class="o">==</span> <span class="s2">&quot;]&quot;</span><span class="p">:</span>
+                <span class="c1"># remove the trailing &quot;\n]&quot;, leading &quot;[\n&quot;, and replace with</span>
+                <span class="c1"># &quot;,\n&quot;</span>
+                <span class="n">output</span><span class="o">.</span><span class="n">seek</span><span class="p">(</span><span class="n">output</span><span class="o">.</span><span class="n">tell</span><span class="p">()</span> <span class="o">-</span> <span class="mi">2</span><span class="p">)</span>
+                <span class="n">output</span><span class="o">.</span><span class="n">write</span><span class="p">(</span><span class="s2">&quot;,</span><span class="se">\n</span><span class="s2">&quot;</span><span class="p">)</span>
+                <span class="n">output_json</span> <span class="o">=</span> <span class="n">output_json</span><span class="p">[</span><span class="mi">2</span><span class="p">:]</span>
+            <span class="k">else</span><span class="p">:</span>
+                <span class="n">output</span><span class="o">.</span><span class="n">seek</span><span class="p">(</span><span class="mi">0</span><span class="p">)</span>
+                <span class="n">output</span><span class="o">.</span><span class="n">truncate</span><span class="p">()</span>
+
+        <span class="n">output</span><span class="o">.</span><span class="n">write</span><span class="p">(</span><span class="n">output_json</span><span class="p">)</span>
+
+
+<span class="k">def</span> <span class="nf">append_csv</span><span class="p">(</span><span class="n">filename</span><span class="p">,</span> <span class="n">csv</span><span class="p">):</span>
+    <span class="k">with</span> <span class="nb">open</span><span class="p">(</span><span class="n">filename</span><span class="p">,</span> <span class="s2">&quot;r+&quot;</span><span class="p">,</span> <span class="n">newline</span><span class="o">=</span><span class="s2">&quot;</span><span class="se">\n</span><span class="s2">&quot;</span><span class="p">,</span> <span class="n">encoding</span><span class="o">=</span><span class="s2">&quot;utf-8&quot;</span><span class="p">)</span> <span class="k">as</span> <span class="n">output</span><span class="p">:</span>
+        <span class="k">if</span> <span class="n">output</span><span class="o">.</span><span class="n">seek</span><span class="p">(</span><span class="mi">0</span><span class="p">,</span> <span class="n">os</span><span class="o">.</span><span class="n">SEEK_END</span><span class="p">)</span> <span class="o">!=</span> <span class="mi">0</span><span class="p">:</span>
+            <span class="c1"># strip the headers from the CSV</span>
+            <span class="n">_headers</span><span class="p">,</span> <span class="n">csv</span> <span class="o">=</span> <span class="n">csv</span><span class="o">.</span><span class="n">split</span><span class="p">(</span><span class="s2">&quot;</span><span class="se">\n</span><span class="s2">&quot;</span><span class="p">,</span> <span class="mi">1</span><span class="p">)</span>
+            <span class="k">if</span> <span class="nb">len</span><span class="p">(</span><span class="n">csv</span><span class="p">)</span> <span class="o">==</span> <span class="mi">0</span><span class="p">:</span>
+                <span class="c1"># not appending anything, don&#39;t do any dance to</span>
+                <span class="c1"># append it correctly</span>
+                <span class="k">return</span>
+        <span class="n">output</span><span class="o">.</span><span class="n">write</span><span class="p">(</span><span class="n">csv</span><span class="p">)</span>
+
+
 <div class="viewcode-block" id="save_output"><a class="viewcode-back" href="../index.html#parsedmarc.save_output">[docs]</a><span class="k">def</span> <span class="nf">save_output</span><span class="p">(</span><span class="n">results</span><span class="p">,</span> <span class="n">output_directory</span><span class="o">=</span><span class="s2">&quot;output&quot;</span><span class="p">,</span>
                 <span class="n">aggregate_json_filename</span><span class="o">=</span><span class="s2">&quot;aggregate.json&quot;</span><span class="p">,</span>
                 <span class="n">forensic_json_filename</span><span class="o">=</span><span class="s2">&quot;forensic.json&quot;</span><span class="p">,</span>
@@ -1359,33 +1389,17 @@
     <span class="k">else</span><span class="p">:</span>
         <span class="n">os</span><span class="o">.</span><span class="n">makedirs</span><span class="p">(</span><span class="n">output_directory</span><span class="p">)</span>
 
-    <span class="k">with</span> <span class="nb">open</span><span class="p">(</span><span class="s2">&quot;</span><span class="si">{0}</span><span class="s2">&quot;</span>
-              <span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">os</span><span class="o">.</span><span class="n">path</span><span class="o">.</span><span class="n">join</span><span class="p">(</span><span class="n">output_directory</span><span class="p">,</span>
-                                   <span class="n">aggregate_json_filename</span><span class="p">)),</span>
-              <span class="s2">&quot;w&quot;</span><span class="p">,</span> <span class="n">newline</span><span class="o">=</span><span class="s2">&quot;</span><span class="se">\n</span><span class="s2">&quot;</span><span class="p">,</span> <span class="n">encoding</span><span class="o">=</span><span class="s2">&quot;utf-8&quot;</span><span class="p">)</span> <span class="k">as</span> <span class="n">agg_json</span><span class="p">:</span>
-        <span class="n">agg_json</span><span class="o">.</span><span class="n">write</span><span class="p">(</span><span class="n">json</span><span class="o">.</span><span class="n">dumps</span><span class="p">(</span><span class="n">aggregate_reports</span><span class="p">,</span> <span class="n">ensure_ascii</span><span class="o">=</span><span class="kc">False</span><span class="p">,</span>
-                                  <span class="n">indent</span><span class="o">=</span><span class="mi">2</span><span class="p">))</span>
+    <span class="n">append_json</span><span class="p">(</span><span class="n">os</span><span class="o">.</span><span class="n">path</span><span class="o">.</span><span class="n">join</span><span class="p">(</span><span class="n">output_directory</span><span class="p">,</span> <span class="n">aggregate_json_filename</span><span class="p">),</span>
+                <span class="n">aggregate_reports</span><span class="p">)</span>
 
-    <span class="k">with</span> <span class="nb">open</span><span class="p">(</span><span class="s2">&quot;</span><span class="si">{0}</span><span class="s2">&quot;</span>
-              <span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">os</span><span class="o">.</span><span class="n">path</span><span class="o">.</span><span class="n">join</span><span class="p">(</span><span class="n">output_directory</span><span class="p">,</span>
-                                   <span class="n">aggregate_csv_filename</span><span class="p">)),</span>
-              <span class="s2">&quot;w&quot;</span><span class="p">,</span> <span class="n">newline</span><span class="o">=</span><span class="s2">&quot;</span><span class="se">\n</span><span class="s2">&quot;</span><span class="p">,</span> <span class="n">encoding</span><span class="o">=</span><span class="s2">&quot;utf-8&quot;</span><span class="p">)</span> <span class="k">as</span> <span class="n">agg_csv</span><span class="p">:</span>
-        <span class="n">csv</span> <span class="o">=</span> <span class="n">parsed_aggregate_reports_to_csv</span><span class="p">(</span><span class="n">aggregate_reports</span><span class="p">)</span>
-        <span class="n">agg_csv</span><span class="o">.</span><span class="n">write</span><span class="p">(</span><span class="n">csv</span><span class="p">)</span>
+    <span class="n">append_csv</span><span class="p">(</span><span class="n">os</span><span class="o">.</span><span class="n">path</span><span class="o">.</span><span class="n">join</span><span class="p">(</span><span class="n">output_directory</span><span class="p">,</span> <span class="n">aggregate_csv_filename</span><span class="p">),</span>
+               <span class="n">parsed_aggregate_reports_to_csv</span><span class="p">(</span><span class="n">aggregate_reports</span><span class="p">))</span>
 
-    <span class="k">with</span> <span class="nb">open</span><span class="p">(</span><span class="s2">&quot;</span><span class="si">{0}</span><span class="s2">&quot;</span>
-              <span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">os</span><span class="o">.</span><span class="n">path</span><span class="o">.</span><span class="n">join</span><span class="p">(</span><span class="n">output_directory</span><span class="p">,</span>
-                                   <span class="n">forensic_json_filename</span><span class="p">)),</span>
-              <span class="s2">&quot;w&quot;</span><span class="p">,</span> <span class="n">newline</span><span class="o">=</span><span class="s2">&quot;</span><span class="se">\n</span><span class="s2">&quot;</span><span class="p">,</span> <span class="n">encoding</span><span class="o">=</span><span class="s2">&quot;utf-8&quot;</span><span class="p">)</span> <span class="k">as</span> <span class="n">for_json</span><span class="p">:</span>
-        <span class="n">for_json</span><span class="o">.</span><span class="n">write</span><span class="p">(</span><span class="n">json</span><span class="o">.</span><span class="n">dumps</span><span class="p">(</span><span class="n">forensic_reports</span><span class="p">,</span> <span class="n">ensure_ascii</span><span class="o">=</span><span class="kc">False</span><span class="p">,</span>
-                                  <span class="n">indent</span><span class="o">=</span><span class="mi">2</span><span class="p">))</span>
+    <span class="n">append_json</span><span class="p">(</span><span class="n">os</span><span class="o">.</span><span class="n">path</span><span class="o">.</span><span class="n">join</span><span class="p">(</span><span class="n">output_directory</span><span class="p">,</span> <span class="n">forensic_json_filename</span><span class="p">),</span>
+                <span class="n">forensic_reports</span><span class="p">)</span>
 
-    <span class="k">with</span> <span class="nb">open</span><span class="p">(</span><span class="s2">&quot;</span><span class="si">{0}</span><span class="s2">&quot;</span>
-              <span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">os</span><span class="o">.</span><span class="n">path</span><span class="o">.</span><span class="n">join</span><span class="p">(</span><span class="n">output_directory</span><span class="p">,</span>
-                                   <span class="n">forensic_csv_filename</span><span class="p">)),</span>
-              <span class="s2">&quot;w&quot;</span><span class="p">,</span> <span class="n">newline</span><span class="o">=</span><span class="s2">&quot;</span><span class="se">\n</span><span class="s2">&quot;</span><span class="p">,</span> <span class="n">encoding</span><span class="o">=</span><span class="s2">&quot;utf-8&quot;</span><span class="p">)</span> <span class="k">as</span> <span class="n">for_csv</span><span class="p">:</span>
-        <span class="n">csv</span> <span class="o">=</span> <span class="n">parsed_forensic_reports_to_csv</span><span class="p">(</span><span class="n">forensic_reports</span><span class="p">)</span>
-        <span class="n">for_csv</span><span class="o">.</span><span class="n">write</span><span class="p">(</span><span class="n">csv</span><span class="p">)</span>
+    <span class="n">append_csv</span><span class="p">(</span><span class="n">os</span><span class="o">.</span><span class="n">path</span><span class="o">.</span><span class="n">join</span><span class="p">(</span><span class="n">output_directory</span><span class="p">,</span> <span class="n">forensic_csv_filename</span><span class="p">),</span>
+               <span class="n">parsed_forensic_reports_to_csv</span><span class="p">(</span><span class="n">forensic_reports</span><span class="p">))</span>
 
     <span class="n">samples_directory</span> <span class="o">=</span> <span class="n">os</span><span class="o">.</span><span class="n">path</span><span class="o">.</span><span class="n">join</span><span class="p">(</span><span class="n">output_directory</span><span class="p">,</span> <span class="s2">&quot;samples&quot;</span><span class="p">)</span>
     <span class="k">if</span> <span class="ow">not</span> <span class="n">os</span><span class="o">.</span><span class="n">path</span><span class="o">.</span><span class="n">exists</span><span class="p">(</span><span class="n">samples_directory</span><span class="p">):</span>
diff --git a/_modules/parsedmarc/elastic.html b/_modules/parsedmarc/elastic.html
index 019ba31..d90e843 100644
--- a/_modules/parsedmarc/elastic.html
+++ b/_modules/parsedmarc/elastic.html
@@ -3,7 +3,7 @@
 <head>
   <meta charset="utf-8" />
   <meta name="viewport" content="width=device-width, initial-scale=1.0" />
-  <title>parsedmarc.elastic &mdash; parsedmarc 7.1.0 documentation</title>
+  <title>parsedmarc.elastic &mdash; parsedmarc 8.3.1 documentation</title>
       <link rel="stylesheet" href="../../_static/pygments.css" type="text/css" />
       <link rel="stylesheet" href="../../_static/css/theme.css" type="text/css" />
   <!--[if lt IE 9]>
@@ -13,6 +13,7 @@
         <script data-url_root="../../" id="documentation_options" src="../../_static/documentation_options.js"></script>
         <script src="../../_static/jquery.js"></script>
         <script src="../../_static/underscore.js"></script>
+        <script src="../../_static/_sphinx_javascript_frameworks_compat.js"></script>
         <script src="../../_static/doctools.js"></script>
     <script src="../../_static/js/theme.js"></script>
     <link rel="index" title="Index" href="../../genindex.html" />
@@ -27,7 +28,7 @@
             <a href="../../index.html" class="icon icon-home"> parsedmarc
           </a>
               <div class="version">
-                7.1.0
+                8.3.1
               </div>
 <div role="search">
   <form id="rtd-search-form" class="wy-form" action="../../search.html" method="get">
@@ -67,7 +68,6 @@
   <h1>Source code for parsedmarc.elastic</h1><div class="highlight"><pre>
 <span></span><span class="c1"># -*- coding: utf-8 -*-</span>
 
-<span class="kn">import</span> <span class="nn">logging</span>
 <span class="kn">from</span> <span class="nn">collections</span> <span class="kn">import</span> <span class="n">OrderedDict</span>
 
 <span class="kn">from</span> <span class="nn">elasticsearch_dsl.search</span> <span class="kn">import</span> <span class="n">Q</span>
@@ -75,12 +75,10 @@
     <span class="n">InnerDoc</span><span class="p">,</span> <span class="n">Integer</span><span class="p">,</span> <span class="n">Text</span><span class="p">,</span> <span class="n">Boolean</span><span class="p">,</span> <span class="n">Ip</span><span class="p">,</span> <span class="n">Date</span><span class="p">,</span> <span class="n">Search</span>
 <span class="kn">from</span> <span class="nn">elasticsearch.helpers</span> <span class="kn">import</span> <span class="n">reindex</span>
 
-
+<span class="kn">from</span> <span class="nn">parsedmarc.log</span> <span class="kn">import</span> <span class="n">logger</span>
 <span class="kn">from</span> <span class="nn">parsedmarc.utils</span> <span class="kn">import</span> <span class="n">human_timestamp_to_datetime</span>
 <span class="kn">from</span> <span class="nn">parsedmarc</span> <span class="kn">import</span> <span class="n">InvalidForensicReport</span>
 
-<span class="n">logger</span> <span class="o">=</span> <span class="n">logging</span><span class="o">.</span><span class="n">getLogger</span><span class="p">(</span><span class="s2">&quot;parsedmarc&quot;</span><span class="p">)</span>
-
 
 <div class="viewcode-block" id="ElasticsearchError"><a class="viewcode-back" href="../../index.html#parsedmarc.elastic.ElasticsearchError">[docs]</a><span class="k">class</span> <span class="nc">ElasticsearchError</span><span class="p">(</span><span class="ne">Exception</span><span class="p">):</span>
     <span class="sd">&quot;&quot;&quot;Raised when an Elasticsearch error occurs&quot;&quot;&quot;</span></div>
diff --git a/_modules/parsedmarc/splunk.html b/_modules/parsedmarc/splunk.html
index 5d67658..4035b74 100644
--- a/_modules/parsedmarc/splunk.html
+++ b/_modules/parsedmarc/splunk.html
@@ -3,7 +3,7 @@
 <head>
   <meta charset="utf-8" />
   <meta name="viewport" content="width=device-width, initial-scale=1.0" />
-  <title>parsedmarc.splunk &mdash; parsedmarc 7.1.0 documentation</title>
+  <title>parsedmarc.splunk &mdash; parsedmarc 8.3.1 documentation</title>
       <link rel="stylesheet" href="../../_static/pygments.css" type="text/css" />
       <link rel="stylesheet" href="../../_static/css/theme.css" type="text/css" />
   <!--[if lt IE 9]>
@@ -13,6 +13,7 @@
         <script data-url_root="../../" id="documentation_options" src="../../_static/documentation_options.js"></script>
         <script src="../../_static/jquery.js"></script>
         <script src="../../_static/underscore.js"></script>
+        <script src="../../_static/_sphinx_javascript_frameworks_compat.js"></script>
         <script src="../../_static/doctools.js"></script>
     <script src="../../_static/js/theme.js"></script>
     <link rel="index" title="Index" href="../../genindex.html" />
@@ -27,7 +28,7 @@
             <a href="../../index.html" class="icon icon-home"> parsedmarc
           </a>
               <div class="version">
-                7.1.0
+                8.3.1
               </div>
 <div role="search">
   <form id="rtd-search-form" class="wy-form" action="../../search.html" method="get">
@@ -65,8 +66,7 @@
            <div itemprop="articleBody">
              
   <h1>Source code for parsedmarc.splunk</h1><div class="highlight"><pre>
-<span></span><span class="kn">import</span> <span class="nn">logging</span>
-<span class="kn">from</span> <span class="nn">urllib.parse</span> <span class="kn">import</span> <span class="n">urlparse</span>
+<span></span><span class="kn">from</span> <span class="nn">urllib.parse</span> <span class="kn">import</span> <span class="n">urlparse</span>
 <span class="kn">import</span> <span class="nn">socket</span>
 <span class="kn">import</span> <span class="nn">json</span>
 
@@ -74,12 +74,11 @@
 <span class="kn">import</span> <span class="nn">requests</span>
 
 <span class="kn">from</span> <span class="nn">parsedmarc</span> <span class="kn">import</span> <span class="n">__version__</span>
+<span class="kn">from</span> <span class="nn">parsedmarc.log</span> <span class="kn">import</span> <span class="n">logger</span>
 <span class="kn">from</span> <span class="nn">parsedmarc.utils</span> <span class="kn">import</span> <span class="n">human_timestamp_to_timestamp</span>
 
 <span class="n">urllib3</span><span class="o">.</span><span class="n">disable_warnings</span><span class="p">(</span><span class="n">urllib3</span><span class="o">.</span><span class="n">exceptions</span><span class="o">.</span><span class="n">InsecureRequestWarning</span><span class="p">)</span>
 
-<span class="n">logger</span> <span class="o">=</span> <span class="n">logging</span><span class="o">.</span><span class="n">getLogger</span><span class="p">(</span><span class="s2">&quot;parsedmarc&quot;</span><span class="p">)</span>
-
 
 <div class="viewcode-block" id="SplunkError"><a class="viewcode-back" href="../../index.html#parsedmarc.splunk.SplunkError">[docs]</a><span class="k">class</span> <span class="nc">SplunkError</span><span class="p">(</span><span class="ne">RuntimeError</span><span class="p">):</span>
     <span class="sd">&quot;&quot;&quot;Raised when a Splunk API error occurs&quot;&quot;&quot;</span></div>
diff --git a/_modules/parsedmarc/utils.html b/_modules/parsedmarc/utils.html
index d020b67..3f99657 100644
--- a/_modules/parsedmarc/utils.html
+++ b/_modules/parsedmarc/utils.html
@@ -3,7 +3,7 @@
 <head>
   <meta charset="utf-8" />
   <meta name="viewport" content="width=device-width, initial-scale=1.0" />
-  <title>parsedmarc.utils &mdash; parsedmarc 7.1.0 documentation</title>
+  <title>parsedmarc.utils &mdash; parsedmarc 8.3.1 documentation</title>
       <link rel="stylesheet" href="../../_static/pygments.css" type="text/css" />
       <link rel="stylesheet" href="../../_static/css/theme.css" type="text/css" />
   <!--[if lt IE 9]>
@@ -13,6 +13,7 @@
         <script data-url_root="../../" id="documentation_options" src="../../_static/documentation_options.js"></script>
         <script src="../../_static/jquery.js"></script>
         <script src="../../_static/underscore.js"></script>
+        <script src="../../_static/_sphinx_javascript_frameworks_compat.js"></script>
         <script src="../../_static/doctools.js"></script>
     <script src="../../_static/js/theme.js"></script>
     <link rel="index" title="Index" href="../../genindex.html" />
@@ -27,7 +28,7 @@
             <a href="../../index.html" class="icon icon-home"> parsedmarc
           </a>
               <div class="version">
-                7.1.0
+                8.3.1
               </div>
 <div role="search">
   <form id="rtd-search-form" class="wy-form" action="../../search.html" method="get">
@@ -70,6 +71,7 @@
 <span class="kn">import</span> <span class="nn">logging</span>
 <span class="kn">import</span> <span class="nn">os</span>
 <span class="kn">from</span> <span class="nn">datetime</span> <span class="kn">import</span> <span class="n">datetime</span>
+<span class="kn">from</span> <span class="nn">datetime</span> <span class="kn">import</span> <span class="n">timezone</span>
 <span class="kn">from</span> <span class="nn">datetime</span> <span class="kn">import</span> <span class="n">timedelta</span>
 <span class="kn">from</span> <span class="nn">collections</span> <span class="kn">import</span> <span class="n">OrderedDict</span>
 <span class="kn">import</span> <span class="nn">tempfile</span>
@@ -89,7 +91,7 @@
     <span class="c1"># Try backported to PY&lt;37 `importlib_resources`</span>
     <span class="kn">import</span> <span class="nn">importlib_resources</span> <span class="k">as</span> <span class="nn">pkg_resources</span>
 
-<span class="kn">import</span> <span class="nn">dateparser</span>
+<span class="kn">from</span> <span class="nn">dateutil.parser</span> <span class="kn">import</span> <span class="n">parse</span> <span class="k">as</span> <span class="n">parse_date</span>
 <span class="kn">import</span> <span class="nn">dns.reversename</span>
 <span class="kn">import</span> <span class="nn">dns.resolver</span>
 <span class="kn">import</span> <span class="nn">dns.exception</span>
@@ -98,6 +100,7 @@
 <span class="kn">import</span> <span class="nn">requests</span>
 <span class="kn">import</span> <span class="nn">publicsuffix2</span>
 
+<span class="kn">from</span> <span class="nn">parsedmarc.log</span> <span class="kn">import</span> <span class="n">logger</span>
 <span class="kn">import</span> <span class="nn">parsedmarc.resources</span>
 
 <span class="n">USER_AGENT</span> <span class="o">=</span> <span class="s2">&quot;Mozilla/5.0 ((</span><span class="si">{0}</span><span class="s2"> </span><span class="si">{1}</span><span class="s2">)) parsedmarc&quot;</span><span class="o">.</span><span class="n">format</span><span class="p">(</span>
@@ -108,7 +111,6 @@
 <span class="n">parenthesis_regex</span> <span class="o">=</span> <span class="n">re</span><span class="o">.</span><span class="n">compile</span><span class="p">(</span><span class="sa">r</span><span class="s1">&#39;\s*\(.*\)\s*&#39;</span><span class="p">)</span>
 
 <span class="n">null_file</span> <span class="o">=</span> <span class="nb">open</span><span class="p">(</span><span class="n">os</span><span class="o">.</span><span class="n">devnull</span><span class="p">,</span> <span class="s2">&quot;w&quot;</span><span class="p">)</span>
-<span class="n">logger</span> <span class="o">=</span> <span class="n">logging</span><span class="o">.</span><span class="n">getLogger</span><span class="p">(</span><span class="s2">&quot;parsedmarc&quot;</span><span class="p">)</span>
 <span class="n">mailparser_logger</span> <span class="o">=</span> <span class="n">logging</span><span class="o">.</span><span class="n">getLogger</span><span class="p">(</span><span class="s2">&quot;mailparser&quot;</span><span class="p">)</span>
 <span class="n">mailparser_logger</span><span class="o">.</span><span class="n">setLevel</span><span class="p">(</span><span class="n">logging</span><span class="o">.</span><span class="n">CRITICAL</span><span class="p">)</span>
 
@@ -313,12 +315,9 @@
 
     <span class="n">human_timestamp</span> <span class="o">=</span> <span class="n">human_timestamp</span><span class="o">.</span><span class="n">replace</span><span class="p">(</span><span class="s2">&quot;-0000&quot;</span><span class="p">,</span> <span class="s2">&quot;&quot;</span><span class="p">)</span>
     <span class="n">human_timestamp</span> <span class="o">=</span> <span class="n">parenthesis_regex</span><span class="o">.</span><span class="n">sub</span><span class="p">(</span><span class="s2">&quot;&quot;</span><span class="p">,</span> <span class="n">human_timestamp</span><span class="p">)</span>
-    <span class="n">settings</span> <span class="o">=</span> <span class="p">{}</span>
 
-    <span class="k">if</span> <span class="n">to_utc</span><span class="p">:</span>
-        <span class="n">settings</span> <span class="o">=</span> <span class="p">{</span><span class="s2">&quot;TO_TIMEZONE&quot;</span><span class="p">:</span> <span class="s2">&quot;UTC&quot;</span><span class="p">}</span>
-
-    <span class="k">return</span> <span class="n">dateparser</span><span class="o">.</span><span class="n">parse</span><span class="p">(</span><span class="n">human_timestamp</span><span class="p">,</span> <span class="n">settings</span><span class="o">=</span><span class="n">settings</span><span class="p">)</span></div>
+    <span class="n">dt</span> <span class="o">=</span> <span class="n">parse_date</span><span class="p">(</span><span class="n">human_timestamp</span><span class="p">)</span>
+    <span class="k">return</span> <span class="n">dt</span><span class="o">.</span><span class="n">astimezone</span><span class="p">(</span><span class="n">timezone</span><span class="o">.</span><span class="n">utc</span><span class="p">)</span> <span class="k">if</span> <span class="n">to_utc</span> <span class="k">else</span> <span class="n">dt</span></div>
 
 
 <div class="viewcode-block" id="human_timestamp_to_timestamp"><a class="viewcode-back" href="../../index.html#parsedmarc.utils.human_timestamp_to_timestamp">[docs]</a><span class="k">def</span> <span class="nf">human_timestamp_to_timestamp</span><span class="p">(</span><span class="n">human_timestamp</span><span class="p">):</span>
diff --git a/_sources/index.md.txt b/_sources/index.md.txt
new file mode 100644
index 0000000..36ab5ba
--- /dev/null
+++ b/_sources/index.md.txt
@@ -0,0 +1,1686 @@
+# parsedmarc documentation - Open source DMARC report analyzer and visualizer
+
+[![Build
+Status](https://github.com/domainaware/parsedmarc/actions/workflows/python-tests.yml/badge.svg)](https://github.com/domainaware/parsedmarc/actions/workflows/python-tests.yml)
+[![Code
+Coverage](https://codecov.io/gh/domainaware/parsedmarc/branch/master/graph/badge.svg)](https://codecov.io/gh/domainaware/parsedmarc)
+[![PyPI
+Package](https://img.shields.io/pypi/v/parsedmarc.svg)](https://pypi.org/project/parsedmarc/)
+
+:::{note}
+**Help Wanted**
+
+This is a project is maintained by one developer.
+Please consider reviewing the open [issues] to see how you can contribute code, documentation, or user support.
+Assistance on the pinned issues would be particularly helpful.
+
+Thanks to all [contributors]!
+:::
+
+```{image} _static/screenshots/dmarc-summary-charts.png
+:align: center
+:alt: A screenshot of DMARC summary charts in Kibana
+:scale: 50 %
+:target: _static/screenshots/dmarc-summary-charts.png
+```
+
+`parsedmarc` is a Python module and CLI utility for parsing DMARC reports.
+When used with Elasticsearch and Kibana (or Splunk), it works as a self-hosted
+open source alternative to commercial DMARC report processing services such
+as Agari Brand Protection, Dmarcian, OnDMARC, ProofPoint Email Fraud Defense,
+and Valimail.
+
+## Features
+
+- Parses draft and 1.0 standard aggregate/rua reports
+- Parses forensic/failure/ruf reports
+- Can parse reports from an inbox over IMAP, Microsoft Graph, or Gmail API
+- Transparently handles gzip or zip compressed reports
+- Consistent data structures
+- Simple JSON and/or CSV output
+- Optionally email the results
+- Optionally send the results to Elasticsearch and/or Splunk, for use with
+  premade dashboards
+- Optionally send reports to Apache Kafka
+
+## Resources
+
+### DMARC guides
+
+- [Demystifying DMARC] - A complete guide to SPF, DKIM, and DMARC
+
+### SPF and DMARC record validation
+
+If you are looking for SPF and DMARC record validation and parsing,
+check out the sister project,
+[checkdmarc](https://domainaware.github.io/checkdmarc/).
+
+### Lookalike domains
+
+DMARC protects against domain spoofing, not lookalike domains. for open source
+lookalike domain monitoring, check out [DomainAware](https://github.com/seanthegeek/domainaware).
+
+## CLI help
+
+```text
+usage: parsedmarc [-h] [-c CONFIG_FILE] [--strip-attachment-payloads] [-o OUTPUT]
+                   [--aggregate-json-filename AGGREGATE_JSON_FILENAME]
+                   [--forensic-json-filename FORENSIC_JSON_FILENAME]
+                   [--aggregate-csv-filename AGGREGATE_CSV_FILENAME]
+                   [--forensic-csv-filename FORENSIC_CSV_FILENAME]
+                   [-n NAMESERVERS [NAMESERVERS ...]] [-t DNS_TIMEOUT] [--offline]
+                   [-s] [--verbose] [--debug] [--log-file LOG_FILE] [-v]
+                   [file_path ...]
+
+ Parses DMARC reports
+
+ positional arguments:
+   file_path             one or more paths to aggregate or forensic report
+                         files, emails, or mbox files'
+
+ optional arguments:
+   -h, --help            show this help message and exit
+   -c CONFIG_FILE, --config-file CONFIG_FILE
+                         a path to a configuration file (--silent implied)
+   --strip-attachment-payloads
+                         remove attachment payloads from forensic report output
+   -o OUTPUT, --output OUTPUT
+                         write output files to the given directory
+   --aggregate-json-filename AGGREGATE_JSON_FILENAME
+                         filename for the aggregate JSON output file
+   --forensic-json-filename FORENSIC_JSON_FILENAME
+                         filename for the forensic JSON output file
+   --aggregate-csv-filename AGGREGATE_CSV_FILENAME
+                         filename for the aggregate CSV output file
+   --forensic-csv-filename FORENSIC_CSV_FILENAME
+                         filename for the forensic CSV output file
+   -n NAMESERVERS [NAMESERVERS ...], --nameservers NAMESERVERS [NAMESERVERS ...]
+                         nameservers to query
+   -t DNS_TIMEOUT, --dns_timeout DNS_TIMEOUT
+                         number of seconds to wait for an answer from DNS
+                         (default: 2.0)
+   --offline             do not make online queries for geolocation or DNS
+   -s, --silent          only print errors and warnings
+   --verbose             more verbose output
+   --debug               print debugging information
+   --log-file LOG_FILE   output logging to a file
+   -v, --version         show program's version number and exit
+```
+
+:::{note}
+Starting in `parsedmarc` 6.0.0, most CLI options were moved to a
+configuration file, described below.
+:::
+
+## Configuration file
+
+`parsedmarc` can be configured by supplying the path to an INI file
+
+```bash
+parsedmarc -c /etc/parsedmarc.ini
+```
+
+For example
+
+```ini
+# This is an example comment
+
+[general]
+save_aggregate = True
+save_forensic = True
+
+[imap]
+host = imap.example.com
+user = dmarcresports@example.com
+password = $uperSecure
+
+[mailbox]
+watch = True
+delete = False
+
+[elasticsearch]
+hosts = 127.0.0.1:9200
+ssl = False
+
+[splunk_hec]
+url = https://splunkhec.example.com
+token = HECTokenGoesHere
+index = email
+
+[s3]
+bucket = my-bucket
+path = parsedmarc
+
+[syslog]
+server = localhost
+port = 514
+```
+
+The full set of configuration options are:
+
+- `general`
+  : - `save_aggregate` - bool: Save aggregate report data to
+      Elasticsearch, Splunk and/or S3
+  - `save_forensic` - bool: Save forensic report data to
+      Elasticsearch, Splunk and/or S3
+  - `strip_attachment_payloads` - bool: Remove attachment
+      payloads from results
+  - `output` - str: Directory to place JSON and CSV files in
+  - `aggregate_json_filename` - str: filename for the aggregate
+      JSON output file
+  - `forensic_json_filename` - str: filename for the forensic
+      JSON output file
+  - `ip_db_path` - str: An optional custom path to a MMDB file
+  - from MaxMind or DBIP
+  - `offline` - bool: Do not use online queries for geolocation
+      or DNS
+  - `nameservers` -  str: A comma separated list of
+      DNS resolvers (Default: [Cloudflare's public resolvers])
+  - `dns_timeout` - float: DNS timeout period
+  - `debug` - bool: Print debugging messages
+  - `silent` - bool: Only print errors (Default: True)
+  - `log_file` - str: Write log messages to a file at this path
+  - `n_procs` - int: Number of process to run in parallel when
+      parsing in CLI mode (Default: 1)
+  - `chunk_size` - int: Number of files to give to each process
+      when running in parallel.
+
+    :::{note}
+    Setting this to a number larger than one can improve
+    performance when processing thousands of files
+    :::
+- `mailbox`
+  : - `reports_folder` - str: The mailbox folder (or label for
+      Gmail) where the incoming reports can be found (Default: INBOX)
+  - `archive_folder` - str:  The mailbox folder (or label for
+      Gmail) to sort processed emails into (Default: Archive)
+  - `watch` - bool: Use the IMAP `IDLE` command to process
+  - messages as they arrive or poll MS Graph for new messages
+  - `delete` - bool: Delete messages after processing them,
+  - instead of archiving them
+  - `test` - bool: Do not move or delete messages
+  - `batch_size` - int: Number of messages to read and process
+      before saving. Default 10. Use 0 for no limit.
+  - `check_timeout` - int: Number of seconds to wait for a IMAP
+      IDLE response or the number of seconds until the next mai
+      check (Default: 30)
+- `imap`
+  : - `host` - str: The IMAP server hostname or IP address
+  - `port` - int: The IMAP server port (Default: 993)
+
+    :::{note}
+    `%` characters must be escaped with another `%` character,
+    so use `%%` wherever a `%` character is used.
+    :::
+
+    :::{note}
+    Starting in version 8.0.0, most options from the `imap`
+    section have been moved to the `mailbox` section.
+    :::
+
+    :::{note}
+    If your host recommends another port, still try 993
+    :::
+
+  - `ssl` - bool: Use an encrypted SSL/TLS connection
+      (Default: True)
+  - `skip_certificate_verification` - bool: Skip certificate
+      verification (not recommended)
+  - `user` - str: The IMAP user
+  - `password` - str: The IMAP password
+- `msgraph`
+  : - `auth_method` - str: Authentication method, valid types are
+      UsernamePassword, DeviceCode, or ClientSecret
+      (Default: UsernamePassword).
+  - `user` - str: The M365 user, required when the auth method is
+      UsernamePassword
+  - `password` - str: The user password, required when the auth
+      method is UsernamePassword
+  - `client_id` - str: The app registration's client ID
+  - `client_secret` - str: The app registration's secret
+  - `tenant_id` - str: The Azure AD tenant ID. This is required
+      for all auth methods except UsernamePassword.
+  - `mailbox` - str: The mailbox name. This defaults to the
+      current user if using the UsernamePassword auth method, but
+      could be a shared mailbox if the user has access to the mailbox
+  - `token_file` - str: Path to save the token file
+      (Default: .token)
+
+    :::{note}
+    You must create an app registration in Azure AD and have an
+    admin grant the Microsoft Graph `Mail.ReadWrite`
+    (delegated) permission to the app. If you are using
+    `UsernamePassword` auth and the mailbox is different from the
+    username, you must grant the app `Mail.ReadWrite.Shared`.
+    :::
+
+    :::{warning}
+    If you are using the `ClientSecret` auth method, you need to
+    grant the `Mail.ReadWrite` (application) permission to the
+    app. You must also restrict the application's access to a
+    specific mailbox since it allows all mailboxes by default.
+    Use the `New-ApplicationAccessPolicy` command in the
+    Exchange PowerShell module. If you need to scope the policy to
+    shared mailboxes, you can add them to a mail enabled security
+    group and use that as the group id.
+
+    ```powershell
+    New-ApplicationAccessPolicy -AccessRight RestrictAccess
+    -AppId "<CLIENT_ID>" -PolicyScopeGroupId "<MAILBOX>"
+    -Description "Restrict access to dmarc reports mailbox."
+    ```
+
+    :::
+- `elasticsearch`
+  : - `hosts` - str: A comma separated list of hostnames and ports
+      or URLs (e.g. `127.0.0.1:9200` or
+      `https://user:secret@localhost`)
+
+    :::{note}
+    Special characters in the username or password must be
+    [URL encoded].
+    :::
+
+  - `ssl` - bool: Use an encrypted SSL/TLS connection (Default: True)
+  - `cert_path` - str: Path to a trusted certificates
+  - `index_suffix` - str: A suffix to apply to the index names
+  - `monthly_indexes` - bool: Use monthly indexes instead of daily indexes
+  - `number_of_shards` - int: The number of shards to use when creating the index (Default: 1)
+  - `number_of_replicas` - int: The number of replicas to use when creating the index (Default: 1)
+- `splunk_hec`
+  : - `url` - str: The URL of the Splunk HTTP Events Collector (HEC)
+  - `token` - str: The HEC token
+  - `index` - str: The Splunk index to use
+  - `skip_certificate_verification` - bool: Skip certificate
+      verification (not recommended)
+- `kafka`
+  : - `hosts` - str: A comma separated list of Kafka hosts
+  - `user` - str: The Kafka user
+  - `passsword` - str: The Kafka password
+  - `ssl` - bool: Use an encrypted SSL/TLS connection (Default: True)
+  - `skip_certificate_verification` - bool: Skip certificate
+      verification (not recommended)
+  - `aggregate_topic` - str: The Kafka topic for aggregate reports
+  - `forensic_topic` - str: The Kafka topic for forensic reports
+- `smtp`
+  : - `host` - str: The SMTP hostname
+  - `port` - int: The SMTP port (Default: 25)
+  - `ssl` - bool: Require SSL/TLS instead of using STARTTLS
+  - `skip_certificate_verification` - bool: Skip certificate
+      verification (not recommended)
+  - `user` - str: the SMTP username
+  - `password` - str: the SMTP password
+  - `from` - str: The From header to use in the email
+  - `to` - list: A list of email addresses to send to
+  - `subject` - str: The Subject header to use in the email
+      (Default: parsedmarc report)
+  - `attachment` - str: The ZIP attachment filenames
+  - `message` - str: The email message
+      (Default: Please see the attached parsedmarc report.)
+
+    :::{note}
+    `%` characters must be escaped with another `%` character,
+    so use `%%` wherever a `%` character is used.
+    :::
+- `s3`
+  : - `bucket` - str: The S3 bucket name
+  - `path` - str: The path to upload reports to (Default: /)
+  - `region_name` - str: The region name (Optional)
+  - `endpoint_url` - str: The endpoint URL (Optional)
+  - `access_key_id` - str: The access key id (Optional)
+  - `secret_access_key` - str: The secret access key (Optional)
+- `syslog`
+  : - `server` - str: The Syslog server name or IP address
+  - `port` - int: The UDP port to use (Default: 514)
+- `gmail_api`
+  : - `credentials_file` - str: Path to file containing the
+      credentials, None to disable (Default: None)
+  - `token_file` - str: Path to save the token file
+      (Default: .token)
+  - `include_spam_trash` - bool: Include messages in Spam and
+      Trash when searching reports (Default: False)
+  - `scopes` - str: Comma separated list of scopes to use when
+      acquiring credentials (Default: <https://www.googleapis.com/auth/gmail.modify>)
+  - `oauth2_port` - int: The TCP port for the local server to
+      listen on for the OAuth2 response (Default: 8080)
+
+:::{warning}
+It is **strongly recommended** to **not** use the `nameservers`
+setting. By default, `parsedmarc` uses
+[Cloudflare's public resolvers], which are much faster and more
+reliable than Google, Cisco OpenDNS, or even most local resolvers.
+
+The `nameservers` option should only be used if your network
+blocks DNS requests to outside resolvers.
+:::
+
+:::{warning}
+`save_aggregate` and `save_forensic` are separate options
+because you may not want to save forensic reports
+(also known as failure reports) to your Elasticsearch instance,
+particularly if you are in a highly-regulated industry that
+handles sensitive data, such as healthcare or finance. If your
+legitimate outgoing email fails DMARC, it is possible
+that email may appear later in a forensic report.
+
+Forensic reports contain the original headers of an email that
+failed a DMARC check, and sometimes may also include the
+full message body, depending on the policy of the reporting
+organization.
+
+Most reporting organizations do not send forensic reports of any
+kind for privacy reasons. While aggregate DMARC reports are sent
+at least daily, it is normal to receive very few forensic reports.
+
+An alternative approach is to still collect forensic/failure/ruf
+reports in your DMARC inbox, but run `parsedmarc` with
+``` save_forensic = True``manually on a separate IMAP folder (using
+the  ``reports_folder ``` option), after you have manually moved
+known samples you want to save to that folder
+(e.g. malicious samples and non-sensitive legitimate samples).
+:::
+
+## Sample aggregate report output
+
+Here are the results from parsing the [example](https://dmarc.org/wiki/FAQ#I_need_to_implement_aggregate_reports.2C_what_do_they_look_like.3F)
+report from the dmarc.org wiki. It's actually an older draft of the the 1.0
+report schema standardized in
+[RFC 7480 Appendix C](https://tools.ietf.org/html/rfc7489#appendix-C).
+This draft schema is still in wide use.
+
+`parsedmarc` produces consistent, normalized output, regardless
+of the report schema.
+
+### JSON
+
+```json
+{
+  "xml_schema": "draft",
+  "report_metadata": {
+    "org_name": "acme.com",
+    "org_email": "noreply-dmarc-support@acme.com",
+    "org_extra_contact_info": "http://acme.com/dmarc/support",
+    "report_id": "9391651994964116463",
+    "begin_date": "2012-04-27 20:00:00",
+    "end_date": "2012-04-28 19:59:59",
+    "errors": []
+  },
+  "policy_published": {
+    "domain": "example.com",
+    "adkim": "r",
+    "aspf": "r",
+    "p": "none",
+    "sp": "none",
+    "pct": "100",
+    "fo": "0"
+  },
+  "records": [
+    {
+      "source": {
+        "ip_address": "72.150.241.94",
+        "country": "US",
+        "reverse_dns": "adsl-72-150-241-94.shv.bellsouth.net",
+        "base_domain": "bellsouth.net"
+      },
+      "count": 2,
+      "alignment": {
+        "spf": true,
+        "dkim": false,
+        "dmarc": true
+      },
+      "policy_evaluated": {
+        "disposition": "none",
+        "dkim": "fail",
+        "spf": "pass",
+        "policy_override_reasons": []
+      },
+      "identifiers": {
+        "header_from": "example.com",
+        "envelope_from": "example.com",
+        "envelope_to": null
+      },
+      "auth_results": {
+        "dkim": [
+          {
+            "domain": "example.com",
+            "selector": "none",
+            "result": "fail"
+          }
+        ],
+        "spf": [
+          {
+            "domain": "example.com",
+            "scope": "mfrom",
+            "result": "pass"
+          }
+        ]
+      }
+    }
+  ]
+}
+```
+
+### CSV
+
+```text
+xml_schema,org_name,org_email,org_extra_contact_info,report_id,begin_date,end_date,errors,domain,adkim,aspf,p,sp,pct,fo,source_ip_address,source_country,source_reverse_dns,source_base_domain,count,spf_aligned,dkim_aligned,dmarc_aligned,disposition,policy_override_reasons,policy_override_comments,envelope_from,header_from,envelope_to,dkim_domains,dkim_selectors,dkim_results,spf_domains,spf_scopes,spf_results
+draft,acme.com,noreply-dmarc-support@acme.com,http://acme.com/dmarc/support,9391651994964116463,2012-04-27 20:00:00,2012-04-28 19:59:59,,example.com,r,r,none,none,100,0,72.150.241.94,US,adsl-72-150-241-94.shv.bellsouth.net,bellsouth.net,2,True,False,True,none,,,example.com,example.com,,example.com,none,fail,example.com,mfrom,pass
+```
+
+## Sample forensic report output
+
+Thanks to Github user [xennn](https://github.com/xennn) for the anonymized
+[forensic report email sample](<https://github.com/domainaware/parsedmarc/raw/master/samples/forensic/DMARC%20Failure%20Report%20for%20domain.de%20(mail-from%3Dsharepoint%40domain.de%2C%20ip%3D10.10.10.10).eml>).
+
+### JSON
+
+```json
+{
+     "feedback_type": "auth-failure",
+     "user_agent": "Lua/1.0",
+     "version": "1.0",
+     "original_mail_from": "sharepoint@domain.de",
+     "original_rcpt_to": "peter.pan@domain.de",
+     "arrival_date": "Mon, 01 Oct 2018 11:20:27 +0200",
+     "message_id": "<38.E7.30937.BD6E1BB5@ mailrelay.de>",
+     "authentication_results": "dmarc=fail (p=none, dis=none) header.from=domain.de",
+     "delivery_result": "policy",
+     "auth_failure": [
+       "dmarc"
+     ],
+     "reported_domain": "domain.de",
+     "arrival_date_utc": "2018-10-01 09:20:27",
+     "source": {
+       "ip_address": "10.10.10.10",
+       "country": null,
+       "reverse_dns": null,
+       "base_domain": null
+     },
+     "authentication_mechanisms": [],
+     "original_envelope_id": null,
+     "dkim_domain": null,
+     "sample_headers_only": false,
+     "sample": "Received: from Servernameone.domain.local (Servernameone.domain.local [10.10.10.10])\n\tby  mailrelay.de (mail.DOMAIN.de) with SMTP id 38.E7.30937.BD6E1BB5; Mon,  1 Oct 2018 11:20:27 +0200 (CEST)\nDate: 01 Oct 2018 11:20:27 +0200\nMessage-ID: <38.E7.30937.BD6E1BB5@ mailrelay.de>\nTo: <peter.pan@domain.de>\nfrom: \"=?utf-8?B?SW50ZXJha3RpdmUgV2V0dGJld2VyYmVyLcOcYmVyc2ljaHQ=?=\" <sharepoint@domain.de>\nSubject: Subject\nMIME-Version: 1.0\nX-Mailer: Microsoft SharePoint Foundation 2010\nContent-Type: text/html; charset=utf-8\nContent-Transfer-Encoding: quoted-printable\n\n<html><head><base href=3D'\nwettbewerb' /></head><body><!DOCTYPE HTML PUBLIC \"-//W3C//DTD HTML 3.2//EN\"=\n><HTML><HEAD><META NAME=3D\"Generator\" CONTENT=3D\"MS Exchange Server version=\n 08.01.0240.003\"></html>\n",
+     "parsed_sample": {
+       "from": {
+         "display_name": "Interaktive Wettbewerber-Übersicht",
+         "address": "sharepoint@domain.de",
+         "local": "sharepoint",
+         "domain": "domain.de"
+       },
+       "to_domains": [
+         "domain.de"
+       ],
+       "to": [
+         {
+           "display_name": null,
+           "address": "peter.pan@domain.de",
+           "local": "peter.pan",
+           "domain": "domain.de"
+         }
+       ],
+       "subject": "Subject",
+       "timezone": "+2",
+       "mime-version": "1.0",
+       "date": "2018-10-01 09:20:27",
+       "content-type": "text/html; charset=utf-8",
+       "x-mailer": "Microsoft SharePoint Foundation 2010",
+       "body": "<html><head><base href='\nwettbewerb' /></head><body><!DOCTYPE HTML PUBLIC \"-//W3C//DTD HTML 3.2//EN\"><HTML><HEAD><META NAME=\"Generator\" CONTENT=\"MS Exchange Server version 08.01.0240.003\"></html>",
+       "received": [
+         {
+           "from": "Servernameone.domain.local Servernameone.domain.local 10.10.10.10",
+           "by": "mailrelay.de mail.DOMAIN.de",
+           "with": "SMTP id 38.E7.30937.BD6E1BB5",
+           "date": "Mon, 1 Oct 2018 11:20:27 +0200 CEST",
+           "hop": 1,
+           "date_utc": "2018-10-01 09:20:27",
+           "delay": 0
+         }
+       ],
+       "content-transfer-encoding": "quoted-printable",
+       "message-id": "<38.E7.30937.BD6E1BB5@ mailrelay.de>",
+       "has_defects": false,
+       "headers": {
+         "Received": "from Servernameone.domain.local (Servernameone.domain.local [10.10.10.10])\n\tby  mailrelay.de (mail.DOMAIN.de) with SMTP id 38.E7.30937.BD6E1BB5; Mon,  1 Oct 2018 11:20:27 +0200 (CEST)",
+         "Date": "01 Oct 2018 11:20:27 +0200",
+         "Message-ID": "<38.E7.30937.BD6E1BB5@ mailrelay.de>",
+         "To": "<peter.pan@domain.de>",
+         "from": "\"Interaktive Wettbewerber-Übersicht\" <sharepoint@domain.de>",
+         "Subject": "Subject",
+         "MIME-Version": "1.0",
+         "X-Mailer": "Microsoft SharePoint Foundation 2010",
+         "Content-Type": "text/html; charset=utf-8",
+         "Content-Transfer-Encoding": "quoted-printable"
+       },
+       "reply_to": [],
+       "cc": [],
+       "bcc": [],
+       "attachments": [],
+       "filename_safe_subject": "Subject"
+     }
+   }
+```
+
+### CSV
+
+```text
+feedback_type,user_agent,version,original_envelope_id,original_mail_from,original_rcpt_to,arrival_date,arrival_date_utc,subject,message_id,authentication_results,dkim_domain,source_ip_address,source_country,source_reverse_dns,source_base_domain,delivery_result,auth_failure,reported_domain,authentication_mechanisms,sample_headers_only
+auth-failure,Lua/1.0,1.0,,sharepoint@domain.de,peter.pan@domain.de,"Mon, 01 Oct 2018 11:20:27 +0200",2018-10-01 09:20:27,Subject,<38.E7.30937.BD6E1BB5@ mailrelay.de>,"dmarc=fail (p=none, dis=none) header.from=domain.de",,10.10.10.10,,,,policy,dmarc,domain.de,,False
+```
+
+## Bug reports
+
+Please report bugs on the GitHub issue tracker
+
+<https://github.com/domainaware/parsedmarc/issues>
+
+## Installation
+
+`parsedmarc` works with Python 3 only.
+
+:::{note}
+If your system is behind a web proxy, you need to configure your system
+to use that proxy. To do this, edit `/etc/environment` and add your
+proxy details there, for example:
+
+```bash
+http_proxy=http://user:password@prox-server:3128
+https_proxy=https://user:password@prox-server:3128
+ftp_proxy=http://user:password@prox-server:3128
+```
+
+Or if no credentials are needed:
+
+```bash
+http_proxy=http://prox-server:3128
+https_proxy=https://prox-server:3128
+ftp_proxy=http://prox-server:3128
+```
+
+This will set the the proxy up for use system-wide, including for
+`parsedmarc`.
+:::
+
+:::{warning}
+If your mail server is Microsoft Exchange, ensure that it is patched to at
+least:
+
+- Exchange Server 2010 Update Rollup 22 ([KB4295699](https://support.microsoft.com/KB/4295699))
+- Exchange Server 2013 Cumulative Update 21 ([KB4099855](https://support.microsoft.com/KB/4099855))
+- Exchange Server 2016 Cumulative Update 11 ([KB4134118](https://support.microsoft.com/kb/4134118))
+:::
+
+### geoipupdate setup
+
+:::{note}
+Starting in `parsedmarc` 7.1.0, a static copy of the  [IP to Country Lite database] from IPDB is
+distributed with `parsedmarc`, under the terms of the [Creative Commons Attribution 4.0 International License]. as
+a fallback if the [MaxMind GeoLite2 Country database] is not installed  However, `parsedmarc` cannot install updated
+versions of these databases as they are released, so MaxMind's databases and [geoipupdate] tool is still the
+preferable solution.
+
+The location of the database file can be overridden by using the `ip_db_path` setting.
+:::
+
+On Debian 10 (Buster) or later, run:
+
+```bash
+sudo apt-get install -y geoipupdate
+```
+
+On Ubuntu systems run:
+
+```bash
+sudo add-apt-repository ppa:maxmind/ppa
+sudo apt update
+sudo apt install -y geoipupdate
+```
+
+On CentOS or RHEL systems, run:
+
+```bash
+sudo dnf install -y geoipupdate
+```
+
+The latest builds for Linux, macOS, and Windows can be downloaded
+from the [geoipupdate releases page on GitHub].
+
+On December 30th, 2019, MaxMind started requiring free accounts to
+access the free Geolite2 databases, in order [to
+comply with various privacy regulations][to comply with various privacy regulations].
+
+Start by [registering for a free GeoLite2 account], and signing in.
+
+Then, navigate the to the [License Keys] page under your account,
+and create a new license key for the version of
+`geoipupdate` that was installed.
+
+:::{warning}
+The configuration file format is different for older (i.e. \<=3.1.1) and newer (i.e. >=3.1.1) versions
+of `geoipupdate`. Be sure to select the correct version for your system.
+:::
+
+:::{note}
+To check the version of `geoipupdate` that is installed, run:
+
+```bash
+geoipupdate -V
+```
+
+:::
+
+You can use `parsedmarc` as the description for the key.
+
+Once you have generated a key, download the config pre-filled
+configuration file. This file should be saved at `/etc/GeoIP.conf`
+on Linux or macOS systems, or at
+`%SystemDrive%\ProgramData\MaxMind\GeoIPUpdate\GeoIP.conf` on
+Windows systems.
+
+Then run
+
+```bash
+sudo geoipupdate
+```
+
+To download the databases for the first time.
+
+The GeoLite2 Country, City, and ASN databases are updated weekly,
+every Tuesday. `geoipupdate` can be run weekly by adding a cron
+job or scheduled task.
+
+More information about `geoipupdate` can be found at the
+[MaxMind geoipupdate page].
+
+### Installing parsedmarc
+
+On Debian or Ubuntu systems, run:
+
+```bash
+sudo apt-get install -y python3-pip python3-virtualenv python3-dev libxml2-dev libxslt-dev
+```
+
+On CentOS or RHEL systems, run:
+
+```bash
+sudo dnf install -y python39 python3-virtualenv python3-setuptools python3-devel libxml2-devel libxslt-devel
+```
+
+Python 3 installers for Windows and macOS can be found at
+<https://www.python.org/downloads/>
+
+Create a system user
+
+```bash
+sudo mkdir /opt
+sudo useradd parsedmarc -r -s /bin/false -m -b /opt
+```
+
+Install parsedmarc in a virtualenv
+
+```bash
+sudo -u parsedmarc virtualenv /opt/parsedmarc/venv
+```
+
+CentOS/RHEL 8 systems use Python 3.6 by default, so on those systems
+explicitly tell `virtualenv` to use `python3.9` instead
+
+```bash
+sudo -u parsedmarc virtualenv -p python3.9  /opt/parsedmarc/venv
+```
+
+To install or upgrade `parsedmarc` inside the virtualenv, run:
+
+```bash
+sudo -u parsedmarc /opt/parsedmarc/venv -U parsedmarc
+```
+
+### Optional dependencies
+
+If you would like to be able to parse emails saved from Microsoft Outlook
+(i.e. OLE .msg files), install `msgconvert`:
+
+On Debian or Ubuntu systems, run:
+
+```bash
+sudo apt-get install libemail-outlook-message-perl
+```
+
+### Testing multiple report analyzers
+
+If you would like to test parsedmarc and another report processing solution
+at the same time, you can have up to two mailto URIs each in the rua and ruf
+tags in your DMARC record, separated by commas.
+
+### Accessing an inbox using OWA/EWS
+
+:::{note}
+Starting in 8.0.0, parsedmarc supports accessing Microsoft/Office 365
+inboxes via the Microsoft Graph API, which is preferred over Davmail.
+:::
+
+Some organizations do not allow IMAP or the Microsoft Graph API,
+and only support Exchange Web Services (EWS)/Outlook Web Access (OWA).
+In that case, Davmail will need to be set up
+as a local EWS/OWA IMAP gateway. It can even work where
+[Modern Auth/multi-factor authentication] is required.
+
+To do this, download the latest `davmail-version.zip` from
+<https://sourceforge.net/projects/davmail/files/>
+
+Extract the zip using the `unzip` command.
+
+Install Java:
+
+```bash
+sudo apt-get install default-jre-headless
+```
+
+Configure Davmail by creating a `davmail.properties` file
+
+```properties
+# DavMail settings, see http://davmail.sourceforge.net/ for documentation
+
+#############################################################
+# Basic settings
+
+# Server or workstation mode
+davmail.server=true
+
+# connection mode auto, EWS or WebDav
+davmail.enableEws=auto
+
+# base Exchange OWA or EWS url
+davmail.url=https://outlook.office365.com/EWS/Exchange.asmx
+
+# Listener ports
+davmail.imapPort=1143
+
+#############################################################
+# Network settings
+
+# Network proxy settings
+davmail.enableProxy=false
+davmail.useSystemProxies=false
+davmail.proxyHost=
+davmail.proxyPort=
+davmail.proxyUser=
+davmail.proxyPassword=
+
+# proxy exclude list
+davmail.noProxyFor=
+
+# block remote connection to DavMail
+davmail.allowRemote=false
+
+# bind server sockets to the loopback address
+davmail.bindAddress=127.0.0.1
+
+# disable SSL for specified listeners
+davmail.ssl.nosecureimap=true
+
+# Send keepalive character during large folder and messages download
+davmail.enableKeepalive=true
+
+# Message count limit on folder retrieval
+davmail.folderSizeLimit=0
+
+#############################################################
+# IMAP settings
+
+# Delete messages immediately on IMAP STORE \Deleted flag
+davmail.imapAutoExpunge=true
+
+# Enable IDLE support, set polling delay in minutes
+davmail.imapIdleDelay=1
+
+# Always reply to IMAP RFC822.SIZE requests with Exchange approximate
+# message size for performance reasons
+davmail.imapAlwaysApproxMsgSize=true
+
+# Client connection timeout in seconds - default 300, 0 to disable
+davmail.clientSoTimeout=0
+
+#############################################################
+```
+
+#### Running DavMail as a systemd service
+
+Use systemd to run `davmail` as a service.
+
+Create a system user
+
+```bash
+sudo useradd davmail -r -s /bin/false
+```
+
+Protect the `davmail` configuration file from prying eyes
+
+```bash
+sudo chown root:davmail /opt/davmail/davmail.properties
+sudo chmod u=rw,g=r,o= /opt/davmail/davmail.properties
+```
+
+Create the service configuration file
+
+```bash
+sudo nano /etc/systemd/system/davmail.service
+```
+
+```ini
+[Unit]
+Description=DavMail gateway service
+Documentation=https://sourceforge.net/projects/davmail/
+Wants=network-online.target
+After=syslog.target network.target
+
+[Service]
+ExecStart=/opt/davmail/davmail /opt/davmail/davmail.properties
+User=davmail
+Group=davmail
+Restart=always
+RestartSec=5m
+
+[Install]
+WantedBy=multi-user.target
+```
+
+Then, enable the service
+
+```bash
+sudo systemctl daemon-reload
+sudo systemctl enable parsedmarc.service
+sudo service davmail restart
+```
+
+:::{note}
+You must also run the above commands whenever you edit
+`davmail.service`.
+:::
+
+:::{warning}
+Always restart the service every time you upgrade to a new version of
+`davmail`:
+
+```bash
+sudo service davmail restart
+```
+
+:::
+
+To check the status of the service, run:
+
+```bash
+service davmail status
+```
+
+:::{note}
+In the event of a crash, systemd will restart the service after 5 minutes,
+but the `service davmail status` command will only show the logs for the
+current process. To vew the logs for previous runs as well as the
+current process (newest to oldest), run:
+
+```bash
+journalctl -u davmail.service -r
+```
+
+:::
+
+#### Configuring parsedmarc for DavMail
+
+Because you are interacting with DavMail server over the loopback
+(i.e. `127.0.0.1`), add the following options to `parsedmarc.ini`
+config file:
+
+```ini
+[imap]
+host=127.0.0.1
+port=1143
+ssl=False
+watch=True
+```
+
+### Elasticsearch and Kibana
+
+:::{note}
+Splunk is also supported starting with `parsedmarc` 4.3.0
+:::
+
+To set up visual dashboards of DMARC data, install Elasticsearch and Kibana.
+
+:::{note}
+Elasticsearch and Kibana 6 or later are required
+:::
+
+On Debian/Ubuntu based systems, run:
+
+```bash
+sudo apt-get install -y apt-transport-https
+wget -qO - https://artifacts.elastic.co/GPG-KEY-elasticsearch | sudo apt-key add -
+echo "deb https://artifacts.elastic.co/packages/7.x/apt stable main" | sudo tee -a /etc/apt/sources.list.d/elastic-7.x.list
+sudo apt-get update
+sudo apt-get install -y default-jre-headless elasticsearch kibana
+```
+
+For CentOS, RHEL, and other RPM systems, follow the Elastic RPM guides for
+[Elasticsearch] and [Kibana].
+
+:::{warning}
+The default JVM heap size for Elasticsearch is very small (1g), which will
+cause it to crash under a heavy load. To fix this, increase the minimum and
+maximum JVM heap sizes in `/etc/elasticsearch/jvm.options` to more
+reasonable levels, depending on your server's resources.
+
+Make sure the system has at least 2 GB more RAM then the assigned JVM
+heap size.
+
+Always set the minimum and maximum JVM heap sizes to the same
+value.
+
+For example, to set a 4 GB heap size, set
+
+```bash
+-Xms4g
+-Xmx4g
+```
+
+See <https://www.elastic.co/guide/en/elasticsearch/reference/current/heap-size.html>
+for more information.
+:::
+
+```bash
+sudo systemctl daemon-reload
+sudo systemctl enable elasticsearch.service
+sudo systemctl enable kibana.service
+sudo service elasticsearch start
+sudo service kibana start
+```
+
+Without the commercial [X-Pack] or [ReadonlyREST] products, Kibana
+does not have any authentication
+mechanism of its own. You can use nginx as a reverse proxy that provides basic
+authentication.
+
+```bash
+sudo apt-get install -y nginx apache2-utils
+```
+
+Or, on CentOS:
+
+```bash
+sudo yum install -y nginx httpd-tools
+```
+
+Create a directory to store the certificates and keys:
+
+```bash
+mkdir ~/ssl
+cd ~/ssl
+```
+
+To create a self-signed certificate, run:
+
+```bash
+openssl req -x509 -nodes -days 365 -newkey rsa:4096 -keyout kibana.key -out kibana.crt
+```
+
+Or, to create a Certificate Signing Request (CSR) for a CA, run:
+
+```bash
+openssl req -newkey rsa:4096-nodes -keyout kibana.key -out kibana.csr
+```
+
+Fill in the prompts. Watch out for Common Name (e.g. server FQDN or YOUR
+domain name), which is the IP address or domain name that you will be hosting
+Kibana on. it is the most important field.
+
+If you generated a CSR, remove the CSR after you have your certs
+
+```bash
+rm -f kibana.csr
+```
+
+Move the keys into place and secure them:
+
+```bash
+cd
+sudo mv ssl /etc/nginx
+sudo chown -R root:www-data /etc/nginx/ssl
+sudo chmod -R u=rX,g=rX,o= /etc/nginx/ssl
+```
+
+Disable the default nginx configuration:
+
+```bash
+sudo rm /etc/nginx/sites-enabled/default
+```
+
+Create the web server configuration
+
+```bash
+sudo nano /etc/nginx/sites-available/kibana
+```
+
+```nginx
+server {
+    listen 443 ssl http2;
+    ssl_certificate /etc/nginx/ssl/kibana.crt;
+    ssl_certificate_key /etc/nginx/ssl/kibana.key;
+    ssl_session_timeout 1d;
+    ssl_session_cache shared:SSL:50m;
+    ssl_session_tickets off;
+
+
+    # modern configuration. tweak to your needs.
+    ssl_protocols TLSv1.2;
+    ssl_ciphers 'ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256';
+    ssl_prefer_server_ciphers on;
+
+    # Uncomment this next line if you are using a signed, trusted cert
+    #add_header Strict-Transport-Security "max-age=63072000; includeSubdomains; preload";
+    add_header X-Frame-Options SAMEORIGIN;
+    add_header X-Content-Type-Options nosniff;
+    auth_basic "Login required";
+    auth_basic_user_file /etc/nginx/htpasswd;
+
+    location / {
+        proxy_pass http://127.0.0.1:5601;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+    }
+}
+
+server {
+    listen 80;
+    return 301 https://$host$request_uri;
+}
+```
+
+Enable the nginx configuration for Kibana:
+
+```bash
+sudo ln -s /etc/nginx/sites-available/kibana /etc/nginx/sites-enabled/kibana
+```
+
+Add a user to basic authentication:
+
+```bash
+sudo htpasswd -c /etc/nginx/htpasswd exampleuser
+```
+
+Where `exampleuser` is the name of the user you want to add.
+
+Secure the permissions of the httpasswd file:
+
+```bash
+sudo chown root:www-data /etc/nginx/htpasswd
+sudo chmod u=rw,g=r,o= /etc/nginx/htpasswd
+```
+
+Restart nginx:
+
+```bash
+sudo service nginx restart
+```
+
+Now that Elasticsearch is up and running, use `parsedmarc` to send data to
+it.
+
+Download (right click the link and click save as) [export.ndjson].
+
+Import `export.ndjson` the Saved Objects tab of the Stack management
+page of Kibana.
+
+It will give you the option to overwrite existing saved dashboards or
+visualizations, which could be used to restore them if you or someone else
+breaks them, as there are no permissions/access controls in Kibana without
+the commercial [X-Pack].
+
+```{image} _static/screenshots/saved-objects.png
+:align: center
+:alt: A screenshot of setting the Saved Objects Stack management UI in Kibana
+:target: _static/screenshots/saved-objects.png
+```
+
+```{image} _static/screenshots/confirm-overwrite.png
+:align: center
+:alt: A screenshot of the overwrite conformation prompt
+:target: _static/screenshots/confirm-overwrite.png
+```
+
+#### Upgrading Kibana index patterns
+
+`parsedmarc` 5.0.0 makes some changes to the way data is indexed in
+Elasticsearch. if you are upgrading from a previous release of
+`parsedmarc`, you need to complete the following steps to replace the
+Kibana index patterns with versions that match the upgraded indexes:
+
+1. Login in to Kibana, and click on Management
+2. Under Kibana, click on Saved Objects
+3. Check the checkboxes for the `dmarc_aggregate` and `dmarc_forensic`
+   index patterns
+4. Click Delete
+5. Click Delete on the conformation message
+6. Download (right click the link and click save as)
+   the latest version of [export.ndjson]
+7. Import `export.ndjson` by clicking Import from the Kibana
+   Saved Objects page
+
+#### Records retention
+
+Starting in version 5.0.0, `parsedmarc` stores data in a separate
+index for each day to make it easy to comply with records
+retention regulations such as GDPR. For fore information,
+check out the Elastic guide to [managing time-based indexes efficiently](https://www.elastic.co/blog/managing-time-based-indices-efficiently).
+
+### Splunk
+
+Starting in version 4.3.0 `parsedmarc` supports sending aggregate and/or
+forensic DMARC data to a Splunk [HTTP Event collector (HEC)].
+
+The project repository contains [XML files] for premade Splunk dashboards for
+aggregate and forensic DMARC reports.
+
+Copy and paste the contents of each file into a separate Splunk dashboard XML
+editor.
+
+:::{warning}
+Change all occurrences of `index="email"` in the XML to
+match your own index name.
+:::
+
+The Splunk dashboards display the same content and layout as the Kibana
+dashboards, although the Kibana dashboards have slightly easier and more
+flexible filtering options.
+
+### Running parsedmarc as a systemd service
+
+Use systemd to run `parsedmarc` as a service and process reports as they
+arrive.
+
+Protect the `parsedmarc` configuration file from prying eyes
+
+```bash
+sudo chown root:parsedmarc /etc/parsedmarc.ini
+sudo chmod u=rw,g=r,o= /etc/parsedmarc.ini
+```
+
+Create the service configuration file
+
+```bash
+sudo nano /etc/systemd/system/parsedmarc.service
+```
+
+```ini
+[Unit]
+Description=parsedmarc mailbox watcher
+Documentation=https://domainaware.github.io/parsedmarc/
+Wants=network-online.target
+After=network.target network-online.target elasticsearch.service
+
+[Service]
+ExecStart=/opt/parsedmarc/venv/bin/parsedmarc -c /etc/parsedmarc.ini
+User=parsedmarc
+Group=parsedmarc
+Restart=always
+RestartSec=5m
+
+[Install]
+WantedBy=multi-user.target
+```
+
+Then, enable the service
+
+```bash
+sudo systemctl daemon-reload
+sudo systemctl enable parsedmarc.service
+sudo service parsedmarc restart
+```
+
+:::{note}
+You must also run the above commands whenever you edit
+`parsedmarc.service`.
+:::
+
+:::{warning}
+Always restart the service every time you upgrade to a new version of
+`parsedmarc`:
+
+```bash
+sudo service parsedmarc restart
+```
+
+:::
+
+To check the status of the service, run:
+
+```bash
+service parsedmarc status
+```
+
+:::{note}
+In the event of a crash, systemd will restart the service after 10 minutes,
+but the `service parsedmarc status` command will only show the logs for the
+current process. To vew the logs for previous runs as well as the
+current process (newest to oldest), run:
+
+```bash
+journalctl -u parsedmarc.service -r
+```
+
+:::
+
+## Using the Kibana dashboards
+
+The Kibana DMARC dashboards are a human-friendly way to understand the results
+from incoming DMARC reports.
+
+:::{note}
+The default dashboard is DMARC Summary. To switch between dashboards,
+click on the Dashboard link in the left side menu of Kibana.
+:::
+
+### DMARC Summary
+
+As the name suggests, this dashboard is the best place to start reviewing your
+aggregate DMARC data.
+
+Across the top of the dashboard, three pie charts display the percentage of
+alignment pass/fail for SPF, DKIM, and DMARC. Clicking on any chart segment
+will filter for that value.
+
+:::{note}
+Messages should not be considered malicious just because they failed to pass
+DMARC; especially if you have just started collecting data. It may be a
+legitimate service that needs SPF and DKIM configured correctly.
+:::
+
+Start by filtering the results to only show failed DKIM alignment. While DMARC
+passes if a message passes SPF or DKIM alignment, only DKIM alignment remains
+valid when a message is forwarded without changing the from address, which is
+often caused by a mailbox forwarding rule. This is because DKIM signatures are
+part of the message headers, whereas SPF relies on SMTP session headers.
+
+Underneath the pie charts. you can see graphs of DMARC passage and message
+disposition over time.
+
+Under the graphs you will find the most useful data tables on the dashboard. On
+the left, there is a list of organizations that are sending you DMARC reports.
+In the center, there is a list of sending servers grouped by the base domain
+in their reverse DNS. On the right, there is a list of email from domains,
+sorted by message volume.
+
+By hovering your mouse over a data table value and using the magnifying glass
+icons, you can filter on our filter out different values. Start by looking at
+the Message Sources by Reverse DNS table. Find a sender that you recognize,
+such as an email marketing service, hover over it, and click on the plus (+)
+magnifying glass icon, to add a filter that only shows results for that sender.
+Now, look at the Message From Header table to the right. That shows you the
+domains that a sender is sending as, which might tell you which brand/business
+is using a particular service. With that information, you can contact them and
+have them set up DKIM.
+
+:::{note}
+If you have a lot of B2C customers, you may see a high volume of emails as
+your domains coming from consumer email services, such as Google/Gmail and
+Yahoo! This occurs when customers have mailbox rules in place that forward
+emails from an old account to a new account, which is why DKIM
+authentication is so important, as mentioned earlier. Similar patterns may
+be observed with businesses who send from reverse DNS addressees of
+parent, subsidiary, and outdated brands.
+:::
+
+Further down the dashboard, you can filter by source country or source IP
+address.
+
+Tables showing SPF and DKIM alignment details are located under the IP address
+table.
+
+:::{note}
+Previously, the alignment tables were included in a separate dashboard
+called DMARC Alignment Failures. That dashboard has been consolidated into
+the DMARC Summary dashboard. To view failures only, use the pie chart.
+:::
+
+Any other filters work the same way. You can also add your own custom temporary
+filters by clicking on Add Filter at the upper right of the page.
+
+### DMARC Forensic Samples
+
+The DMARC Forensic Samples dashboard contains information on DMARC forensic
+reports (also known as failure reports or ruf reports). These reports contain
+samples of emails that have failed to pass DMARC.
+
+:::{note}
+Most recipients do not send forensic/failure/ruf reports at all to avoid
+privacy leaks. Some recipients (notably Chinese webmail services) will only
+supply the headers of sample emails. Very few provide the entire email.
+:::
+
+## DMARC Alignment Guide
+
+DMARC ensures that SPF and DKM authentication mechanisms actually authenticate
+against the same domain that the end user sees.
+
+A message passes a DMARC check by passing DKIM or SPF, **as long as the related
+indicators are also in alignment**.
+
+```{eval-rst}
++-----------------------+-----------------------+-----------------------+
+|                       | **DKIM**              | **SPF**               |
++-----------------------+-----------------------+-----------------------+
+| **Passing**           | The signature in the  | The mail server's IP  |
+|                       | DKIM header is        | address is listed in  |
+|                       | validated using a     | the SPF record of the |
+|                       | public key that is    | domain in the SMTP    |
+|                       | published as a DNS    | envelope's mail from  |
+|                       | record of the domain  | header                |
+|                       | name specified in the |                       |
+|                       | signature             |                       |
++-----------------------+-----------------------+-----------------------+
+| **Alignment**         | The signing domain    | The domain in the     |
+|                       | aligns with the       | SMTP envelope's mail  |
+|                       | domain in the         | from header aligns    |
+|                       | message's from header | with the domain in    |
+|                       |                       | the message's from    |
+|                       |                       | header                |
++-----------------------+-----------------------+-----------------------+
+```
+
+## What if a sender won't support DKIM/DMARC?
+
+1. Some vendors don't know about DMARC yet; ask about SPF and DKIM/email
+   authentication.
+2. Check if they can send through your email relays instead of theirs.
+3. Do they really need to spoof your domain? Why not use the display
+   name instead?
+4. Worst case, have that vendor send email as a specific subdomain of
+   your domain (e.g. `noreply@news.example.com`), and then create
+   separate SPF and DMARC records on `news.example.com`, and set
+   `p=none` in that DMARC record.
+
+:::{warning}
+Do not alter the `p` or `sp` values of the DMARC record on the
+Top-Level Domain (TLD) – that would leave you vulnerable to
+spoofing of your TLD and/or any subdomain.
+:::
+
+## What about mailing lists?
+
+When you deploy DMARC on your domain, you might find that messages
+relayed by mailing lists are failing DMARC, most likely because the mailing
+list is spoofing your from address, and modifying the subject,
+footer, or other part of the message, thereby breaking the
+DKIM signature.
+
+### Mailing list list best practices
+
+Ideally, a mailing list should forward messages without altering the
+headers or body content at all. [Joe Nelson] does a fantastic job of
+explaining exactly what mailing lists should and shouldn't do to be
+fully DMARC compliant. Rather than repeat his fine work, here's a
+summary:
+
+#### Do
+
+- Retain headers from the original message
+
+- Add [RFC 2369] List-Unsubscribe headers to outgoing messages, instead of
+  adding unsubscribe links to the body
+
+> List-Unsubscribe: <https://list.example.com/unsubscribe-link>
+
+- Add [RFC 2919] List-Id headers instead of modifying the subject
+
+  > List-Id: Example Mailing List <list.example.com>
+
+Modern mail clients and webmail services generate unsubscribe buttons based on
+these headers.
+
+#### Do not
+
+- Remove or modify any existing headers from the original message, including
+  From, Date, Subject, etc.
+- Add to or remove content from the message body, **including traditional
+  disclaimers and unsubscribe footers**
+
+In addition to complying with DMARC, this configuration ensures that Reply
+and Reply All actions work like they would with any email message. Reply
+replies to the message sender, and Reply All replies to the sender and the
+list.
+
+Even without a subject prefix or body footer, mailing list users can still
+tell that a message came from the mailing list, because the message was sent
+to the mailing list post address, and not their email address.
+
+Configuration steps for common mailing list platforms are listed below.
+
+#### Mailman 2
+
+Navigate to General Settings, and configure the settings below
+
+```{eval-rst}
+============================ ==========
+**Setting**                  **Value**
+**subject_prefix**
+**from_is_list**             No
+**first_strip_reply_to**     No
+**reply_goes_to_list**       Poster
+**include_rfc2369_headers**  Yes
+**include_list_post_header** Yes
+**include_sender_header**    No
+============================ ==========
+```
+
+Navigate to Non-digest options, and configure the settings below
+
+```{eval-rst}
+=================== ==========
+**Setting**         **Value**
+**msg_header**
+**msg_footer**
+**scrub_nondigest**  No
+=================== ==========
+```
+
+Navigate to Privacy Options> Sending Filters, and configure the settings below
+
+```{eval-rst}
+====================================== ==========
+**Setting**                            **Value**
+**dmarc_moderation_action**            Accept
+**dmarc_quarantine_moderation_action** Yes
+**dmarc_none_moderation_action**       Yes
+====================================== ==========
+```
+
+#### Mailman 3
+
+Navigate to Settings> List Identity
+
+Make Subject prefix blank.
+
+Navigate to Settings> Alter Messages
+
+Configure the settings below
+
+```{eval-rst}
+====================================== ==========
+**Setting**                            **Value**
+**Convert html to plaintext**          No
+**Include RFC2369 headers**            Yes
+**Include the list post header**       Yes
+**Explicit reply-to address**
+**First strip replyto**                 No
+**Reply goes to list**                 No munging
+====================================== ==========
+```
+
+Navigate to Settings> DMARC Mitigation
+
+Configure the settings below
+
+```{eval-rst}
+================================== ===============================
+**Setting**                            **Value**
+**DMARC mitigation action**            No DMARC mitigations
+**DMARC mitigate unconditionally** No
+================================== ===============================
+```
+
+Create a blank footer template for your mailing list to remove the message
+footer. Unfortunately, the Postorius mailing list admin UI will not allow you
+to create an empty template, so you'll have to create one using the system's
+command line instead, for example:
+
+```bash
+touch var/templates/lists/list.example.com/en/list:member:regular:footer
+```
+
+Where `list.example.com` the list ID, and `en` is the language.
+
+Then restart mailman core.
+
+### Workarounds
+
+If a mailing list must go **against** best practices and
+modify the message (e.g. to add a required legal footer), the mailing
+list administrator must configure the list to replace the From address of the
+message (also known as munging) with the address of the mailing list, so they
+no longer spoof email addresses with domains protected by DMARC.
+
+Configuration steps for common mailing list platforms are listed below.
+
+#### Mailman 2
+
+Navigate to Privacy Options> Sending Filters, and configure the settings below
+
+```{eval-rst}
+====================================== ==========
+**Setting**                            **Value**
+**dmarc_moderation_action**            Munge From
+**dmarc_quarantine_moderation_action** Yes
+**dmarc_none_moderation_action**       Yes
+====================================== ==========
+```
+
+:::{note}
+Message wrapping could be used as the DMARC mitigation action instead. In
+that case, the original message is added as an attachment to the mailing
+list message, but that could interfere with inbox searching, or mobile
+clients.
+
+On the other hand, replacing the From address might cause users to
+accidentally reply to the entire list, when they only intended to reply to
+the original sender.
+
+Choose the option that best fits your community.
+:::
+
+#### Mailman 3
+
+In the DMARC Mitigations tab of the Settings page, configure the settings below
+
+```{eval-rst}
+================================== ===============================
+**Setting**                            **Value**
+**DMARC mitigation action**            Replace From: with list address
+**DMARC mitigate unconditionally** No
+================================== ===============================
+```
+
+:::{note}
+Message wrapping could be used as the DMARC mitigation action instead. In
+that case, the original message is added as an attachment to the mailing
+list message, but that could interfere with inbox searching, or mobile
+clients.
+
+On the other hand, replacing the From address might cause users to
+accidentally reply to the entire list, when they only intended to reply to
+the original sender.
+:::
+
+#### LISTSERV
+
+[LISTSERV 16.0-2017a] and higher will rewrite the From header for domains
+that enforce with a DMARC quarantine or reject policy.
+
+Some additional steps are needed for Linux hosts.
+
+## API
+
+```{eval-rst}
+.. automodule:: parsedmarc
+   :members:
+```
+
+### parsedmarc.elastic
+
+```{eval-rst}
+.. automodule:: parsedmarc.elastic
+   :members:
+```
+
+```{toctree}
+:caption: 'Contents:'
+:maxdepth: 2
+```
+
+### parsedmarc.splunk
+
+```{eval-rst}
+.. automodule:: parsedmarc.splunk
+   :members:
+```
+
+```{toctree}
+:caption: 'Contents:'
+:maxdepth: 2
+```
+
+### parsedmarc.utils
+
+```{eval-rst}
+.. automodule:: parsedmarc.utils
+   :members:
+```
+
+```{toctree}
+:caption: 'Contents:'
+:maxdepth: 2
+```
+
+## Indices and tables
+
+- {ref}`genindex`
+- {ref}`modindex`
+- {ref}`search`
+
+[cloudflare's public resolvers]: https://1.1.1.1/
+[contributors]: https://github.com/domainaware/parsedmarc/graphs/contributors
+[creative commons attribution 4.0 international license]: https://creativecommons.org/licenses/by/4.0/
+[demystifying dmarc]: https://seanthegeek.net/459/demystifying-dmarc/
+[elasticsearch]: https://www.elastic.co/guide/en/elasticsearch/reference/current/rpm.html
+[export.ndjson]: https://raw.githubusercontent.com/domainaware/parsedmarc/master/kibana/export.ndjson
+[geoipupdate]: https://github.com/maxmind/geoipupdate
+[geoipupdate releases page on github]: https://github.com/maxmind/geoipupdate/releases
+[http event collector (hec)]: http://docs.splunk.com/Documentation/Splunk/latest/Data/AboutHEC
+[ip to country lite database]: https://db-ip.com/db/download/ip-to-country-lite
+[issues]: https://github.com/domainaware/parsedmarc/issues
+[joe nelson]: https://begriffs.com/posts/2018-09-18-dmarc-mailing-list.html
+[kibana]: https://www.elastic.co/guide/en/kibana/current/rpm.html
+[license keys]: https://www.maxmind.com/en/accounts/current/license-key
+[listserv 16.0-2017a]: https://www.lsoft.com/news/dmarc-issue1-2018.asp
+[maxmind geoipupdate page]: https://dev.maxmind.com/geoip/geoipupdate/
+[maxmind geolite2 country database]: https://dev.maxmind.com/geoip/geolite2-free-geolocation-data
+[modern auth/multi-factor authentication]: http://davmail.sourceforge.net/faq.html
+[pypy3]: https://www.pypy.org/download.html
+[readonlyrest]: https://readonlyrest.com/
+[registering for a free geolite2 account]: https://www.maxmind.com/en/geolite2/signup
+[rfc 2369]: https://tools.ietf.org/html/rfc2369
+[rfc 2919]: https://tools.ietf.org/html/rfc2919
+[to comply with various privacy regulations]: https://blog.maxmind.com/2019/12/18/significant-changes-to-accessing-and-using-geolite2-databases/
+[url encoded]: https://en.wikipedia.org/wiki/Percent-encoding#Percent-encoding_reserved_characters
+[x-pack]: https://www.elastic.co/products/x-pack
+[xml files]: https://github.com/domainaware/parsedmarc/tree/master/splunk
diff --git a/_sources/index.rst.txt b/_sources/index.rst.txt
index f7b49e3..88fced3 100644
--- a/_sources/index.rst.txt
+++ b/_sources/index.rst.txt
@@ -69,7 +69,7 @@ lookalike domain monitoring, check out `DomainAware <https://github.com/seantheg
 CLI help
 ========
 
-::
+.. code-block:: text
 
    usage: parsedmarc [-h] [-c CONFIG_FILE] [--strip-attachment-payloads] [-o OUTPUT]
                       [--aggregate-json-filename AGGREGATE_JSON_FILENAME]
@@ -117,7 +117,8 @@ CLI help
 
 .. note::
 
-   Starting in ``parsedmarc`` 6.0.0, most CLI options were moved to a configuration file, described below.
+   Starting in ``parsedmarc`` 6.0.0, most CLI options were moved to a
+   configuration file, described below.
 
 Configuration file
 ==================
@@ -170,78 +171,124 @@ The full set of configuration options are:
 
 
 - ``general``
-    - ``save_aggregate`` - bool: Save aggregate report data to Elasticsearch, Splunk and/or S3
-    - ``save_forensic`` - bool: Save forensic report data to Elasticsearch, Splunk and/or S3
-    - ``strip_attachment_payloads`` - bool: Remove attachment payloads from results
+    - ``save_aggregate`` - bool: Save aggregate report data to
+      Elasticsearch, Splunk and/or S3
+    - ``save_forensic`` - bool: Save forensic report data to
+      Elasticsearch, Splunk and/or S3
+    - ``strip_attachment_payloads`` - bool: Remove attachment
+      payloads from results
     - ``output`` - str: Directory to place JSON and CSV files in
-    - ``aggregate_json_filename`` - str: filename for the aggregate JSON output file
-    - ``forensic_json_filename`` - str: filename for the forensic JSON output file
-    - ``ip_db_path`` - str: An optional custom path to a MMDB file from MaxMind or DBIP
-    - ``offline`` - bool: Do not use online queries for geolocation or DNS
-    - ``nameservers`` -  str: A comma separated list of DNS resolvers (Default: `Cloudflare's public resolvers`_)
+    - ``aggregate_json_filename`` - str: filename for the aggregate
+      JSON output file
+    - ``forensic_json_filename`` - str: filename for the forensic
+      JSON output file
+    - ``ip_db_path`` - str: An optional custom path to a MMDB file
+    -   from MaxMind or DBIP
+    - ``offline`` - bool: Do not use online queries for geolocation
+      or DNS
+    - ``nameservers`` -  str: A comma separated list of
+      DNS resolvers (Default: `Cloudflare's public resolvers`_)
     - ``dns_timeout`` - float: DNS timeout period
     - ``debug`` - bool: Print debugging messages
     - ``silent`` - bool: Only print errors (Default: True)
     - ``log_file`` - str: Write log messages to a file at this path
-    - ``n_procs`` - int: Number of process to run in parallel when parsing in CLI mode (Default: 1)
-    - ``chunk_size`` - int: Number of files to give to each process when running in parallel.
+    - ``n_procs`` - int: Number of process to run in parallel when
+      parsing in CLI mode (Default: 1)
+    - ``chunk_size`` - int: Number of files to give to each process
+      when running in parallel.
 
     .. note::
-        Setting this to a number larger than one can improve performance when processing thousands of files
+        Setting this to a number larger than one can improve
+        performance when processing thousands of files
 
 - ``mailbox``
-    - ``reports_folder`` - str: The mailbox folder (or label for Gmail) where the incoming reports can be found (Default: INBOX)
-    - ``archive_folder`` - str:  The mailbox folder (or label for Gmail) to sort processed emails into (Default: Archive)
-    - ``watch`` - bool: Use the IMAP ``IDLE`` command to process messages as they arrive or poll MS Graph for new messages
-    - ``delete`` - bool: Delete messages after processing them, instead of archiving them
+    - ``reports_folder`` - str: The mailbox folder (or label for
+      Gmail) where the incoming reports can be found (Default: INBOX)
+    - ``archive_folder`` - str:  The mailbox folder (or label for
+      Gmail) to sort processed emails into (Default: Archive)
+    - ``watch`` - bool: Use the IMAP ``IDLE`` command to process
+    -   messages as they arrive or poll MS Graph for new messages
+    - ``delete`` - bool: Delete messages after processing them,
+    -   instead of archiving them
     - ``test`` - bool: Do not move or delete messages
-    - ``batch_size`` - int: Number of messages to read and process before saving. Default 10. Use 0 for no limit.
+    - ``batch_size`` - int: Number of messages to read and process
+      before saving. Default 10. Use 0 for no limit.
+    - ``check_timeout`` - int: Number of seconds to wait for a IMAP
+      IDLE response or the number of seconds until the next mai
+      check (Default: 30)
 
 - ``imap``
     - ``host`` - str: The IMAP server hostname or IP address
     - ``port`` - int: The IMAP server port (Default: 993)
 
     .. note::
-      ``%`` characters must be escaped with another ``%`` character, so use ``%%`` wherever a ``%`` character is used.
+      ``%`` characters must be escaped with another ``%`` character,
+      so use ``%%`` wherever a ``%`` character is used.
 
     .. note::
-      Starting in version 8.0.0, most options from the ``imap`` section have been moved to the ``mailbox`` section.
+      Starting in version 8.0.0, most options from the ``imap``
+      section have been moved to the ``mailbox`` section.
 
     .. note::
         If your host recommends another port, still try 993
 
-    - ``ssl`` - bool: Use an encrypted SSL/TLS connection (Default: True)
-    - ``skip_certificate_verification`` - bool: Skip certificate verification (not recommended)
+    - ``ssl`` - bool: Use an encrypted SSL/TLS connection
+      (Default: True)
+    - ``skip_certificate_verification`` - bool: Skip certificate
+      verification (not recommended)
     - ``user`` - str: The IMAP user
     - ``password`` - str: The IMAP password
 
 - ``msgraph``
-    - ``auth_method`` - str: Authentication method, valid types are UsernamePassword, DeviceCode, or ClientSecret (Default: UsernamePassword).
-    - ``user`` - str: The M365 user, required when the auth method is UsernamePassword
-    - ``password`` - str: The user password, required when the auth method is UsernamePassword
+    - ``auth_method`` - str: Authentication method, valid types are
+      UsernamePassword, DeviceCode, or ClientSecret
+      (Default: UsernamePassword).
+    - ``user`` - str: The M365 user, required when the auth method is
+      UsernamePassword
+    - ``password`` - str: The user password, required when the auth
+      method is UsernamePassword
     - ``client_id`` - str: The app registration's client ID
     - ``client_secret`` - str: The app registration's secret
-    - ``tenant_id`` - str: The Azure AD tenant ID. This is required for all auth methods except UsernamePassword.
-    - ``mailbox`` - str: The mailbox name. This defaults to the current user if using the UsernamePassword auth method, but could be a shared mailbox if the user has access to the mailbox
+    - ``tenant_id`` - str: The Azure AD tenant ID. This is required
+      for all auth methods except UsernamePassword.
+    - ``mailbox`` - str: The mailbox name. This defaults to the
+      current user if using the UsernamePassword auth method, but
+      could be a shared mailbox if the user has access to the mailbox
+    - ``token_file`` - str: Path to save the token file
+      (Default: .token)
 
     .. note::
-        You must create an app registration in Azure AD and have an admin grant the Microsoft Graph ``Mail.ReadWrite`` (delegated) permission to the app.
-        If you are using `UsernamePassword` auth and the mailbox is different from the username, you must grant the app ``Mail.ReadWrite.Shared``.
+        You must create an app registration in Azure AD and have an
+        admin grant the Microsoft Graph ``Mail.ReadWrite``
+        (delegated) permission to the app. If you are using
+        `UsernamePassword` auth and the mailbox is different from the
+        username, you must grant the app ``Mail.ReadWrite.Shared``.
 
     .. warning::
-        If you are using the `ClientSecret` auth method, you need to grant the ``Mail.ReadWrite`` (application) permission to the app.
-        You must also restrict the application's access to a specific mailbox since it allows all mailboxes by default.
-        Use the ``New-ApplicationAccessPolicy`` command in the Exchange PowerShell module.
-        If you need to scope the policy to shared mailboxes, you can add them to a mail enabled security group and use that as the group id.
+        If you are using the `ClientSecret` auth method, you need to
+        grant the ``Mail.ReadWrite`` (application) permission to the
+        app. You must also restrict the application's access to a
+        specific mailbox since it allows all mailboxes by default.
+        Use the ``New-ApplicationAccessPolicy`` command in the
+        Exchange PowerShell module. If you need to scope the policy to
+        shared mailboxes, you can add them to a mail enabled security
+        group and use that as the group id.
 
-        ``New-ApplicationAccessPolicy -AccessRight RestrictAccess -AppId "<CLIENT_ID>" -PolicyScopeGroupId "<MAILBOX>" -Description "Restrict access to dmarc reports mailbox."``
+        .. code-block:: powershell
+
+          New-ApplicationAccessPolicy -AccessRight RestrictAccess
+          -AppId "<CLIENT_ID>" -PolicyScopeGroupId "<MAILBOX>"
+          -Description "Restrict access to dmarc reports mailbox."
 
 
 - ``elasticsearch``
-    - ``hosts`` - str: A comma separated list of hostnames and ports or URLs (e.g. ``127.0.0.1:9200`` or ``https://user:secret@localhost``)
+    - ``hosts`` - str: A comma separated list of hostnames and ports
+      or URLs (e.g. ``127.0.0.1:9200`` or
+      ``https://user:secret@localhost``)
 
     .. note::
-         Special characters in the username or password must be `URL encoded`_.
+         Special characters in the username or password must be
+         `URL encoded`_.
 
     - ``ssl`` - bool: Use an encrypted SSL/TLS connection (Default: True)
     - ``cert_path`` - str: Path to a trusted certificates
@@ -253,30 +300,36 @@ The full set of configuration options are:
     - ``url`` - str: The URL of the Splunk HTTP Events Collector (HEC)
     - ``token`` - str: The HEC token
     - ``index`` - str: The Splunk index to use
-    - ``skip_certificate_verification`` - bool: Skip certificate verification (not recommended)
+    - ``skip_certificate_verification`` - bool: Skip certificate
+      verification (not recommended)
 - ``kafka``
     - ``hosts`` - str: A comma separated list of Kafka hosts
     - ``user`` - str: The Kafka user
     - ``passsword`` - str: The Kafka password
     - ``ssl`` - bool: Use an encrypted SSL/TLS connection (Default: True)
-    - ``skip_certificate_verification`` - bool: Skip certificate verification (not recommended)
+    - ``skip_certificate_verification`` - bool: Skip certificate
+      verification (not recommended)
     - ``aggregate_topic`` - str: The Kafka topic for aggregate reports
     - ``forensic_topic`` - str: The Kafka topic for forensic reports
 - ``smtp``
     - ``host`` - str: The SMTP hostname
     - ``port`` - int: The SMTP port (Default: 25)
     - ``ssl`` - bool: Require SSL/TLS instead of using STARTTLS
-    - ``skip_certificate_verification`` - bool: Skip certificate verification (not recommended)
+    - ``skip_certificate_verification`` - bool: Skip certificate
+      verification (not recommended)
     - ``user`` - str: the SMTP username
     - ``password`` - str: the SMTP password
     - ``from`` - str: The From header to use in the email
     - ``to`` - list: A list of email addresses to send to
-    - ``subject`` - str: The Subject header to use in the email (Default: parsedmarc report)
+    - ``subject`` - str: The Subject header to use in the email
+      (Default: parsedmarc report)
     - ``attachment`` - str: The ZIP attachment filenames
-    - ``message`` - str: The email message (Default: Please see the attached parsedmarc report.)
+    - ``message`` - str: The email message
+      (Default: Please see the attached parsedmarc report.)
 
     .. note::
-      ``%`` characters must be escaped with another ``%`` character, so use ``%%`` wherever a ``%`` character is used.
+      ``%`` characters must be escaped with another ``%`` character,
+      so use ``%%`` wherever a ``%`` character is used.
 
 - ``s3``
     - ``bucket`` - str: The S3 bucket name
@@ -289,43 +342,52 @@ The full set of configuration options are:
     - ``server`` - str: The Syslog server name or IP address
     - ``port`` - int: The UDP port to use (Default: 514)
 - ``gmail_api``
-    - ``gmail_api_credentials_file`` - str: Path to file containing the credentials, None to disable (Default: None)
-    - ``gmail_api_token_file`` - str: Path to save the token file (Default: .token)
-    - ``gmail_api_include_spam_trash`` - bool: Include messages in Spam and Trash when searching reports (Default: False)
-    - ``gmail_api_scopes`` - str: Comma separated list of scopes to use when acquiring credentials (Default: https://www.googleapis.com/auth/gmail.modify)
+    - ``credentials_file`` - str: Path to file containing the
+      credentials, None to disable (Default: None)
+    - ``token_file`` - str: Path to save the token file
+      (Default: .token)
+    - ``include_spam_trash`` - bool: Include messages in Spam and
+      Trash when searching reports (Default: False)
+    - ``scopes`` - str: Comma separated list of scopes to use when
+      acquiring credentials (Default: https://www.googleapis.com/auth/gmail.modify)
+    - ``oauth2_port`` - int: The TCP port for the local server to
+      listen on for the OAuth2 response (Default: 8080)
 
 .. warning::
 
-    It is **strongly recommended** to **not** use the ``nameservers`` setting.
-    By default, ``parsedmarc`` uses `Cloudflare's public resolvers`_,
-    which are much faster and more reliable than Google, Cisco OpenDNS, or
-    even most local resolvers.
+    It is **strongly recommended** to **not** use the ``nameservers``
+    setting. By default, ``parsedmarc`` uses
+    `Cloudflare's public resolvers`_, which are much faster and more
+    reliable than Google, Cisco OpenDNS, or even most local resolvers.
 
-    The ``nameservers`` option should only be used if your network blocks DNS
-    requests to outside resolvers.
+    The ``nameservers`` option should only be used if your network
+    blocks DNS requests to outside resolvers.
 
 .. warning::
 
-   ``save_aggregate`` and ``save_forensic`` are separate options because
-   you may not want to save forensic reports (also known as failure reports)
-   to your Elasticsearch instance, particularly if you are in a
-   highly-regulated industry that handles sensitive data, such as healthcare
-   or finance. If your legitimate outgoing email fails DMARC, it is possible
+   ``save_aggregate`` and ``save_forensic`` are separate options
+   because you may not want to save forensic reports
+   (also known as failure reports) to your Elasticsearch instance,
+   particularly if you are in a highly-regulated industry that
+   handles sensitive data, such as healthcare or finance. If your
+   legitimate outgoing email fails DMARC, it is possible
    that email may appear later in a forensic report.
 
-   Forensic reports contain the original headers of an email that failed a
-   DMARC check, and sometimes may also include the full message body,
-   depending on the policy of the reporting organization.
+   Forensic reports contain the original headers of an email that
+   failed a DMARC check, and sometimes may also include the
+   full message body, depending on the policy of the reporting
+   organization.
 
-   Most reporting organizations do not send forensic reports of any kind for
-   privacy reasons. While aggregate DMARC reports are sent at least daily,
-   it is normal to receive very few forensic reports.
+   Most reporting organizations do not send forensic reports of any
+   kind for privacy reasons. While aggregate DMARC reports are sent
+   at least daily, it is normal to receive very few forensic reports.
 
-   An alternative approach is to still collect forensic/failure/ruf reports
-   in your DMARC inbox, but run ``parsedmarc`` with ``save_forensic = True``
-   manually on a separate IMAP folder (using the  ``reports_folder`` option),
-   after you have manually moved known samples you want to save to that
-   folder (e.g. malicious samples and non-sensitive legitimate samples).
+   An alternative approach is to still collect forensic/failure/ruf
+   reports in your DMARC inbox, but run ``parsedmarc`` with
+   ``save_forensic = True``manually on a separate IMAP folder (using
+   the  ``reports_folder`` option), after you have manually moved
+   known samples you want to save to that folder
+   (e.g. malicious samples and non-sensitive legitimate samples).
 
 
 Sample aggregate report output
@@ -337,8 +399,8 @@ report schema standardized in
 `RFC 7480 Appendix C <https://tools.ietf.org/html/rfc7489#appendix-C>`_.
 This draft schema is still in wide use.
 
-``parsedmarc`` produces consistent, normalized output, regardless of the report
-schema.
+``parsedmarc`` produces consistent, normalized output, regardless
+of the report schema.
 
 JSON
 ----
@@ -413,7 +475,7 @@ JSON
 CSV
 ---
 
-::
+.. code-block:: text
 
     xml_schema,org_name,org_email,org_extra_contact_info,report_id,begin_date,end_date,errors,domain,adkim,aspf,p,sp,pct,fo,source_ip_address,source_country,source_reverse_dns,source_base_domain,count,spf_aligned,dkim_aligned,dmarc_aligned,disposition,policy_override_reasons,policy_override_comments,envelope_from,header_from,envelope_to,dkim_domains,dkim_selectors,dkim_results,spf_domains,spf_scopes,spf_results
     draft,acme.com,noreply-dmarc-support@acme.com,http://acme.com/dmarc/support,9391651994964116463,2012-04-27 20:00:00,2012-04-28 19:59:59,,example.com,r,r,none,none,100,0,72.150.241.94,US,adsl-72-150-241-94.shv.bellsouth.net,bellsouth.net,2,True,False,True,none,,,example.com,example.com,,example.com,none,fail,example.com,mfrom,pass
@@ -521,7 +583,7 @@ JSON
 CSV
 ---
 
-::
+.. code-block:: text
 
     feedback_type,user_agent,version,original_envelope_id,original_mail_from,original_rcpt_to,arrival_date,arrival_date_utc,subject,message_id,authentication_results,dkim_domain,source_ip_address,source_country,source_reverse_dns,source_base_domain,delivery_result,auth_failure,reported_domain,authentication_mechanisms,sample_headers_only
     auth-failure,Lua/1.0,1.0,,sharepoint@domain.de,peter.pan@domain.de,"Mon, 01 Oct 2018 11:20:27 +0200",2018-10-01 09:20:27,Subject,<38.E7.30937.BD6E1BB5@ mailrelay.de>,"dmarc=fail (p=none, dis=none) header.from=domain.de",,10.10.10.10,,,,policy,dmarc,domain.de,,False
@@ -544,7 +606,7 @@ Installation
    to use that proxy. To do this, edit ``/etc/environment`` and add your
    proxy details there, for example:
 
-   ::
+   .. code-block:: bash
 
       http_proxy=http://user:password@prox-server:3128
       https_proxy=https://user:password@prox-server:3128
@@ -552,7 +614,7 @@ Installation
 
    Or if no credentials are needed:
 
-   ::
+   .. code-block:: bash
 
       http_proxy=http://prox-server:3128
       https_proxy=https://prox-server:3128
@@ -604,14 +666,17 @@ On CentOS or RHEL systems, run:
 
    sudo dnf install -y geoipupdate
 
-The latest builds for Linux, macOS, and Windows can be downloaded from the `geoipupdate releases page on GitHub`_.
+The latest builds for Linux, macOS, and Windows can be downloaded
+from the `geoipupdate releases page on GitHub`_.
 
-On December 30th, 2019, MaxMind started requiring free accounts to access the free Geolite2 databases, in order `to
+On December 30th, 2019, MaxMind started requiring free accounts to
+access the free Geolite2 databases, in order `to
 comply with various privacy regulations`_.
 
 Start by `registering for a free GeoLite2 account`_, and signing in.
 
-Then, navigate the to the `License Keys`_ page under your account, and create a new license key for the version of
+Then, navigate the to the `License Keys`_ page under your account,
+and create a new license key for the version of
 ``geoipupdate`` that was installed.
 
 .. warning::
@@ -629,9 +694,11 @@ Then, navigate the to the `License Keys`_ page under your account, and create a
 
 You can use ``parsedmarc`` as the description for the key.
 
-Once you have generated a key, download the config pre-filled configuration file.
-This file should be saved at ``/etc/GeoIP.conf`` on Linux or macOS systems, or at
-``%SystemDrive%\ProgramData\MaxMind\GeoIPUpdate\GeoIP.conf`` on Windows systems.
+Once you have generated a key, download the config pre-filled
+configuration file. This file should be saved at ``/etc/GeoIP.conf``
+on Linux or macOS systems, or at
+``%SystemDrive%\ProgramData\MaxMind\GeoIPUpdate\GeoIP.conf`` on
+Windows systems.
 
 Then run
 
@@ -641,10 +708,12 @@ Then run
 
 To download the databases for the first time.
 
-The GeoLite2 Country, City, and ASN databases are updated weekly, every Tuesday.
-``geoipupdate`` can be run weekly by adding a cron job or scheduled task.
+The GeoLite2 Country, City, and ASN databases are updated weekly,
+every Tuesday. ``geoipupdate`` can be run weekly by adding a cron
+job or scheduled task.
 
-More information about ``geoipupdate`` can be found at the `MaxMind geoipupdate page`_.
+More information about ``geoipupdate`` can be found at the
+`MaxMind geoipupdate page`_.
 
 Installing parsedmarc
 ---------------------
@@ -681,7 +750,8 @@ Install parsedmarc in a virtualenv
 
     sudo -u parsedmarc virtualenv /opt/parsedmarc/venv
 
-CentOS/RHEL 8 systems use Python 3.6 by default, so on those systems explicitly tell ``virtualenv`` to use ``python3.9`` instead
+CentOS/RHEL 8 systems use Python 3.6 by default, so on those systems
+explicitly tell ``virtualenv`` to use ``python3.9`` instead
 
 .. code-block:: bash
 
@@ -721,7 +791,7 @@ Accessing an inbox using OWA/EWS
    Starting in 8.0.0, parsedmarc supports accessing Microsoft/Office 365
    inboxes via the Microsoft Graph API, which is preferred over Davmail.
 
-Some organisations do not allow IMAP or the Microsoft Graph API,
+Some organizations do not allow IMAP or the Microsoft Graph API,
 and only support Exchange Web Services (EWS)/Outlook Web Access (OWA).
 In that case, Davmail will need to be set up
 as a local EWS/OWA IMAP gateway. It can even work where
@@ -963,7 +1033,8 @@ For CentOS, RHEL, and other RPM systems, follow the Elastic RPM guides for
     sudo service elasticsearch start
     sudo service kibana start
 
-Without the commercial X-Pack_ or ReadonlyREST_ products, Kibana does not have any authentication
+Without the commercial X-Pack_ or ReadonlyREST_ products, Kibana
+does not have any authentication
 mechanism of its own. You can use nginx as a reverse proxy that provides basic
 authentication.
 
@@ -1298,7 +1369,7 @@ is using a particular service. With that information, you can contact them and
 have them set up DKIM.
 
 .. note::
-  
+
     If you have a lot of B2C customers, you may see a high volume of emails as
     your domains coming from consumer email services, such as Google/Gmail and
     Yahoo! This occurs when customers have mailbox rules in place that forward
@@ -1383,24 +1454,26 @@ What if a sender won't support DKIM/DMARC?
 .. warning ::
 
   Do not alter the ``p`` or ``sp`` values of the DMARC record on the
-  Top-Level Domain (TLD) – that would leave you vulnerable to spoofing of
-  your TLD and/or any subdomain.
+  Top-Level Domain (TLD) – that would leave you vulnerable to
+  spoofing of your TLD and/or any subdomain.
 
 What about mailing lists?
 =========================
 
-When you deploy DMARC on your domain, you might find that messages relayed by
-mailing lists are failing DMARC, most likely because the mailing list is
-spoofing your from address, and modifying the subject, footer, or other part
-of the message, thereby breaking the DKIM signature.
+When you deploy DMARC on your domain, you might find that messages
+relayed by mailing lists are failing DMARC, most likely because the mailing
+list is spoofing your from address, and modifying the subject,
+footer, or other part of the message, thereby breaking the
+DKIM signature.
 
 Mailing list list best practices
 --------------------------------
 
-Ideally, a mailing list should forward messages without altering the headers
-or body content at all. `Joe Nelson`_ does a fantastic job of explaining exactly
-what mailing lists should and shouldn't do to be fully DMARC compliant.
-Rather than repeat his fine work, here's a summary:
+Ideally, a mailing list should forward messages without altering the
+headers or body content at all. `Joe Nelson`_ does a fantastic job of
+explaining exactly what mailing lists should and shouldn't do to be
+fully DMARC compliant. Rather than repeat his fine work, here's a
+summary:
 
 **Do**
 
@@ -1470,7 +1543,7 @@ Navigate to Privacy Options> Sending Filters, and configure the settings below
 ====================================== ==========
 **Setting**                            **Value**
 **dmarc_moderation_action**            Accept
-**dmarc_quarentine_moderation_action** Yes
+**dmarc_quarantine_moderation_action** Yes
 **dmarc_none_moderation_action**       Yes
 ====================================== ==========
 
@@ -1492,7 +1565,7 @@ Configure the settings below
 **Include RFC2369 headers**            Yes
 **Include the list post header**       Yes
 **Explicit reply-to address**
-**First strip replyo**                 No
+**First strip replyto**                 No
 **Reply goes to list**                 No munging
 ====================================== ==========
 
@@ -1538,7 +1611,7 @@ Navigate to Privacy Options> Sending Filters, and configure the settings below
 ====================================== ==========
 **Setting**                            **Value**
 **dmarc_moderation_action**            Munge From
-**dmarc_quarentine_moderation_action** Yes
+**dmarc_quarantine_moderation_action** Yes
 **dmarc_none_moderation_action**       Yes
 ====================================== ==========
 
diff --git a/_static/basic.css b/_static/basic.css
index 7d5974c..eeb0519 100644
--- a/_static/basic.css
+++ b/_static/basic.css
@@ -608,8 +608,6 @@ ol.simple p,
 ul.simple p {
     margin-bottom: 0;
 }
-
-/* Docutils 0.17 and older (footnotes & citations) */
 dl.footnote > dt,
 dl.citation > dt {
     float: left;
@@ -627,33 +625,6 @@ dl.citation > dd:after {
     clear: both;
 }
 
-/* Docutils 0.18+ (footnotes & citations) */
-aside.footnote > span,
-div.citation > span {
-    float: left;
-}
-aside.footnote > span:last-of-type,
-div.citation > span:last-of-type {
-  padding-right: 0.5em;
-}
-aside.footnote > p {
-  margin-left: 2em;
-}
-div.citation > p {
-  margin-left: 4em;
-}
-aside.footnote > p:last-of-type,
-div.citation > p:last-of-type {
-    margin-bottom: 0em;
-}
-aside.footnote > p:last-of-type:after,
-div.citation > p:last-of-type:after {
-    content: "";
-    clear: both;
-}
-
-/* Footnotes & citations ends */
-
 dl.field-list {
     display: grid;
     grid-template-columns: fit-content(30%) auto;
@@ -665,11 +636,11 @@ dl.field-list > dt {
     padding-left: 0.5em;
     padding-right: 5px;
 }
-
 dl.field-list > dt:after {
     content: ":";
 }
 
+
 dl.field-list > dd {
     padding-left: 0.5em;
     margin-top: 0em;
diff --git a/_static/documentation_options.js b/_static/documentation_options.js
index dc0a387..cd4f09b 100644
--- a/_static/documentation_options.js
+++ b/_static/documentation_options.js
@@ -1,6 +1,6 @@
 var DOCUMENTATION_OPTIONS = {
     URL_ROOT: document.getElementById("documentation_options").getAttribute('data-url_root'),
-    VERSION: '8.3.0',
+    VERSION: '8.3.1',
     LANGUAGE: 'en',
     COLLAPSE_INDEX: false,
     BUILDER: 'html',
@@ -10,5 +10,5 @@ var DOCUMENTATION_OPTIONS = {
     SOURCELINK_SUFFIX: '.txt',
     NAVIGATION_WITH_KEYS: false,
     SHOW_SEARCH_SUMMARY: true,
-    ENABLE_SEARCH_SHORTCUTS: false,
+    ENABLE_SEARCH_SHORTCUTS: true,
 };
\ No newline at end of file
diff --git a/_static/pygments.css b/_static/pygments.css
index 691aeb8..08bec68 100644
--- a/_static/pygments.css
+++ b/_static/pygments.css
@@ -4,71 +4,71 @@ span.linenos { color: inherit; background-color: transparent; padding-left: 5px;
 td.linenos .special { color: #000000; background-color: #ffffc0; padding-left: 5px; padding-right: 5px; }
 span.linenos.special { color: #000000; background-color: #ffffc0; padding-left: 5px; padding-right: 5px; }
 .highlight .hll { background-color: #ffffcc }
-.highlight { background: #eeffcc; }
-.highlight .c { color: #408090; font-style: italic } /* Comment */
+.highlight { background: #f8f8f8; }
+.highlight .c { color: #3D7B7B; font-style: italic } /* Comment */
 .highlight .err { border: 1px solid #FF0000 } /* Error */
-.highlight .k { color: #007020; font-weight: bold } /* Keyword */
+.highlight .k { color: #008000; font-weight: bold } /* Keyword */
 .highlight .o { color: #666666 } /* Operator */
-.highlight .ch { color: #408090; font-style: italic } /* Comment.Hashbang */
-.highlight .cm { color: #408090; font-style: italic } /* Comment.Multiline */
-.highlight .cp { color: #007020 } /* Comment.Preproc */
-.highlight .cpf { color: #408090; font-style: italic } /* Comment.PreprocFile */
-.highlight .c1 { color: #408090; font-style: italic } /* Comment.Single */
-.highlight .cs { color: #408090; background-color: #fff0f0 } /* Comment.Special */
+.highlight .ch { color: #3D7B7B; font-style: italic } /* Comment.Hashbang */
+.highlight .cm { color: #3D7B7B; font-style: italic } /* Comment.Multiline */
+.highlight .cp { color: #9C6500 } /* Comment.Preproc */
+.highlight .cpf { color: #3D7B7B; font-style: italic } /* Comment.PreprocFile */
+.highlight .c1 { color: #3D7B7B; font-style: italic } /* Comment.Single */
+.highlight .cs { color: #3D7B7B; font-style: italic } /* Comment.Special */
 .highlight .gd { color: #A00000 } /* Generic.Deleted */
 .highlight .ge { font-style: italic } /* Generic.Emph */
-.highlight .gr { color: #FF0000 } /* Generic.Error */
+.highlight .gr { color: #E40000 } /* Generic.Error */
 .highlight .gh { color: #000080; font-weight: bold } /* Generic.Heading */
-.highlight .gi { color: #00A000 } /* Generic.Inserted */
-.highlight .go { color: #333333 } /* Generic.Output */
-.highlight .gp { color: #c65d09; font-weight: bold } /* Generic.Prompt */
+.highlight .gi { color: #008400 } /* Generic.Inserted */
+.highlight .go { color: #717171 } /* Generic.Output */
+.highlight .gp { color: #000080; font-weight: bold } /* Generic.Prompt */
 .highlight .gs { font-weight: bold } /* Generic.Strong */
 .highlight .gu { color: #800080; font-weight: bold } /* Generic.Subheading */
 .highlight .gt { color: #0044DD } /* Generic.Traceback */
-.highlight .kc { color: #007020; font-weight: bold } /* Keyword.Constant */
-.highlight .kd { color: #007020; font-weight: bold } /* Keyword.Declaration */
-.highlight .kn { color: #007020; font-weight: bold } /* Keyword.Namespace */
-.highlight .kp { color: #007020 } /* Keyword.Pseudo */
-.highlight .kr { color: #007020; font-weight: bold } /* Keyword.Reserved */
-.highlight .kt { color: #902000 } /* Keyword.Type */
-.highlight .m { color: #208050 } /* Literal.Number */
-.highlight .s { color: #4070a0 } /* Literal.String */
-.highlight .na { color: #4070a0 } /* Name.Attribute */
-.highlight .nb { color: #007020 } /* Name.Builtin */
-.highlight .nc { color: #0e84b5; font-weight: bold } /* Name.Class */
-.highlight .no { color: #60add5 } /* Name.Constant */
-.highlight .nd { color: #555555; font-weight: bold } /* Name.Decorator */
-.highlight .ni { color: #d55537; font-weight: bold } /* Name.Entity */
-.highlight .ne { color: #007020 } /* Name.Exception */
-.highlight .nf { color: #06287e } /* Name.Function */
-.highlight .nl { color: #002070; font-weight: bold } /* Name.Label */
-.highlight .nn { color: #0e84b5; font-weight: bold } /* Name.Namespace */
-.highlight .nt { color: #062873; font-weight: bold } /* Name.Tag */
-.highlight .nv { color: #bb60d5 } /* Name.Variable */
-.highlight .ow { color: #007020; font-weight: bold } /* Operator.Word */
+.highlight .kc { color: #008000; font-weight: bold } /* Keyword.Constant */
+.highlight .kd { color: #008000; font-weight: bold } /* Keyword.Declaration */
+.highlight .kn { color: #008000; font-weight: bold } /* Keyword.Namespace */
+.highlight .kp { color: #008000 } /* Keyword.Pseudo */
+.highlight .kr { color: #008000; font-weight: bold } /* Keyword.Reserved */
+.highlight .kt { color: #B00040 } /* Keyword.Type */
+.highlight .m { color: #666666 } /* Literal.Number */
+.highlight .s { color: #BA2121 } /* Literal.String */
+.highlight .na { color: #687822 } /* Name.Attribute */
+.highlight .nb { color: #008000 } /* Name.Builtin */
+.highlight .nc { color: #0000FF; font-weight: bold } /* Name.Class */
+.highlight .no { color: #880000 } /* Name.Constant */
+.highlight .nd { color: #AA22FF } /* Name.Decorator */
+.highlight .ni { color: #717171; font-weight: bold } /* Name.Entity */
+.highlight .ne { color: #CB3F38; font-weight: bold } /* Name.Exception */
+.highlight .nf { color: #0000FF } /* Name.Function */
+.highlight .nl { color: #767600 } /* Name.Label */
+.highlight .nn { color: #0000FF; font-weight: bold } /* Name.Namespace */
+.highlight .nt { color: #008000; font-weight: bold } /* Name.Tag */
+.highlight .nv { color: #19177C } /* Name.Variable */
+.highlight .ow { color: #AA22FF; font-weight: bold } /* Operator.Word */
 .highlight .w { color: #bbbbbb } /* Text.Whitespace */
-.highlight .mb { color: #208050 } /* Literal.Number.Bin */
-.highlight .mf { color: #208050 } /* Literal.Number.Float */
-.highlight .mh { color: #208050 } /* Literal.Number.Hex */
-.highlight .mi { color: #208050 } /* Literal.Number.Integer */
-.highlight .mo { color: #208050 } /* Literal.Number.Oct */
-.highlight .sa { color: #4070a0 } /* Literal.String.Affix */
-.highlight .sb { color: #4070a0 } /* Literal.String.Backtick */
-.highlight .sc { color: #4070a0 } /* Literal.String.Char */
-.highlight .dl { color: #4070a0 } /* Literal.String.Delimiter */
-.highlight .sd { color: #4070a0; font-style: italic } /* Literal.String.Doc */
-.highlight .s2 { color: #4070a0 } /* Literal.String.Double */
-.highlight .se { color: #4070a0; font-weight: bold } /* Literal.String.Escape */
-.highlight .sh { color: #4070a0 } /* Literal.String.Heredoc */
-.highlight .si { color: #70a0d0; font-style: italic } /* Literal.String.Interpol */
-.highlight .sx { color: #c65d09 } /* Literal.String.Other */
-.highlight .sr { color: #235388 } /* Literal.String.Regex */
-.highlight .s1 { color: #4070a0 } /* Literal.String.Single */
-.highlight .ss { color: #517918 } /* Literal.String.Symbol */
-.highlight .bp { color: #007020 } /* Name.Builtin.Pseudo */
-.highlight .fm { color: #06287e } /* Name.Function.Magic */
-.highlight .vc { color: #bb60d5 } /* Name.Variable.Class */
-.highlight .vg { color: #bb60d5 } /* Name.Variable.Global */
-.highlight .vi { color: #bb60d5 } /* Name.Variable.Instance */
-.highlight .vm { color: #bb60d5 } /* Name.Variable.Magic */
-.highlight .il { color: #208050 } /* Literal.Number.Integer.Long */
\ No newline at end of file
+.highlight .mb { color: #666666 } /* Literal.Number.Bin */
+.highlight .mf { color: #666666 } /* Literal.Number.Float */
+.highlight .mh { color: #666666 } /* Literal.Number.Hex */
+.highlight .mi { color: #666666 } /* Literal.Number.Integer */
+.highlight .mo { color: #666666 } /* Literal.Number.Oct */
+.highlight .sa { color: #BA2121 } /* Literal.String.Affix */
+.highlight .sb { color: #BA2121 } /* Literal.String.Backtick */
+.highlight .sc { color: #BA2121 } /* Literal.String.Char */
+.highlight .dl { color: #BA2121 } /* Literal.String.Delimiter */
+.highlight .sd { color: #BA2121; font-style: italic } /* Literal.String.Doc */
+.highlight .s2 { color: #BA2121 } /* Literal.String.Double */
+.highlight .se { color: #AA5D1F; font-weight: bold } /* Literal.String.Escape */
+.highlight .sh { color: #BA2121 } /* Literal.String.Heredoc */
+.highlight .si { color: #A45A77; font-weight: bold } /* Literal.String.Interpol */
+.highlight .sx { color: #008000 } /* Literal.String.Other */
+.highlight .sr { color: #A45A77 } /* Literal.String.Regex */
+.highlight .s1 { color: #BA2121 } /* Literal.String.Single */
+.highlight .ss { color: #19177C } /* Literal.String.Symbol */
+.highlight .bp { color: #008000 } /* Name.Builtin.Pseudo */
+.highlight .fm { color: #0000FF } /* Name.Function.Magic */
+.highlight .vc { color: #19177C } /* Name.Variable.Class */
+.highlight .vg { color: #19177C } /* Name.Variable.Global */
+.highlight .vi { color: #19177C } /* Name.Variable.Instance */
+.highlight .vm { color: #19177C } /* Name.Variable.Magic */
+.highlight .il { color: #666666 } /* Literal.Number.Integer.Long */
\ No newline at end of file
diff --git a/_static/searchtools.js b/_static/searchtools.js
index ac4d586..f2fb7d5 100644
--- a/_static/searchtools.js
+++ b/_static/searchtools.js
@@ -88,7 +88,7 @@ const _displayItem = (item, highlightTerms, searchTerms) => {
   linkEl.href = linkUrl + "?" + params.toString() + anchor;
   linkEl.innerHTML = title;
   if (descr)
-    listItem.appendChild(document.createElement("span")).innerText =
+    listItem.appendChild(document.createElement("span")).innerHTML =
       " (" + descr + ")";
   else if (showSearchSummary)
     fetch(requestUrl)
@@ -155,10 +155,8 @@ const Search = {
   _pulse_status: -1,
 
   htmlToText: (htmlString) => {
-    const htmlElement = document
-      .createRange()
-      .createContextualFragment(htmlString);
-    _removeChildren(htmlElement.querySelectorAll(".headerlink"));
+    const htmlElement = new DOMParser().parseFromString(htmlString, 'text/html');
+    htmlElement.querySelectorAll(".headerlink").forEach((el) => { el.remove() });
     const docContent = htmlElement.querySelector('[role="main"]');
     if (docContent !== undefined) return docContent.textContent;
     console.warn(
@@ -504,11 +502,12 @@ const Search = {
    * latter for highlighting it.
    */
   makeSearchSummary: (htmlText, keywords, highlightWords) => {
-    const text = Search.htmlToText(htmlText).toLowerCase();
+    const text = Search.htmlToText(htmlText);
     if (text === "") return null;
 
+    const textLower = text.toLowerCase();
     const actualStartPosition = [...keywords]
-      .map((k) => text.indexOf(k.toLowerCase()))
+      .map((k) => textLower.indexOf(k.toLowerCase()))
       .filter((i) => i > -1)
       .slice(-1)[0];
     const startWithContext = Math.max(actualStartPosition - 120, 0);
@@ -516,9 +515,9 @@ const Search = {
     const top = startWithContext === 0 ? "" : "...";
     const tail = startWithContext + 240 < text.length ? "..." : "";
 
-    let summary = document.createElement("div");
+    let summary = document.createElement("p");
     summary.classList.add("context");
-    summary.innerText = top + text.substr(startWithContext, 240).trim() + tail;
+    summary.textContent = top + text.substr(startWithContext, 240).trim() + tail;
 
     highlightWords.forEach((highlightWord) =>
       _highlightText(summary, highlightWord, "highlighted")
diff --git a/genindex.html b/genindex.html
index 1b03de5..9f29b9a 100644
--- a/genindex.html
+++ b/genindex.html
@@ -3,7 +3,7 @@
 <head>
   <meta charset="utf-8" />
   <meta name="viewport" content="width=device-width, initial-scale=1.0" />
-  <title>Index &mdash; parsedmarc 8.3.0 documentation</title>
+  <title>Index &mdash; parsedmarc 8.3.1 documentation</title>
       <link rel="stylesheet" href="_static/pygments.css" type="text/css" />
       <link rel="stylesheet" href="_static/css/theme.css" type="text/css" />
   <!--[if lt IE 9]>
@@ -28,7 +28,7 @@
             <a href="index.html" class="icon icon-home"> parsedmarc
           </a>
               <div class="version">
-                8.3.0
+                8.3.1
               </div>
 <div role="search">
   <form id="rtd-search-form" class="wy-form" action="search.html" method="get">
diff --git a/index.html b/index.html
index b651f73..a191b31 100644
--- a/index.html
+++ b/index.html
@@ -4,7 +4,7 @@
   <meta charset="utf-8" /><meta name="generator" content="Docutils 0.17.1: http://docutils.sourceforge.net/" />
 
   <meta name="viewport" content="width=device-width, initial-scale=1.0" />
-  <title>parsedmarc documentation - Open source DMARC report analyzer and visualizer &mdash; parsedmarc 8.3.0 documentation</title>
+  <title>parsedmarc documentation - Open source DMARC report analyzer and visualizer &mdash; parsedmarc 8.3.1 documentation</title>
       <link rel="stylesheet" href="_static/pygments.css" type="text/css" />
       <link rel="stylesheet" href="_static/css/theme.css" type="text/css" />
   <!--[if lt IE 9]>
@@ -29,7 +29,7 @@
             <a href="#" class="icon icon-home"> parsedmarc
           </a>
               <div class="version">
-                8.3.0
+                8.3.1
               </div>
 <div role="search">
   <form id="rtd-search-form" class="wy-form" action="search.html" method="get">
@@ -87,9 +87,11 @@
 </ul>
 </li>
 <li><a class="reference internal" href="#dmarc-alignment-guide">DMARC Alignment Guide</a></li>
-<li><a class="reference internal" href="#what-if-a-sender-won-t-support-dkim-dmarc">What if a sender won’t support DKIM/DMARC?</a></li>
+<li><a class="reference internal" href="#what-if-a-sender-wont-support-dkim-dmarc">What if a sender won’t support DKIM/DMARC?</a></li>
 <li><a class="reference internal" href="#what-about-mailing-lists">What about mailing lists?</a><ul>
 <li><a class="reference internal" href="#mailing-list-list-best-practices">Mailing list list best practices</a><ul>
+<li><a class="reference internal" href="#do">Do</a></li>
+<li><a class="reference internal" href="#do-not">Do not</a></li>
 <li><a class="reference internal" href="#mailman-2">Mailman 2</a></li>
 <li><a class="reference internal" href="#mailman-3">Mailman 3</a></li>
 </ul>
@@ -129,7 +131,7 @@
       <li><a href="#" class="icon icon-home"></a> &raquo;</li>
       <li>parsedmarc documentation - Open source DMARC report analyzer and visualizer</li>
       <li class="wy-breadcrumbs-aside">
-            <a href="_sources/index.rst.txt" rel="nofollow"> View page source</a>
+            <a href="_sources/index.md.txt" rel="nofollow"> View page source</a>
       </li>
   </ul>
   <hr/>
@@ -137,9 +139,11 @@
           <div role="main" class="document" itemscope="itemscope" itemtype="http://schema.org/Article">
            <div itemprop="articleBody">
              
-  <section id="parsedmarc-documentation-open-source-dmarc-report-analyzer-and-visualizer">
+  <section class="tex2jax_ignore mathjax_ignore" id="parsedmarc-documentation-open-source-dmarc-report-analyzer-and-visualizer">
 <h1>parsedmarc documentation - Open source DMARC report analyzer and visualizer<a class="headerlink" href="#parsedmarc-documentation-open-source-dmarc-report-analyzer-and-visualizer" title="Permalink to this heading"></a></h1>
-<p><a class="reference external" href="https://github.com/domainaware/parsedmarc/actions/workflows/python-tests.yml"><img alt="Build Status" src="https://github.com/domainaware/parsedmarc/actions/workflows/python-tests.yml/badge.svg" /></a> <a class="reference external" href="https://codecov.io/gh/domainaware/parsedmarc"><img alt="Code Coverage" src="https://codecov.io/gh/domainaware/parsedmarc/branch/master/graph/badge.svg" /></a> <a class="reference external" href="https://pypi.org/project/parsedmarc/"><img alt="PyPI Package" src="https://img.shields.io/pypi/v/parsedmarc.svg" /></a></p>
+<p><a class="reference external" href="https://github.com/domainaware/parsedmarc/actions/workflows/python-tests.yml"><img alt="BuildStatus" src="https://github.com/domainaware/parsedmarc/actions/workflows/python-tests.yml/badge.svg" /></a>
+<a class="reference external" href="https://codecov.io/gh/domainaware/parsedmarc"><img alt="CodeCoverage" src="https://codecov.io/gh/domainaware/parsedmarc/branch/master/graph/badge.svg" /></a>
+<a class="reference external" href="https://pypi.org/project/parsedmarc/"><img alt="PyPIPackage" src="https://img.shields.io/pypi/v/parsedmarc.svg" /></a></p>
 <div class="admonition note">
 <p class="admonition-title">Note</p>
 <p><strong>Help Wanted</strong></p>
@@ -191,53 +195,54 @@ lookalike domain monitoring, check out <a class="reference external" href="https
 </section>
 <section id="cli-help">
 <h2>CLI help<a class="headerlink" href="#cli-help" title="Permalink to this heading"></a></h2>
-<div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="n">usage</span><span class="p">:</span> <span class="n">parsedmarc</span> <span class="p">[</span><span class="o">-</span><span class="n">h</span><span class="p">]</span> <span class="p">[</span><span class="o">-</span><span class="n">c</span> <span class="n">CONFIG_FILE</span><span class="p">]</span> <span class="p">[</span><span class="o">--</span><span class="n">strip</span><span class="o">-</span><span class="n">attachment</span><span class="o">-</span><span class="n">payloads</span><span class="p">]</span> <span class="p">[</span><span class="o">-</span><span class="n">o</span> <span class="n">OUTPUT</span><span class="p">]</span>
-                   <span class="p">[</span><span class="o">--</span><span class="n">aggregate</span><span class="o">-</span><span class="n">json</span><span class="o">-</span><span class="n">filename</span> <span class="n">AGGREGATE_JSON_FILENAME</span><span class="p">]</span>
-                   <span class="p">[</span><span class="o">--</span><span class="n">forensic</span><span class="o">-</span><span class="n">json</span><span class="o">-</span><span class="n">filename</span> <span class="n">FORENSIC_JSON_FILENAME</span><span class="p">]</span>
-                   <span class="p">[</span><span class="o">--</span><span class="n">aggregate</span><span class="o">-</span><span class="n">csv</span><span class="o">-</span><span class="n">filename</span> <span class="n">AGGREGATE_CSV_FILENAME</span><span class="p">]</span>
-                   <span class="p">[</span><span class="o">--</span><span class="n">forensic</span><span class="o">-</span><span class="n">csv</span><span class="o">-</span><span class="n">filename</span> <span class="n">FORENSIC_CSV_FILENAME</span><span class="p">]</span>
-                   <span class="p">[</span><span class="o">-</span><span class="n">n</span> <span class="n">NAMESERVERS</span> <span class="p">[</span><span class="n">NAMESERVERS</span> <span class="o">...</span><span class="p">]]</span> <span class="p">[</span><span class="o">-</span><span class="n">t</span> <span class="n">DNS_TIMEOUT</span><span class="p">]</span> <span class="p">[</span><span class="o">--</span><span class="n">offline</span><span class="p">]</span>
-                   <span class="p">[</span><span class="o">-</span><span class="n">s</span><span class="p">]</span> <span class="p">[</span><span class="o">--</span><span class="n">verbose</span><span class="p">]</span> <span class="p">[</span><span class="o">--</span><span class="n">debug</span><span class="p">]</span> <span class="p">[</span><span class="o">--</span><span class="n">log</span><span class="o">-</span><span class="n">file</span> <span class="n">LOG_FILE</span><span class="p">]</span> <span class="p">[</span><span class="o">-</span><span class="n">v</span><span class="p">]</span>
-                   <span class="p">[</span><span class="n">file_path</span> <span class="o">...</span><span class="p">]</span>
+<div class="highlight-text notranslate"><div class="highlight"><pre><span></span>usage: parsedmarc [-h] [-c CONFIG_FILE] [--strip-attachment-payloads] [-o OUTPUT]
+                   [--aggregate-json-filename AGGREGATE_JSON_FILENAME]
+                   [--forensic-json-filename FORENSIC_JSON_FILENAME]
+                   [--aggregate-csv-filename AGGREGATE_CSV_FILENAME]
+                   [--forensic-csv-filename FORENSIC_CSV_FILENAME]
+                   [-n NAMESERVERS [NAMESERVERS ...]] [-t DNS_TIMEOUT] [--offline]
+                   [-s] [--verbose] [--debug] [--log-file LOG_FILE] [-v]
+                   [file_path ...]
 
- <span class="n">Parses</span> <span class="n">DMARC</span> <span class="n">reports</span>
+ Parses DMARC reports
 
- <span class="n">positional</span> <span class="n">arguments</span><span class="p">:</span>
-   <span class="n">file_path</span>             <span class="n">one</span> <span class="ow">or</span> <span class="n">more</span> <span class="n">paths</span> <span class="n">to</span> <span class="n">aggregate</span> <span class="ow">or</span> <span class="n">forensic</span> <span class="n">report</span>
-                         <span class="n">files</span><span class="p">,</span> <span class="n">emails</span><span class="p">,</span> <span class="ow">or</span> <span class="n">mbox</span> <span class="n">files</span><span class="s1">&#39;</span>
+ positional arguments:
+   file_path             one or more paths to aggregate or forensic report
+                         files, emails, or mbox files&#39;
 
- <span class="n">optional</span> <span class="n">arguments</span><span class="p">:</span>
-   <span class="o">-</span><span class="n">h</span><span class="p">,</span> <span class="o">--</span><span class="n">help</span>            <span class="n">show</span> <span class="n">this</span> <span class="n">help</span> <span class="n">message</span> <span class="ow">and</span> <span class="n">exit</span>
-   <span class="o">-</span><span class="n">c</span> <span class="n">CONFIG_FILE</span><span class="p">,</span> <span class="o">--</span><span class="n">config</span><span class="o">-</span><span class="n">file</span> <span class="n">CONFIG_FILE</span>
-                         <span class="n">a</span> <span class="n">path</span> <span class="n">to</span> <span class="n">a</span> <span class="n">configuration</span> <span class="n">file</span> <span class="p">(</span><span class="o">--</span><span class="n">silent</span> <span class="n">implied</span><span class="p">)</span>
-   <span class="o">--</span><span class="n">strip</span><span class="o">-</span><span class="n">attachment</span><span class="o">-</span><span class="n">payloads</span>
-                         <span class="n">remove</span> <span class="n">attachment</span> <span class="n">payloads</span> <span class="kn">from</span> <span class="nn">forensic</span> <span class="n">report</span> <span class="n">output</span>
-   <span class="o">-</span><span class="n">o</span> <span class="n">OUTPUT</span><span class="p">,</span> <span class="o">--</span><span class="n">output</span> <span class="n">OUTPUT</span>
-                         <span class="n">write</span> <span class="n">output</span> <span class="n">files</span> <span class="n">to</span> <span class="n">the</span> <span class="n">given</span> <span class="n">directory</span>
-   <span class="o">--</span><span class="n">aggregate</span><span class="o">-</span><span class="n">json</span><span class="o">-</span><span class="n">filename</span> <span class="n">AGGREGATE_JSON_FILENAME</span>
-                         <span class="n">filename</span> <span class="k">for</span> <span class="n">the</span> <span class="n">aggregate</span> <span class="n">JSON</span> <span class="n">output</span> <span class="n">file</span>
-   <span class="o">--</span><span class="n">forensic</span><span class="o">-</span><span class="n">json</span><span class="o">-</span><span class="n">filename</span> <span class="n">FORENSIC_JSON_FILENAME</span>
-                         <span class="n">filename</span> <span class="k">for</span> <span class="n">the</span> <span class="n">forensic</span> <span class="n">JSON</span> <span class="n">output</span> <span class="n">file</span>
-   <span class="o">--</span><span class="n">aggregate</span><span class="o">-</span><span class="n">csv</span><span class="o">-</span><span class="n">filename</span> <span class="n">AGGREGATE_CSV_FILENAME</span>
-                         <span class="n">filename</span> <span class="k">for</span> <span class="n">the</span> <span class="n">aggregate</span> <span class="n">CSV</span> <span class="n">output</span> <span class="n">file</span>
-   <span class="o">--</span><span class="n">forensic</span><span class="o">-</span><span class="n">csv</span><span class="o">-</span><span class="n">filename</span> <span class="n">FORENSIC_CSV_FILENAME</span>
-                         <span class="n">filename</span> <span class="k">for</span> <span class="n">the</span> <span class="n">forensic</span> <span class="n">CSV</span> <span class="n">output</span> <span class="n">file</span>
-   <span class="o">-</span><span class="n">n</span> <span class="n">NAMESERVERS</span> <span class="p">[</span><span class="n">NAMESERVERS</span> <span class="o">...</span><span class="p">],</span> <span class="o">--</span><span class="n">nameservers</span> <span class="n">NAMESERVERS</span> <span class="p">[</span><span class="n">NAMESERVERS</span> <span class="o">...</span><span class="p">]</span>
-                         <span class="n">nameservers</span> <span class="n">to</span> <span class="n">query</span>
-   <span class="o">-</span><span class="n">t</span> <span class="n">DNS_TIMEOUT</span><span class="p">,</span> <span class="o">--</span><span class="n">dns_timeout</span> <span class="n">DNS_TIMEOUT</span>
-                         <span class="n">number</span> <span class="n">of</span> <span class="n">seconds</span> <span class="n">to</span> <span class="n">wait</span> <span class="k">for</span> <span class="n">an</span> <span class="n">answer</span> <span class="kn">from</span> <span class="nn">DNS</span>
-                         <span class="p">(</span><span class="n">default</span><span class="p">:</span> <span class="mf">2.0</span><span class="p">)</span>
-   <span class="o">--</span><span class="n">offline</span>             <span class="n">do</span> <span class="ow">not</span> <span class="n">make</span> <span class="n">online</span> <span class="n">queries</span> <span class="k">for</span> <span class="n">geolocation</span> <span class="ow">or</span> <span class="n">DNS</span>
-   <span class="o">-</span><span class="n">s</span><span class="p">,</span> <span class="o">--</span><span class="n">silent</span>          <span class="n">only</span> <span class="nb">print</span> <span class="n">errors</span> <span class="ow">and</span> <span class="n">warnings</span>
-   <span class="o">--</span><span class="n">verbose</span>             <span class="n">more</span> <span class="n">verbose</span> <span class="n">output</span>
-   <span class="o">--</span><span class="n">debug</span>               <span class="nb">print</span> <span class="n">debugging</span> <span class="n">information</span>
-   <span class="o">--</span><span class="n">log</span><span class="o">-</span><span class="n">file</span> <span class="n">LOG_FILE</span>   <span class="n">output</span> <span class="n">logging</span> <span class="n">to</span> <span class="n">a</span> <span class="n">file</span>
-   <span class="o">-</span><span class="n">v</span><span class="p">,</span> <span class="o">--</span><span class="n">version</span>         <span class="n">show</span> <span class="n">program</span><span class="s1">&#39;s version number and exit</span>
+ optional arguments:
+   -h, --help            show this help message and exit
+   -c CONFIG_FILE, --config-file CONFIG_FILE
+                         a path to a configuration file (--silent implied)
+   --strip-attachment-payloads
+                         remove attachment payloads from forensic report output
+   -o OUTPUT, --output OUTPUT
+                         write output files to the given directory
+   --aggregate-json-filename AGGREGATE_JSON_FILENAME
+                         filename for the aggregate JSON output file
+   --forensic-json-filename FORENSIC_JSON_FILENAME
+                         filename for the forensic JSON output file
+   --aggregate-csv-filename AGGREGATE_CSV_FILENAME
+                         filename for the aggregate CSV output file
+   --forensic-csv-filename FORENSIC_CSV_FILENAME
+                         filename for the forensic CSV output file
+   -n NAMESERVERS [NAMESERVERS ...], --nameservers NAMESERVERS [NAMESERVERS ...]
+                         nameservers to query
+   -t DNS_TIMEOUT, --dns_timeout DNS_TIMEOUT
+                         number of seconds to wait for an answer from DNS
+                         (default: 2.0)
+   --offline             do not make online queries for geolocation or DNS
+   -s, --silent          only print errors and warnings
+   --verbose             more verbose output
+   --debug               print debugging information
+   --log-file LOG_FILE   output logging to a file
+   -v, --version         show program&#39;s version number and exit
 </pre></div>
 </div>
 <div class="admonition note">
 <p class="admonition-title">Note</p>
-<p>Starting in <code class="docutils literal notranslate"><span class="pre">parsedmarc</span></code> 6.0.0, most CLI options were moved to a configuration file, described below.</p>
+<p>Starting in <code class="docutils literal notranslate"><span class="pre">parsedmarc</span></code> 6.0.0, most CLI options were moved to a
+configuration file, described below.</p>
 </div>
 </section>
 <section id="configuration-file">
@@ -282,103 +287,160 @@ lookalike domain monitoring, check out <a class="reference external" href="https
 </div>
 <p>The full set of configuration options are:</p>
 <ul>
-<li><dl>
+<li><dl class="simple myst">
 <dt><code class="docutils literal notranslate"><span class="pre">general</span></code></dt><dd><ul class="simple">
-<li><p><code class="docutils literal notranslate"><span class="pre">save_aggregate</span></code> - bool: Save aggregate report data to Elasticsearch, Splunk and/or S3</p></li>
-<li><p><code class="docutils literal notranslate"><span class="pre">save_forensic</span></code> - bool: Save forensic report data to Elasticsearch, Splunk and/or S3</p></li>
-<li><p><code class="docutils literal notranslate"><span class="pre">strip_attachment_payloads</span></code> - bool: Remove attachment payloads from results</p></li>
+<li><p><code class="docutils literal notranslate"><span class="pre">save_aggregate</span></code> - bool: Save aggregate report data to
+Elasticsearch, Splunk and/or S3</p></li>
+</ul>
+</dd>
+</dl>
+<ul>
+<li><p><code class="docutils literal notranslate"><span class="pre">save_forensic</span></code> - bool: Save forensic report data to
+Elasticsearch, Splunk and/or S3</p></li>
+<li><p><code class="docutils literal notranslate"><span class="pre">strip_attachment_payloads</span></code> - bool: Remove attachment
+payloads from results</p></li>
 <li><p><code class="docutils literal notranslate"><span class="pre">output</span></code> - str: Directory to place JSON and CSV files in</p></li>
-<li><p><code class="docutils literal notranslate"><span class="pre">aggregate_json_filename</span></code> - str: filename for the aggregate JSON output file</p></li>
-<li><p><code class="docutils literal notranslate"><span class="pre">forensic_json_filename</span></code> - str: filename for the forensic JSON output file</p></li>
-<li><p><code class="docutils literal notranslate"><span class="pre">ip_db_path</span></code> - str: An optional custom path to a MMDB file from MaxMind or DBIP</p></li>
-<li><p><code class="docutils literal notranslate"><span class="pre">offline</span></code> - bool: Do not use online queries for geolocation or DNS</p></li>
-<li><p><code class="docutils literal notranslate"><span class="pre">nameservers</span></code> -  str: A comma separated list of DNS resolvers (Default: <a class="reference external" href="https://1.1.1.1/">Cloudflare’s public resolvers</a>)</p></li>
+<li><p><code class="docutils literal notranslate"><span class="pre">aggregate_json_filename</span></code> - str: filename for the aggregate
+JSON output file</p></li>
+<li><p><code class="docutils literal notranslate"><span class="pre">forensic_json_filename</span></code> - str: filename for the forensic
+JSON output file</p></li>
+<li><p><code class="docutils literal notranslate"><span class="pre">ip_db_path</span></code> - str: An optional custom path to a MMDB file</p></li>
+<li><p>from MaxMind or DBIP</p></li>
+<li><p><code class="docutils literal notranslate"><span class="pre">offline</span></code> - bool: Do not use online queries for geolocation
+or DNS</p></li>
+<li><p><code class="docutils literal notranslate"><span class="pre">nameservers</span></code> -  str: A comma separated list of
+DNS resolvers (Default: <a class="reference external" href="https://1.1.1.1/">Cloudflare’s public resolvers</a>)</p></li>
 <li><p><code class="docutils literal notranslate"><span class="pre">dns_timeout</span></code> - float: DNS timeout period</p></li>
 <li><p><code class="docutils literal notranslate"><span class="pre">debug</span></code> - bool: Print debugging messages</p></li>
 <li><p><code class="docutils literal notranslate"><span class="pre">silent</span></code> - bool: Only print errors (Default: True)</p></li>
 <li><p><code class="docutils literal notranslate"><span class="pre">log_file</span></code> - str: Write log messages to a file at this path</p></li>
-<li><p><code class="docutils literal notranslate"><span class="pre">n_procs</span></code> - int: Number of process to run in parallel when parsing in CLI mode (Default: 1)</p></li>
-<li><p><code class="docutils literal notranslate"><span class="pre">chunk_size</span></code> - int: Number of files to give to each process when running in parallel.</p></li>
-</ul>
+<li><p><code class="docutils literal notranslate"><span class="pre">n_procs</span></code> - int: Number of process to run in parallel when
+parsing in CLI mode (Default: 1)</p></li>
+<li><p><code class="docutils literal notranslate"><span class="pre">chunk_size</span></code> - int: Number of files to give to each process
+when running in parallel.</p>
 <div class="admonition note">
 <p class="admonition-title">Note</p>
-<p>Setting this to a number larger than one can improve performance when processing thousands of files</p>
+<p>Setting this to a number larger than one can improve
+performance when processing thousands of files</p>
 </div>
-</dd>
-</dl>
 </li>
-<li><dl class="simple">
+</ul>
+</li>
+<li><dl class="simple myst">
 <dt><code class="docutils literal notranslate"><span class="pre">mailbox</span></code></dt><dd><ul class="simple">
-<li><p><code class="docutils literal notranslate"><span class="pre">reports_folder</span></code> - str: The mailbox folder (or label for Gmail) where the incoming reports can be found (Default: INBOX)</p></li>
-<li><p><code class="docutils literal notranslate"><span class="pre">archive_folder</span></code> - str:  The mailbox folder (or label for Gmail) to sort processed emails into (Default: Archive)</p></li>
-<li><p><code class="docutils literal notranslate"><span class="pre">watch</span></code> - bool: Use the IMAP <code class="docutils literal notranslate"><span class="pre">IDLE</span></code> command to process messages as they arrive or poll MS Graph for new messages</p></li>
-<li><p><code class="docutils literal notranslate"><span class="pre">delete</span></code> - bool: Delete messages after processing them, instead of archiving them</p></li>
-<li><p><code class="docutils literal notranslate"><span class="pre">test</span></code> - bool: Do not move or delete messages</p></li>
-<li><p><code class="docutils literal notranslate"><span class="pre">batch_size</span></code> - int: Number of messages to read and process before saving. Default 10. Use 0 for no limit.</p></li>
+<li><p><code class="docutils literal notranslate"><span class="pre">reports_folder</span></code> - str: The mailbox folder (or label for
+Gmail) where the incoming reports can be found (Default: INBOX)</p></li>
 </ul>
 </dd>
 </dl>
+<ul class="simple">
+<li><p><code class="docutils literal notranslate"><span class="pre">archive_folder</span></code> - str:  The mailbox folder (or label for
+Gmail) to sort processed emails into (Default: Archive)</p></li>
+<li><p><code class="docutils literal notranslate"><span class="pre">watch</span></code> - bool: Use the IMAP <code class="docutils literal notranslate"><span class="pre">IDLE</span></code> command to process</p></li>
+<li><p>messages as they arrive or poll MS Graph for new messages</p></li>
+<li><p><code class="docutils literal notranslate"><span class="pre">delete</span></code> - bool: Delete messages after processing them,</p></li>
+<li><p>instead of archiving them</p></li>
+<li><p><code class="docutils literal notranslate"><span class="pre">test</span></code> - bool: Do not move or delete messages</p></li>
+<li><p><code class="docutils literal notranslate"><span class="pre">batch_size</span></code> - int: Number of messages to read and process
+before saving. Default 10. Use 0 for no limit.</p></li>
+<li><p><code class="docutils literal notranslate"><span class="pre">check_timeout</span></code> - int: Number of seconds to wait for a IMAP
+IDLE response or the number of seconds until the next mai
+check (Default: 30)</p></li>
+</ul>
 </li>
-<li><dl>
+<li><dl class="simple myst">
 <dt><code class="docutils literal notranslate"><span class="pre">imap</span></code></dt><dd><ul class="simple">
 <li><p><code class="docutils literal notranslate"><span class="pre">host</span></code> - str: The IMAP server hostname or IP address</p></li>
-<li><p><code class="docutils literal notranslate"><span class="pre">port</span></code> - int: The IMAP server port (Default: 993)</p></li>
 </ul>
+</dd>
+</dl>
+<ul>
+<li><p><code class="docutils literal notranslate"><span class="pre">port</span></code> - int: The IMAP server port (Default: 993)</p>
 <div class="admonition note">
 <p class="admonition-title">Note</p>
-<p><code class="docutils literal notranslate"><span class="pre">%</span></code> characters must be escaped with another <code class="docutils literal notranslate"><span class="pre">%</span></code> character, so use <code class="docutils literal notranslate"><span class="pre">%%</span></code> wherever a <code class="docutils literal notranslate"><span class="pre">%</span></code> character is used.</p>
+<p><code class="docutils literal notranslate"><span class="pre">%</span></code> characters must be escaped with another <code class="docutils literal notranslate"><span class="pre">%</span></code> character,
+so use <code class="docutils literal notranslate"><span class="pre">%%</span></code> wherever a <code class="docutils literal notranslate"><span class="pre">%</span></code> character is used.</p>
 </div>
 <div class="admonition note">
 <p class="admonition-title">Note</p>
-<p>Starting in version 8.0.0, most options from the <code class="docutils literal notranslate"><span class="pre">imap</span></code> section have been moved to the <code class="docutils literal notranslate"><span class="pre">mailbox</span></code> section.</p>
+<p>Starting in version 8.0.0, most options from the <code class="docutils literal notranslate"><span class="pre">imap</span></code>
+section have been moved to the <code class="docutils literal notranslate"><span class="pre">mailbox</span></code> section.</p>
 </div>
 <div class="admonition note">
 <p class="admonition-title">Note</p>
 <p>If your host recommends another port, still try 993</p>
 </div>
-<ul class="simple">
-<li><p><code class="docutils literal notranslate"><span class="pre">ssl</span></code> - bool: Use an encrypted SSL/TLS connection (Default: True)</p></li>
-<li><p><code class="docutils literal notranslate"><span class="pre">skip_certificate_verification</span></code> - bool: Skip certificate verification (not recommended)</p></li>
+</li>
+<li><p><code class="docutils literal notranslate"><span class="pre">ssl</span></code> - bool: Use an encrypted SSL/TLS connection
+(Default: True)</p></li>
+<li><p><code class="docutils literal notranslate"><span class="pre">skip_certificate_verification</span></code> - bool: Skip certificate
+verification (not recommended)</p></li>
 <li><p><code class="docutils literal notranslate"><span class="pre">user</span></code> - str: The IMAP user</p></li>
 <li><p><code class="docutils literal notranslate"><span class="pre">password</span></code> - str: The IMAP password</p></li>
 </ul>
+</li>
+<li><dl class="simple myst">
+<dt><code class="docutils literal notranslate"><span class="pre">msgraph</span></code></dt><dd><ul class="simple">
+<li><p><code class="docutils literal notranslate"><span class="pre">auth_method</span></code> - str: Authentication method, valid types are
+UsernamePassword, DeviceCode, or ClientSecret
+(Default: UsernamePassword).</p></li>
+</ul>
 </dd>
 </dl>
-</li>
-<li><dl>
-<dt><code class="docutils literal notranslate"><span class="pre">msgraph</span></code></dt><dd><ul class="simple">
-<li><p><code class="docutils literal notranslate"><span class="pre">auth_method</span></code> - str: Authentication method, valid types are UsernamePassword, DeviceCode, or ClientSecret (Default: UsernamePassword).</p></li>
-<li><p><code class="docutils literal notranslate"><span class="pre">user</span></code> - str: The M365 user, required when the auth method is UsernamePassword</p></li>
-<li><p><code class="docutils literal notranslate"><span class="pre">password</span></code> - str: The user password, required when the auth method is UsernamePassword</p></li>
+<ul>
+<li><p><code class="docutils literal notranslate"><span class="pre">user</span></code> - str: The M365 user, required when the auth method is
+UsernamePassword</p></li>
+<li><p><code class="docutils literal notranslate"><span class="pre">password</span></code> - str: The user password, required when the auth
+method is UsernamePassword</p></li>
 <li><p><code class="docutils literal notranslate"><span class="pre">client_id</span></code> - str: The app registration’s client ID</p></li>
 <li><p><code class="docutils literal notranslate"><span class="pre">client_secret</span></code> - str: The app registration’s secret</p></li>
-<li><p><code class="docutils literal notranslate"><span class="pre">tenant_id</span></code> - str: The Azure AD tenant ID. This is required for all auth methods except UsernamePassword.</p></li>
-<li><p><code class="docutils literal notranslate"><span class="pre">mailbox</span></code> - str: The mailbox name. This defaults to the current user if using the UsernamePassword auth method, but could be a shared mailbox if the user has access to the mailbox</p></li>
-</ul>
+<li><p><code class="docutils literal notranslate"><span class="pre">tenant_id</span></code> - str: The Azure AD tenant ID. This is required
+for all auth methods except UsernamePassword.</p></li>
+<li><p><code class="docutils literal notranslate"><span class="pre">mailbox</span></code> - str: The mailbox name. This defaults to the
+current user if using the UsernamePassword auth method, but
+could be a shared mailbox if the user has access to the mailbox</p></li>
+<li><p><code class="docutils literal notranslate"><span class="pre">token_file</span></code> - str: Path to save the token file
+(Default: .token)</p>
 <div class="admonition note">
 <p class="admonition-title">Note</p>
-<p>You must create an app registration in Azure AD and have an admin grant the Microsoft Graph <code class="docutils literal notranslate"><span class="pre">Mail.ReadWrite</span></code> (delegated) permission to the app.
-If you are using <cite>UsernamePassword</cite> auth and the mailbox is different from the username, you must grant the app <code class="docutils literal notranslate"><span class="pre">Mail.ReadWrite.Shared</span></code>.</p>
+<p>You must create an app registration in Azure AD and have an
+admin grant the Microsoft Graph <code class="docutils literal notranslate"><span class="pre">Mail.ReadWrite</span></code>
+(delegated) permission to the app. If you are using
+<code class="docutils literal notranslate"><span class="pre">UsernamePassword</span></code> auth and the mailbox is different from the
+username, you must grant the app <code class="docutils literal notranslate"><span class="pre">Mail.ReadWrite.Shared</span></code>.</p>
 </div>
 <div class="admonition warning">
 <p class="admonition-title">Warning</p>
-<p>If you are using the <cite>ClientSecret</cite> auth method, you need to grant the <code class="docutils literal notranslate"><span class="pre">Mail.ReadWrite</span></code> (application) permission to the app.
-You must also restrict the application’s access to a specific mailbox since it allows all mailboxes by default.
-Use the <code class="docutils literal notranslate"><span class="pre">New-ApplicationAccessPolicy</span></code> command in the Exchange PowerShell module.
-If you need to scope the policy to shared mailboxes, you can add them to a mail enabled security group and use that as the group id.</p>
-<p><code class="docutils literal notranslate"><span class="pre">New-ApplicationAccessPolicy</span> <span class="pre">-AccessRight</span> <span class="pre">RestrictAccess</span> <span class="pre">-AppId</span> <span class="pre">&quot;&lt;CLIENT_ID&gt;&quot;</span> <span class="pre">-PolicyScopeGroupId</span> <span class="pre">&quot;&lt;MAILBOX&gt;&quot;</span> <span class="pre">-Description</span> <span class="pre">&quot;Restrict</span> <span class="pre">access</span> <span class="pre">to</span> <span class="pre">dmarc</span> <span class="pre">reports</span> <span class="pre">mailbox.&quot;</span></code></p>
+<p>If you are using the <code class="docutils literal notranslate"><span class="pre">ClientSecret</span></code> auth method, you need to
+grant the <code class="docutils literal notranslate"><span class="pre">Mail.ReadWrite</span></code> (application) permission to the
+app. You must also restrict the application’s access to a
+specific mailbox since it allows all mailboxes by default.
+Use the <code class="docutils literal notranslate"><span class="pre">New-ApplicationAccessPolicy</span></code> command in the
+Exchange PowerShell module. If you need to scope the policy to
+shared mailboxes, you can add them to a mail enabled security
+group and use that as the group id.</p>
+<div class="highlight-powershell notranslate"><div class="highlight"><pre><span></span><span class="nb">New-ApplicationAccessPolicy</span> <span class="n">-AccessRight</span> <span class="n">RestrictAccess</span>
+<span class="n">-AppId</span> <span class="s2">&quot;&lt;CLIENT_ID&gt;&quot;</span> <span class="n">-PolicyScopeGroupId</span> <span class="s2">&quot;&lt;MAILBOX&gt;&quot;</span>
+<span class="n">-Description</span> <span class="s2">&quot;Restrict access to dmarc reports mailbox.&quot;</span>
+</pre></div>
+</div>
 </div>
-</dd>
-</dl>
 </li>
-<li><dl>
+</ul>
+</li>
+<li><dl class="simple myst">
 <dt><code class="docutils literal notranslate"><span class="pre">elasticsearch</span></code></dt><dd><ul class="simple">
-<li><p><code class="docutils literal notranslate"><span class="pre">hosts</span></code> - str: A comma separated list of hostnames and ports or URLs (e.g. <code class="docutils literal notranslate"><span class="pre">127.0.0.1:9200</span></code> or <code class="docutils literal notranslate"><span class="pre">https://user:secret&#64;localhost</span></code>)</p></li>
+<li><p><code class="docutils literal notranslate"><span class="pre">hosts</span></code> - str: A comma separated list of hostnames and ports
+or URLs (e.g. <code class="docutils literal notranslate"><span class="pre">127.0.0.1:9200</span></code> or
+<code class="docutils literal notranslate"><span class="pre">https://user:secret&#64;localhost</span></code>)</p></li>
 </ul>
 <div class="admonition note">
 <p class="admonition-title">Note</p>
-<p>Special characters in the username or password must be <a class="reference external" href="https://en.wikipedia.org/wiki/Percent-encoding#Percent-encoding_reserved_characters">URL encoded</a>.</p>
+<p>Special characters in the username or password must be
+<a class="reference external" href="https://en.wikipedia.org/wiki/Percent-encoding#Percent-encoding_reserved_characters">URL encoded</a>.</p>
 </div>
+</dd>
+</dl>
 <ul class="simple">
 <li><p><code class="docutils literal notranslate"><span class="pre">ssl</span></code> - bool: Use an encrypted SSL/TLS connection (Default: True)</p></li>
 <li><p><code class="docutils literal notranslate"><span class="pre">cert_path</span></code> - str: Path to a trusted certificates</p></li>
@@ -387,123 +449,148 @@ If you need to scope the policy to shared mailboxes, you can add them to a mail
 <li><p><code class="docutils literal notranslate"><span class="pre">number_of_shards</span></code> - int: The number of shards to use when creating the index (Default: 1)</p></li>
 <li><p><code class="docutils literal notranslate"><span class="pre">number_of_replicas</span></code> - int: The number of replicas to use when creating the index (Default: 1)</p></li>
 </ul>
-</dd>
-</dl>
 </li>
-<li><dl class="simple">
+<li><dl class="simple myst">
 <dt><code class="docutils literal notranslate"><span class="pre">splunk_hec</span></code></dt><dd><ul class="simple">
 <li><p><code class="docutils literal notranslate"><span class="pre">url</span></code> - str: The URL of the Splunk HTTP Events Collector (HEC)</p></li>
-<li><p><code class="docutils literal notranslate"><span class="pre">token</span></code> - str: The HEC token</p></li>
-<li><p><code class="docutils literal notranslate"><span class="pre">index</span></code> - str: The Splunk index to use</p></li>
-<li><p><code class="docutils literal notranslate"><span class="pre">skip_certificate_verification</span></code> - bool: Skip certificate verification (not recommended)</p></li>
 </ul>
 </dd>
 </dl>
+<ul class="simple">
+<li><p><code class="docutils literal notranslate"><span class="pre">token</span></code> - str: The HEC token</p></li>
+<li><p><code class="docutils literal notranslate"><span class="pre">index</span></code> - str: The Splunk index to use</p></li>
+<li><p><code class="docutils literal notranslate"><span class="pre">skip_certificate_verification</span></code> - bool: Skip certificate
+verification (not recommended)</p></li>
+</ul>
 </li>
-<li><dl class="simple">
+<li><dl class="simple myst">
 <dt><code class="docutils literal notranslate"><span class="pre">kafka</span></code></dt><dd><ul class="simple">
 <li><p><code class="docutils literal notranslate"><span class="pre">hosts</span></code> - str: A comma separated list of Kafka hosts</p></li>
+</ul>
+</dd>
+</dl>
+<ul class="simple">
 <li><p><code class="docutils literal notranslate"><span class="pre">user</span></code> - str: The Kafka user</p></li>
 <li><p><code class="docutils literal notranslate"><span class="pre">passsword</span></code> - str: The Kafka password</p></li>
 <li><p><code class="docutils literal notranslate"><span class="pre">ssl</span></code> - bool: Use an encrypted SSL/TLS connection (Default: True)</p></li>
-<li><p><code class="docutils literal notranslate"><span class="pre">skip_certificate_verification</span></code> - bool: Skip certificate verification (not recommended)</p></li>
+<li><p><code class="docutils literal notranslate"><span class="pre">skip_certificate_verification</span></code> - bool: Skip certificate
+verification (not recommended)</p></li>
 <li><p><code class="docutils literal notranslate"><span class="pre">aggregate_topic</span></code> - str: The Kafka topic for aggregate reports</p></li>
 <li><p><code class="docutils literal notranslate"><span class="pre">forensic_topic</span></code> - str: The Kafka topic for forensic reports</p></li>
 </ul>
-</dd>
-</dl>
 </li>
-<li><dl>
+<li><dl class="simple myst">
 <dt><code class="docutils literal notranslate"><span class="pre">smtp</span></code></dt><dd><ul class="simple">
 <li><p><code class="docutils literal notranslate"><span class="pre">host</span></code> - str: The SMTP hostname</p></li>
+</ul>
+</dd>
+</dl>
+<ul>
 <li><p><code class="docutils literal notranslate"><span class="pre">port</span></code> - int: The SMTP port (Default: 25)</p></li>
 <li><p><code class="docutils literal notranslate"><span class="pre">ssl</span></code> - bool: Require SSL/TLS instead of using STARTTLS</p></li>
-<li><p><code class="docutils literal notranslate"><span class="pre">skip_certificate_verification</span></code> - bool: Skip certificate verification (not recommended)</p></li>
+<li><p><code class="docutils literal notranslate"><span class="pre">skip_certificate_verification</span></code> - bool: Skip certificate
+verification (not recommended)</p></li>
 <li><p><code class="docutils literal notranslate"><span class="pre">user</span></code> - str: the SMTP username</p></li>
 <li><p><code class="docutils literal notranslate"><span class="pre">password</span></code> - str: the SMTP password</p></li>
 <li><p><code class="docutils literal notranslate"><span class="pre">from</span></code> - str: The From header to use in the email</p></li>
 <li><p><code class="docutils literal notranslate"><span class="pre">to</span></code> - list: A list of email addresses to send to</p></li>
-<li><p><code class="docutils literal notranslate"><span class="pre">subject</span></code> - str: The Subject header to use in the email (Default: parsedmarc report)</p></li>
+<li><p><code class="docutils literal notranslate"><span class="pre">subject</span></code> - str: The Subject header to use in the email
+(Default: parsedmarc report)</p></li>
 <li><p><code class="docutils literal notranslate"><span class="pre">attachment</span></code> - str: The ZIP attachment filenames</p></li>
-<li><p><code class="docutils literal notranslate"><span class="pre">message</span></code> - str: The email message (Default: Please see the attached parsedmarc report.)</p></li>
-</ul>
+<li><p><code class="docutils literal notranslate"><span class="pre">message</span></code> - str: The email message
+(Default: Please see the attached parsedmarc report.)</p>
 <div class="admonition note">
 <p class="admonition-title">Note</p>
-<p><code class="docutils literal notranslate"><span class="pre">%</span></code> characters must be escaped with another <code class="docutils literal notranslate"><span class="pre">%</span></code> character, so use <code class="docutils literal notranslate"><span class="pre">%%</span></code> wherever a <code class="docutils literal notranslate"><span class="pre">%</span></code> character is used.</p>
+<p><code class="docutils literal notranslate"><span class="pre">%</span></code> characters must be escaped with another <code class="docutils literal notranslate"><span class="pre">%</span></code> character,
+so use <code class="docutils literal notranslate"><span class="pre">%%</span></code> wherever a <code class="docutils literal notranslate"><span class="pre">%</span></code> character is used.</p>
 </div>
-</dd>
-</dl>
 </li>
-<li><dl class="simple">
+</ul>
+</li>
+<li><dl class="simple myst">
 <dt><code class="docutils literal notranslate"><span class="pre">s3</span></code></dt><dd><ul class="simple">
 <li><p><code class="docutils literal notranslate"><span class="pre">bucket</span></code> - str: The S3 bucket name</p></li>
+</ul>
+</dd>
+</dl>
+<ul class="simple">
 <li><p><code class="docutils literal notranslate"><span class="pre">path</span></code> - str: The path to upload reports to (Default: /)</p></li>
 <li><p><code class="docutils literal notranslate"><span class="pre">region_name</span></code> - str: The region name (Optional)</p></li>
 <li><p><code class="docutils literal notranslate"><span class="pre">endpoint_url</span></code> - str: The endpoint URL (Optional)</p></li>
 <li><p><code class="docutils literal notranslate"><span class="pre">access_key_id</span></code> - str: The access key id (Optional)</p></li>
 <li><p><code class="docutils literal notranslate"><span class="pre">secret_access_key</span></code> - str: The secret access key (Optional)</p></li>
 </ul>
-</dd>
-</dl>
 </li>
-<li><dl class="simple">
+<li><dl class="simple myst">
 <dt><code class="docutils literal notranslate"><span class="pre">syslog</span></code></dt><dd><ul class="simple">
 <li><p><code class="docutils literal notranslate"><span class="pre">server</span></code> - str: The Syslog server name or IP address</p></li>
+</ul>
+</dd>
+</dl>
+<ul class="simple">
 <li><p><code class="docutils literal notranslate"><span class="pre">port</span></code> - int: The UDP port to use (Default: 514)</p></li>
 </ul>
-</dd>
-</dl>
 </li>
-<li><dl class="simple">
+<li><dl class="simple myst">
 <dt><code class="docutils literal notranslate"><span class="pre">gmail_api</span></code></dt><dd><ul class="simple">
-<li><p><code class="docutils literal notranslate"><span class="pre">gmail_api_credentials_file</span></code> - str: Path to file containing the credentials, None to disable (Default: None)</p></li>
-<li><p><code class="docutils literal notranslate"><span class="pre">gmail_api_token_file</span></code> - str: Path to save the token file (Default: .token)</p></li>
-<li><p><code class="docutils literal notranslate"><span class="pre">gmail_api_include_spam_trash</span></code> - bool: Include messages in Spam and Trash when searching reports (Default: False)</p></li>
-<li><p><code class="docutils literal notranslate"><span class="pre">gmail_api_scopes</span></code> - str: Comma separated list of scopes to use when acquiring credentials (Default: <a class="reference external" href="https://www.googleapis.com/auth/gmail.modify">https://www.googleapis.com/auth/gmail.modify</a>)</p></li>
+<li><p><code class="docutils literal notranslate"><span class="pre">credentials_file</span></code> - str: Path to file containing the
+credentials, None to disable (Default: None)</p></li>
 </ul>
 </dd>
 </dl>
+<ul class="simple">
+<li><p><code class="docutils literal notranslate"><span class="pre">token_file</span></code> - str: Path to save the token file
+(Default: .token)</p></li>
+<li><p><code class="docutils literal notranslate"><span class="pre">include_spam_trash</span></code> - bool: Include messages in Spam and
+Trash when searching reports (Default: False)</p></li>
+<li><p><code class="docutils literal notranslate"><span class="pre">scopes</span></code> - str: Comma separated list of scopes to use when
+acquiring credentials (Default: <a class="reference external" href="https://www.googleapis.com/auth/gmail.modify">https://www.googleapis.com/auth/gmail.modify</a>)</p></li>
+<li><p><code class="docutils literal notranslate"><span class="pre">oauth2_port</span></code> - int: The TCP port for the local server to
+listen on for the OAuth2 response (Default: 8080)</p></li>
+</ul>
 </li>
 </ul>
 <div class="admonition warning">
 <p class="admonition-title">Warning</p>
-<p>It is <strong>strongly recommended</strong> to <strong>not</strong> use the <code class="docutils literal notranslate"><span class="pre">nameservers</span></code> setting.
-By default, <code class="docutils literal notranslate"><span class="pre">parsedmarc</span></code> uses <a class="reference external" href="https://1.1.1.1/">Cloudflare’s public resolvers</a>,
-which are much faster and more reliable than Google, Cisco OpenDNS, or
-even most local resolvers.</p>
-<p>The <code class="docutils literal notranslate"><span class="pre">nameservers</span></code> option should only be used if your network blocks DNS
-requests to outside resolvers.</p>
+<p>It is <strong>strongly recommended</strong> to <strong>not</strong> use the <code class="docutils literal notranslate"><span class="pre">nameservers</span></code>
+setting. By default, <code class="docutils literal notranslate"><span class="pre">parsedmarc</span></code> uses
+<a class="reference external" href="https://1.1.1.1/">Cloudflare’s public resolvers</a>, which are much faster and more
+reliable than Google, Cisco OpenDNS, or even most local resolvers.</p>
+<p>The <code class="docutils literal notranslate"><span class="pre">nameservers</span></code> option should only be used if your network
+blocks DNS requests to outside resolvers.</p>
 </div>
 <div class="admonition warning">
 <p class="admonition-title">Warning</p>
-<p><code class="docutils literal notranslate"><span class="pre">save_aggregate</span></code> and <code class="docutils literal notranslate"><span class="pre">save_forensic</span></code> are separate options because
-you may not want to save forensic reports (also known as failure reports)
-to your Elasticsearch instance, particularly if you are in a
-highly-regulated industry that handles sensitive data, such as healthcare
-or finance. If your legitimate outgoing email fails DMARC, it is possible
+<p><code class="docutils literal notranslate"><span class="pre">save_aggregate</span></code> and <code class="docutils literal notranslate"><span class="pre">save_forensic</span></code> are separate options
+because you may not want to save forensic reports
+(also known as failure reports) to your Elasticsearch instance,
+particularly if you are in a highly-regulated industry that
+handles sensitive data, such as healthcare or finance. If your
+legitimate outgoing email fails DMARC, it is possible
 that email may appear later in a forensic report.</p>
-<p>Forensic reports contain the original headers of an email that failed a
-DMARC check, and sometimes may also include the full message body,
-depending on the policy of the reporting organization.</p>
-<p>Most reporting organizations do not send forensic reports of any kind for
-privacy reasons. While aggregate DMARC reports are sent at least daily,
-it is normal to receive very few forensic reports.</p>
-<p>An alternative approach is to still collect forensic/failure/ruf reports
-in your DMARC inbox, but run <code class="docutils literal notranslate"><span class="pre">parsedmarc</span></code> with <code class="docutils literal notranslate"><span class="pre">save_forensic</span> <span class="pre">=</span> <span class="pre">True</span></code>
-manually on a separate IMAP folder (using the  <code class="docutils literal notranslate"><span class="pre">reports_folder</span></code> option),
-after you have manually moved known samples you want to save to that
-folder (e.g. malicious samples and non-sensitive legitimate samples).</p>
+<p>Forensic reports contain the original headers of an email that
+failed a DMARC check, and sometimes may also include the
+full message body, depending on the policy of the reporting
+organization.</p>
+<p>Most reporting organizations do not send forensic reports of any
+kind for privacy reasons. While aggregate DMARC reports are sent
+at least daily, it is normal to receive very few forensic reports.</p>
+<p>An alternative approach is to still collect forensic/failure/ruf
+reports in your DMARC inbox, but run <code class="docutils literal notranslate"><span class="pre">parsedmarc</span></code> with
+<code class="docutils literal notranslate"><span class="pre">save_forensic</span> <span class="pre">=</span> <span class="pre">True``manually</span> <span class="pre">on</span> <span class="pre">a</span> <span class="pre">separate</span> <span class="pre">IMAP</span> <span class="pre">folder</span> <span class="pre">(using</span> <span class="pre">the</span>&#160; <span class="pre">``reports_folder</span></code> option), after you have manually moved
+known samples you want to save to that folder
+(e.g. malicious samples and non-sensitive legitimate samples).</p>
 </div>
 </section>
 <section id="sample-aggregate-report-output">
 <h2>Sample aggregate report output<a class="headerlink" href="#sample-aggregate-report-output" title="Permalink to this heading"></a></h2>
 <p>Here are the results from parsing the <a class="reference external" href="https://dmarc.org/wiki/FAQ#I_need_to_implement_aggregate_reports.2C_what_do_they_look_like.3F">example</a>
-report from the dmarc.org wiki. It’s actually an older draft of the the 1.0
+report from the <a class="reference external" href="http://dmarc.org">dmarc.org</a> wiki. It’s actually an older draft of the the 1.0
 report schema standardized in
 <a class="reference external" href="https://tools.ietf.org/html/rfc7489#appendix-C">RFC 7480 Appendix C</a>.
 This draft schema is still in wide use.</p>
-<p><code class="docutils literal notranslate"><span class="pre">parsedmarc</span></code> produces consistent, normalized output, regardless of the report
-schema.</p>
+<p><code class="docutils literal notranslate"><span class="pre">parsedmarc</span></code> produces consistent, normalized output, regardless
+of the report schema.</p>
 <section id="json">
 <h3>JSON<a class="headerlink" href="#json" title="Permalink to this heading"></a></h3>
 <div class="highlight-json notranslate"><div class="highlight"><pre><span></span><span class="p">{</span><span class="w"></span>
@@ -575,8 +662,8 @@ schema.</p>
 </section>
 <section id="csv">
 <h3>CSV<a class="headerlink" href="#csv" title="Permalink to this heading"></a></h3>
-<div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="n">xml_schema</span><span class="p">,</span><span class="n">org_name</span><span class="p">,</span><span class="n">org_email</span><span class="p">,</span><span class="n">org_extra_contact_info</span><span class="p">,</span><span class="n">report_id</span><span class="p">,</span><span class="n">begin_date</span><span class="p">,</span><span class="n">end_date</span><span class="p">,</span><span class="n">errors</span><span class="p">,</span><span class="n">domain</span><span class="p">,</span><span class="n">adkim</span><span class="p">,</span><span class="n">aspf</span><span class="p">,</span><span class="n">p</span><span class="p">,</span><span class="n">sp</span><span class="p">,</span><span class="n">pct</span><span class="p">,</span><span class="n">fo</span><span class="p">,</span><span class="n">source_ip_address</span><span class="p">,</span><span class="n">source_country</span><span class="p">,</span><span class="n">source_reverse_dns</span><span class="p">,</span><span class="n">source_base_domain</span><span class="p">,</span><span class="n">count</span><span class="p">,</span><span class="n">spf_aligned</span><span class="p">,</span><span class="n">dkim_aligned</span><span class="p">,</span><span class="n">dmarc_aligned</span><span class="p">,</span><span class="n">disposition</span><span class="p">,</span><span class="n">policy_override_reasons</span><span class="p">,</span><span class="n">policy_override_comments</span><span class="p">,</span><span class="n">envelope_from</span><span class="p">,</span><span class="n">header_from</span><span class="p">,</span><span class="n">envelope_to</span><span class="p">,</span><span class="n">dkim_domains</span><span class="p">,</span><span class="n">dkim_selectors</span><span class="p">,</span><span class="n">dkim_results</span><span class="p">,</span><span class="n">spf_domains</span><span class="p">,</span><span class="n">spf_scopes</span><span class="p">,</span><span class="n">spf_results</span>
-<span class="n">draft</span><span class="p">,</span><span class="n">acme</span><span class="o">.</span><span class="n">com</span><span class="p">,</span><span class="n">noreply</span><span class="o">-</span><span class="n">dmarc</span><span class="o">-</span><span class="n">support</span><span class="nd">@acme</span><span class="o">.</span><span class="n">com</span><span class="p">,</span><span class="n">http</span><span class="p">:</span><span class="o">//</span><span class="n">acme</span><span class="o">.</span><span class="n">com</span><span class="o">/</span><span class="n">dmarc</span><span class="o">/</span><span class="n">support</span><span class="p">,</span><span class="mi">9391651994964116463</span><span class="p">,</span><span class="mi">2012</span><span class="o">-</span><span class="mi">04</span><span class="o">-</span><span class="mi">27</span> <span class="mi">20</span><span class="p">:</span><span class="mi">00</span><span class="p">:</span><span class="mi">00</span><span class="p">,</span><span class="mi">2012</span><span class="o">-</span><span class="mi">04</span><span class="o">-</span><span class="mi">28</span> <span class="mi">19</span><span class="p">:</span><span class="mi">59</span><span class="p">:</span><span class="mi">59</span><span class="p">,,</span><span class="n">example</span><span class="o">.</span><span class="n">com</span><span class="p">,</span><span class="n">r</span><span class="p">,</span><span class="n">r</span><span class="p">,</span><span class="n">none</span><span class="p">,</span><span class="n">none</span><span class="p">,</span><span class="mi">100</span><span class="p">,</span><span class="mi">0</span><span class="p">,</span><span class="mf">72.150.241.94</span><span class="p">,</span><span class="n">US</span><span class="p">,</span><span class="n">adsl</span><span class="o">-</span><span class="mi">72</span><span class="o">-</span><span class="mi">150</span><span class="o">-</span><span class="mi">241</span><span class="o">-</span><span class="mf">94.</span><span class="n">shv</span><span class="o">.</span><span class="n">bellsouth</span><span class="o">.</span><span class="n">net</span><span class="p">,</span><span class="n">bellsouth</span><span class="o">.</span><span class="n">net</span><span class="p">,</span><span class="mi">2</span><span class="p">,</span><span class="kc">True</span><span class="p">,</span><span class="kc">False</span><span class="p">,</span><span class="kc">True</span><span class="p">,</span><span class="n">none</span><span class="p">,,,</span><span class="n">example</span><span class="o">.</span><span class="n">com</span><span class="p">,</span><span class="n">example</span><span class="o">.</span><span class="n">com</span><span class="p">,,</span><span class="n">example</span><span class="o">.</span><span class="n">com</span><span class="p">,</span><span class="n">none</span><span class="p">,</span><span class="n">fail</span><span class="p">,</span><span class="n">example</span><span class="o">.</span><span class="n">com</span><span class="p">,</span><span class="n">mfrom</span><span class="p">,</span><span class="k">pass</span>
+<div class="highlight-text notranslate"><div class="highlight"><pre><span></span>xml_schema,org_name,org_email,org_extra_contact_info,report_id,begin_date,end_date,errors,domain,adkim,aspf,p,sp,pct,fo,source_ip_address,source_country,source_reverse_dns,source_base_domain,count,spf_aligned,dkim_aligned,dmarc_aligned,disposition,policy_override_reasons,policy_override_comments,envelope_from,header_from,envelope_to,dkim_domains,dkim_selectors,dkim_results,spf_domains,spf_scopes,spf_results
+draft,acme.com,noreply-dmarc-support@acme.com,http://acme.com/dmarc/support,9391651994964116463,2012-04-27 20:00:00,2012-04-28 19:59:59,,example.com,r,r,none,none,100,0,72.150.241.94,US,adsl-72-150-241-94.shv.bellsouth.net,bellsouth.net,2,True,False,True,none,,,example.com,example.com,,example.com,none,fail,example.com,mfrom,pass
 </pre></div>
 </div>
 </section>
@@ -676,8 +763,8 @@ schema.</p>
 </section>
 <section id="id2">
 <h3>CSV<a class="headerlink" href="#id2" title="Permalink to this heading"></a></h3>
-<div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="n">feedback_type</span><span class="p">,</span><span class="n">user_agent</span><span class="p">,</span><span class="n">version</span><span class="p">,</span><span class="n">original_envelope_id</span><span class="p">,</span><span class="n">original_mail_from</span><span class="p">,</span><span class="n">original_rcpt_to</span><span class="p">,</span><span class="n">arrival_date</span><span class="p">,</span><span class="n">arrival_date_utc</span><span class="p">,</span><span class="n">subject</span><span class="p">,</span><span class="n">message_id</span><span class="p">,</span><span class="n">authentication_results</span><span class="p">,</span><span class="n">dkim_domain</span><span class="p">,</span><span class="n">source_ip_address</span><span class="p">,</span><span class="n">source_country</span><span class="p">,</span><span class="n">source_reverse_dns</span><span class="p">,</span><span class="n">source_base_domain</span><span class="p">,</span><span class="n">delivery_result</span><span class="p">,</span><span class="n">auth_failure</span><span class="p">,</span><span class="n">reported_domain</span><span class="p">,</span><span class="n">authentication_mechanisms</span><span class="p">,</span><span class="n">sample_headers_only</span>
-<span class="n">auth</span><span class="o">-</span><span class="n">failure</span><span class="p">,</span><span class="n">Lua</span><span class="o">/</span><span class="mf">1.0</span><span class="p">,</span><span class="mf">1.0</span><span class="p">,,</span><span class="n">sharepoint</span><span class="nd">@domain</span><span class="o">.</span><span class="n">de</span><span class="p">,</span><span class="n">peter</span><span class="o">.</span><span class="n">pan</span><span class="nd">@domain</span><span class="o">.</span><span class="n">de</span><span class="p">,</span><span class="s2">&quot;Mon, 01 Oct 2018 11:20:27 +0200&quot;</span><span class="p">,</span><span class="mi">2018</span><span class="o">-</span><span class="mi">10</span><span class="o">-</span><span class="mi">01</span> <span class="mi">09</span><span class="p">:</span><span class="mi">20</span><span class="p">:</span><span class="mi">27</span><span class="p">,</span><span class="n">Subject</span><span class="p">,</span><span class="o">&lt;</span><span class="mf">38.E7.30937</span><span class="o">.</span><span class="n">BD6E1BB5</span><span class="o">@</span> <span class="n">mailrelay</span><span class="o">.</span><span class="n">de</span><span class="o">&gt;</span><span class="p">,</span><span class="s2">&quot;dmarc=fail (p=none, dis=none) header.from=domain.de&quot;</span><span class="p">,,</span><span class="mf">10.10.10.10</span><span class="p">,,,,</span><span class="n">policy</span><span class="p">,</span><span class="n">dmarc</span><span class="p">,</span><span class="n">domain</span><span class="o">.</span><span class="n">de</span><span class="p">,,</span><span class="kc">False</span>
+<div class="highlight-text notranslate"><div class="highlight"><pre><span></span>feedback_type,user_agent,version,original_envelope_id,original_mail_from,original_rcpt_to,arrival_date,arrival_date_utc,subject,message_id,authentication_results,dkim_domain,source_ip_address,source_country,source_reverse_dns,source_base_domain,delivery_result,auth_failure,reported_domain,authentication_mechanisms,sample_headers_only
+auth-failure,Lua/1.0,1.0,,sharepoint@domain.de,peter.pan@domain.de,&quot;Mon, 01 Oct 2018 11:20:27 +0200&quot;,2018-10-01 09:20:27,Subject,&lt;38.E7.30937.BD6E1BB5@ mailrelay.de&gt;,&quot;dmarc=fail (p=none, dis=none) header.from=domain.de&quot;,,10.10.10.10,,,,policy,dmarc,domain.de,,False
 </pre></div>
 </div>
 </section>
@@ -695,15 +782,15 @@ schema.</p>
 <p>If your system is behind a web proxy, you need to configure your system
 to use that proxy. To do this, edit <code class="docutils literal notranslate"><span class="pre">/etc/environment</span></code> and add your
 proxy details there, for example:</p>
-<div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="n">http_proxy</span><span class="o">=</span><span class="n">http</span><span class="p">:</span><span class="o">//</span><span class="n">user</span><span class="p">:</span><span class="n">password</span><span class="nd">@prox</span><span class="o">-</span><span class="n">server</span><span class="p">:</span><span class="mi">3128</span>
-<span class="n">https_proxy</span><span class="o">=</span><span class="n">https</span><span class="p">:</span><span class="o">//</span><span class="n">user</span><span class="p">:</span><span class="n">password</span><span class="nd">@prox</span><span class="o">-</span><span class="n">server</span><span class="p">:</span><span class="mi">3128</span>
-<span class="n">ftp_proxy</span><span class="o">=</span><span class="n">http</span><span class="p">:</span><span class="o">//</span><span class="n">user</span><span class="p">:</span><span class="n">password</span><span class="nd">@prox</span><span class="o">-</span><span class="n">server</span><span class="p">:</span><span class="mi">3128</span>
+<div class="highlight-bash notranslate"><div class="highlight"><pre><span></span><span class="nv">http_proxy</span><span class="o">=</span>http://user:password@prox-server:3128
+<span class="nv">https_proxy</span><span class="o">=</span>https://user:password@prox-server:3128
+<span class="nv">ftp_proxy</span><span class="o">=</span>http://user:password@prox-server:3128
 </pre></div>
 </div>
 <p>Or if no credentials are needed:</p>
-<div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="n">http_proxy</span><span class="o">=</span><span class="n">http</span><span class="p">:</span><span class="o">//</span><span class="n">prox</span><span class="o">-</span><span class="n">server</span><span class="p">:</span><span class="mi">3128</span>
-<span class="n">https_proxy</span><span class="o">=</span><span class="n">https</span><span class="p">:</span><span class="o">//</span><span class="n">prox</span><span class="o">-</span><span class="n">server</span><span class="p">:</span><span class="mi">3128</span>
-<span class="n">ftp_proxy</span><span class="o">=</span><span class="n">http</span><span class="p">:</span><span class="o">//</span><span class="n">prox</span><span class="o">-</span><span class="n">server</span><span class="p">:</span><span class="mi">3128</span>
+<div class="highlight-bash notranslate"><div class="highlight"><pre><span></span><span class="nv">http_proxy</span><span class="o">=</span>http://prox-server:3128
+<span class="nv">https_proxy</span><span class="o">=</span>https://prox-server:3128
+<span class="nv">ftp_proxy</span><span class="o">=</span>http://prox-server:3128
 </pre></div>
 </div>
 <p>This will set the the proxy up for use system-wide, including for
@@ -744,11 +831,14 @@ sudo apt install -y geoipupdate
 <div class="highlight-bash notranslate"><div class="highlight"><pre><span></span>sudo dnf install -y geoipupdate
 </pre></div>
 </div>
-<p>The latest builds for Linux, macOS, and Windows can be downloaded from the <a class="reference external" href="https://github.com/maxmind/geoipupdate/releases">geoipupdate releases page on GitHub</a>.</p>
-<p>On December 30th, 2019, MaxMind started requiring free accounts to access the free Geolite2 databases, in order <a class="reference external" href="https://blog.maxmind.com/2019/12/18/significant-changes-to-accessing-and-using-geolite2-databases/">to
+<p>The latest builds for Linux, macOS, and Windows can be downloaded
+from the <a class="reference external" href="https://github.com/maxmind/geoipupdate/releases">geoipupdate releases page on GitHub</a>.</p>
+<p>On December 30th, 2019, MaxMind started requiring free accounts to
+access the free Geolite2 databases, in order <a class="reference external" href="https://blog.maxmind.com/2019/12/18/significant-changes-to-accessing-and-using-geolite2-databases/">to
 comply with various privacy regulations</a>.</p>
 <p>Start by <a class="reference external" href="https://www.maxmind.com/en/geolite2/signup">registering for a free GeoLite2 account</a>, and signing in.</p>
-<p>Then, navigate the to the <a class="reference external" href="https://www.maxmind.com/en/accounts/current/license-key">License Keys</a> page under your account, and create a new license key for the version of
+<p>Then, navigate the to the <a class="reference external" href="https://www.maxmind.com/en/accounts/current/license-key">License Keys</a> page under your account,
+and create a new license key for the version of
 <code class="docutils literal notranslate"><span class="pre">geoipupdate</span></code> that was installed.</p>
 <div class="admonition warning">
 <p class="admonition-title">Warning</p>
@@ -763,17 +853,21 @@ of <code class="docutils literal notranslate"><span class="pre">geoipupdate</spa
 </div>
 </div>
 <p>You can use <code class="docutils literal notranslate"><span class="pre">parsedmarc</span></code> as the description for the key.</p>
-<p>Once you have generated a key, download the config pre-filled configuration file.
-This file should be saved at <code class="docutils literal notranslate"><span class="pre">/etc/GeoIP.conf</span></code> on Linux or macOS systems, or at
-<code class="docutils literal notranslate"><span class="pre">%SystemDrive%\ProgramData\MaxMind\GeoIPUpdate\GeoIP.conf</span></code> on Windows systems.</p>
+<p>Once you have generated a key, download the config pre-filled
+configuration file. This file should be saved at <code class="docutils literal notranslate"><span class="pre">/etc/GeoIP.conf</span></code>
+on Linux or macOS systems, or at
+<code class="docutils literal notranslate"><span class="pre">%SystemDrive%\ProgramData\MaxMind\GeoIPUpdate\GeoIP.conf</span></code> on
+Windows systems.</p>
 <p>Then run</p>
 <div class="highlight-bash notranslate"><div class="highlight"><pre><span></span>sudo geoipupdate
 </pre></div>
 </div>
 <p>To download the databases for the first time.</p>
-<p>The GeoLite2 Country, City, and ASN databases are updated weekly, every Tuesday.
-<code class="docutils literal notranslate"><span class="pre">geoipupdate</span></code> can be run weekly by adding a cron job or scheduled task.</p>
-<p>More information about <code class="docutils literal notranslate"><span class="pre">geoipupdate</span></code> can be found at the <a class="reference external" href="https://dev.maxmind.com/geoip/geoipupdate/">MaxMind geoipupdate page</a>.</p>
+<p>The GeoLite2 Country, City, and ASN databases are updated weekly,
+every Tuesday. <code class="docutils literal notranslate"><span class="pre">geoipupdate</span></code> can be run weekly by adding a cron
+job or scheduled task.</p>
+<p>More information about <code class="docutils literal notranslate"><span class="pre">geoipupdate</span></code> can be found at the
+<a class="reference external" href="https://dev.maxmind.com/geoip/geoipupdate/">MaxMind geoipupdate page</a>.</p>
 </section>
 <section id="installing-parsedmarc">
 <h3>Installing parsedmarc<a class="headerlink" href="#installing-parsedmarc" title="Permalink to this heading"></a></h3>
@@ -796,7 +890,8 @@ sudo useradd parsedmarc -r -s /bin/false -m -b /opt
 <div class="highlight-bash notranslate"><div class="highlight"><pre><span></span>sudo -u parsedmarc virtualenv /opt/parsedmarc/venv
 </pre></div>
 </div>
-<p>CentOS/RHEL 8 systems use Python 3.6 by default, so on those systems explicitly tell <code class="docutils literal notranslate"><span class="pre">virtualenv</span></code> to use <code class="docutils literal notranslate"><span class="pre">python3.9</span></code> instead</p>
+<p>CentOS/RHEL 8 systems use Python 3.6 by default, so on those systems
+explicitly tell <code class="docutils literal notranslate"><span class="pre">virtualenv</span></code> to use <code class="docutils literal notranslate"><span class="pre">python3.9</span></code> instead</p>
 <div class="highlight-bash notranslate"><div class="highlight"><pre><span></span>sudo -u parsedmarc virtualenv -p python3.9  /opt/parsedmarc/venv
 </pre></div>
 </div>
@@ -827,7 +922,7 @@ tags in your DMARC record, separated by commas.</p>
 <p>Starting in 8.0.0, parsedmarc supports accessing Microsoft/Office 365
 inboxes via the Microsoft Graph API, which is preferred over Davmail.</p>
 </div>
-<p>Some organisations do not allow IMAP or the Microsoft Graph API,
+<p>Some organizations do not allow IMAP or the Microsoft Graph API,
 and only support Exchange Web Services (EWS)/Outlook Web Access (OWA).
 In that case, Davmail will need to be set up
 as a local EWS/OWA IMAP gateway. It can even work where
@@ -964,7 +1059,7 @@ sudo service davmail restart
 <div class="admonition note">
 <p class="admonition-title">Note</p>
 <p>In the event of a crash, systemd will restart the service after 5 minutes,
-but the <cite>service davmail status</cite> command will only show the logs for the
+but the <code class="docutils literal notranslate"><span class="pre">service</span> <span class="pre">davmail</span> <span class="pre">status</span></code> command will only show the logs for the
 current process. To vew the logs for previous runs as well as the
 current process (newest to oldest), run:</p>
 <div class="highlight-bash notranslate"><div class="highlight"><pre><span></span>journalctl -u davmail.service -r
@@ -1032,7 +1127,8 @@ sudo service elasticsearch start
 sudo service kibana start
 </pre></div>
 </div>
-<p>Without the commercial <a class="reference external" href="https://www.elastic.co/products/x-pack">X-Pack</a> or <a class="reference external" href="https://readonlyrest.com/">ReadonlyREST</a> products, Kibana does not have any authentication
+<p>Without the commercial <a class="reference external" href="https://www.elastic.co/products/x-pack">X-Pack</a> or <a class="reference external" href="https://readonlyrest.com/">ReadonlyREST</a> products, Kibana
+does not have any authentication
 mechanism of its own. You can use nginx as a reverse proxy that provides basic
 authentication.</p>
 <div class="highlight-bash notranslate"><div class="highlight"><pre><span></span>sudo apt-get install -y nginx apache2-utils
@@ -1241,7 +1337,7 @@ sudo service parsedmarc restart
 <div class="admonition note">
 <p class="admonition-title">Note</p>
 <p>In the event of a crash, systemd will restart the service after 10 minutes,
-but the <cite>service parsedmarc status</cite> command will only show the logs for the
+but the <code class="docutils literal notranslate"><span class="pre">service</span> <span class="pre">parsedmarc</span> <span class="pre">status</span></code> command will only show the logs for the
 current process. To vew the logs for previous runs as well as the
 current process (newest to oldest), run:</p>
 <div class="highlight-bash notranslate"><div class="highlight"><pre><span></span>journalctl -u parsedmarc.service -r
@@ -1377,8 +1473,8 @@ header</p></td>
 </tbody>
 </table>
 </section>
-<section id="what-if-a-sender-won-t-support-dkim-dmarc">
-<h2>What if a sender won’t support DKIM/DMARC?<a class="headerlink" href="#what-if-a-sender-won-t-support-dkim-dmarc" title="Permalink to this heading"></a></h2>
+<section id="what-if-a-sender-wont-support-dkim-dmarc">
+<h2>What if a sender won’t support DKIM/DMARC?<a class="headerlink" href="#what-if-a-sender-wont-support-dkim-dmarc" title="Permalink to this heading"></a></h2>
 <ol class="arabic simple">
 <li><p>Some vendors don’t know about DMARC yet; ask about SPF and DKIM/email
 authentication.</p></li>
@@ -1393,44 +1489,46 @@ separate SPF and DMARC records on <code class="docutils literal notranslate"><sp
 <div class="admonition warning">
 <p class="admonition-title">Warning</p>
 <p>Do not alter the <code class="docutils literal notranslate"><span class="pre">p</span></code> or <code class="docutils literal notranslate"><span class="pre">sp</span></code> values of the DMARC record on the
-Top-Level Domain (TLD) – that would leave you vulnerable to spoofing of
-your TLD and/or any subdomain.</p>
+Top-Level Domain (TLD) – that would leave you vulnerable to
+spoofing of your TLD and/or any subdomain.</p>
 </div>
 </section>
 <section id="what-about-mailing-lists">
 <h2>What about mailing lists?<a class="headerlink" href="#what-about-mailing-lists" title="Permalink to this heading"></a></h2>
-<p>When you deploy DMARC on your domain, you might find that messages relayed by
-mailing lists are failing DMARC, most likely because the mailing list is
-spoofing your from address, and modifying the subject, footer, or other part
-of the message, thereby breaking the DKIM signature.</p>
+<p>When you deploy DMARC on your domain, you might find that messages
+relayed by mailing lists are failing DMARC, most likely because the mailing
+list is spoofing your from address, and modifying the subject,
+footer, or other part of the message, thereby breaking the
+DKIM signature.</p>
 <section id="mailing-list-list-best-practices">
 <h3>Mailing list list best practices<a class="headerlink" href="#mailing-list-list-best-practices" title="Permalink to this heading"></a></h3>
-<p>Ideally, a mailing list should forward messages without altering the headers
-or body content at all. <a class="reference external" href="https://begriffs.com/posts/2018-09-18-dmarc-mailing-list.html">Joe Nelson</a> does a fantastic job of explaining exactly
-what mailing lists should and shouldn’t do to be fully DMARC compliant.
-Rather than repeat his fine work, here’s a summary:</p>
-<p><strong>Do</strong></p>
-<ul>
+<p>Ideally, a mailing list should forward messages without altering the
+headers or body content at all. <a class="reference external" href="https://begriffs.com/posts/2018-09-18-dmarc-mailing-list.html">Joe Nelson</a> does a fantastic job of
+explaining exactly what mailing lists should and shouldn’t do to be
+fully DMARC compliant. Rather than repeat his fine work, here’s a
+summary:</p>
+<section id="do">
+<h4>Do<a class="headerlink" href="#do" title="Permalink to this heading"></a></h4>
+<ul class="simple">
 <li><p>Retain headers from the original message</p></li>
 <li><p>Add <a class="reference external" href="https://tools.ietf.org/html/rfc2369">RFC 2369</a> List-Unsubscribe headers to outgoing messages, instead of
-adding unsubscribe links to the body</p>
+adding unsubscribe links to the body</p></li>
+</ul>
 <blockquote>
-<div><div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="n">List</span><span class="o">-</span><span class="n">Unsubscribe</span><span class="p">:</span> <span class="o">&lt;</span><span class="n">https</span><span class="p">:</span><span class="o">//</span><span class="nb">list</span><span class="o">.</span><span class="n">example</span><span class="o">.</span><span class="n">com</span><span class="o">/</span><span class="n">unsubscribe</span><span class="o">-</span><span class="n">link</span><span class="o">&gt;</span>
-</pre></div>
-</div>
+<div><p>List-Unsubscribe: <a class="reference external" href="https://list.example.com/unsubscribe-link">https://list.example.com/unsubscribe-link</a></p>
 </div></blockquote>
-</li>
+<ul>
 <li><p>Add <a class="reference external" href="https://tools.ietf.org/html/rfc2919">RFC 2919</a> List-Id headers instead of modifying the subject</p>
 <blockquote>
-<div><div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="n">List</span><span class="o">-</span><span class="n">Id</span><span class="p">:</span> <span class="n">Example</span> <span class="n">Mailing</span> <span class="n">List</span> <span class="o">&lt;</span><span class="nb">list</span><span class="o">.</span><span class="n">example</span><span class="o">.</span><span class="n">com</span><span class="o">&gt;</span>
-</pre></div>
-</div>
+<div><p>List-Id: Example Mailing List &lt;<a class="reference external" href="http://list.example.com">list.example.com</a>&gt;</p>
 </div></blockquote>
 </li>
 </ul>
 <p>Modern mail clients and webmail services generate unsubscribe buttons based on
 these headers.</p>
-<p><strong>Do not</strong></p>
+</section>
+<section id="do-not">
+<h4>Do not<a class="headerlink" href="#do-not" title="Permalink to this heading"></a></h4>
 <ul class="simple">
 <li><p>Remove or modify any existing headers from the original message, including
 From, Date, Subject, etc.</p></li>
@@ -1445,6 +1543,7 @@ list.</p>
 tell that a message came from the mailing list, because the message was sent
 to the mailing list post address, and not their email address.</p>
 <p>Configuration steps for common mailing list platforms are listed below.</p>
+</section>
 <section id="mailman-2">
 <h4>Mailman 2<a class="headerlink" href="#mailman-2" title="Permalink to this heading"></a></h4>
 <p>Navigate to General Settings, and configure the settings below</p>
@@ -1514,7 +1613,7 @@ to the mailing list post address, and not their email address.</p>
 <tr class="row-even"><td><p><strong>dmarc_moderation_action</strong></p></td>
 <td><p>Accept</p></td>
 </tr>
-<tr class="row-odd"><td><p><strong>dmarc_quarentine_moderation_action</strong></p></td>
+<tr class="row-odd"><td><p><strong>dmarc_quarantine_moderation_action</strong></p></td>
 <td><p>Yes</p></td>
 </tr>
 <tr class="row-even"><td><p><strong>dmarc_none_moderation_action</strong></p></td>
@@ -1550,7 +1649,7 @@ to the mailing list post address, and not their email address.</p>
 <tr class="row-odd"><td><p><strong>Explicit reply-to address</strong></p></td>
 <td></td>
 </tr>
-<tr class="row-even"><td><p><strong>First strip replyo</strong></p></td>
+<tr class="row-even"><td><p><strong>First strip replyto</strong></p></td>
 <td><p>No</p></td>
 </tr>
 <tr class="row-odd"><td><p><strong>Reply goes to list</strong></p></td>
@@ -1611,7 +1710,7 @@ no longer spoof email addresses with domains protected by DMARC.</p>
 <tr class="row-even"><td><p><strong>dmarc_moderation_action</strong></p></td>
 <td><p>Munge From</p></td>
 </tr>
-<tr class="row-odd"><td><p><strong>dmarc_quarentine_moderation_action</strong></p></td>
+<tr class="row-odd"><td><p><strong>dmarc_quarantine_moderation_action</strong></p></td>
 <td><p>Yes</p></td>
 </tr>
 <tr class="row-even"><td><p><strong>dmarc_none_moderation_action</strong></p></td>
@@ -1823,7 +1922,7 @@ DMARC reports</p>
 <dl class="py function">
 <dt class="sig sig-object py" id="parsedmarc.parse_aggregate_report_file">
 <span class="sig-prename descclassname"><span class="pre">parsedmarc.</span></span><span class="sig-name descname"><span class="pre">parse_aggregate_report_file</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">_input</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">offline</span></span><span class="o"><span class="pre">=</span></span><span class="default_value"><span class="pre">False</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">ip_db_path</span></span><span class="o"><span class="pre">=</span></span><span class="default_value"><span class="pre">None</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">nameservers</span></span><span class="o"><span class="pre">=</span></span><span class="default_value"><span class="pre">None</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">dns_timeout</span></span><span class="o"><span class="pre">=</span></span><span class="default_value"><span class="pre">2.0</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">parallel</span></span><span class="o"><span class="pre">=</span></span><span class="default_value"><span class="pre">False</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">keep_alive</span></span><span class="o"><span class="pre">=</span></span><span class="default_value"><span class="pre">None</span></span></em><span class="sig-paren">)</span><a class="reference internal" href="_modules/parsedmarc.html#parse_aggregate_report_file"><span class="viewcode-link"><span class="pre">[source]</span></span></a><a class="headerlink" href="#parsedmarc.parse_aggregate_report_file" title="Permalink to this definition"></a></dt>
-<dd><p>Parses a file at the given path, a file-like object. or bytes as a
+<dd><p>Parses a file at the given path, a file-like object. or bytes as an
 aggregate DMARC report</p>
 <dl class="field-list simple">
 <dt class="field-odd">Parameters</dt>
@@ -2194,7 +2293,20 @@ index</p></li>
 <dl class="py class">
 <dt class="sig sig-object py" id="parsedmarc.splunk.HECClient">
 <em class="property"><span class="pre">class</span><span class="w"> </span></em><span class="sig-prename descclassname"><span class="pre">parsedmarc.splunk.</span></span><span class="sig-name descname"><span class="pre">HECClient</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">url</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">access_token</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">index</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">source</span></span><span class="o"><span class="pre">=</span></span><span class="default_value"><span class="pre">'parsedmarc'</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">verify</span></span><span class="o"><span class="pre">=</span></span><span class="default_value"><span class="pre">True</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">timeout</span></span><span class="o"><span class="pre">=</span></span><span class="default_value"><span class="pre">60</span></span></em><span class="sig-paren">)</span><a class="reference internal" href="_modules/parsedmarc/splunk.html#HECClient"><span class="viewcode-link"><span class="pre">[source]</span></span></a><a class="headerlink" href="#parsedmarc.splunk.HECClient" title="Permalink to this definition"></a></dt>
-<dd><p>A client for a Splunk HTTP Events Collector (HEC)</p>
+<dd><p>Initializes the HECClient
+:param url: The URL of the HEC
+:type url: str
+:param access_token: The HEC access token
+:type access_token: str
+:param index: The name of the index
+:type index: str
+:param source: The source name
+:type source: str
+:param verify: Verify SSL certificates
+:type verify: bool
+:param timeout: Number of seconds to wait for the server to send
+:type timeout: float
+:param data before giving up:</p>
 <dl class="py method">
 <dt class="sig sig-object py" id="parsedmarc.splunk.HECClient.save_aggregate_reports_to_splunk">
 <span class="sig-name descname"><span class="pre">save_aggregate_reports_to_splunk</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">aggregate_reports</span></span></em><span class="sig-paren">)</span><a class="reference internal" href="_modules/parsedmarc/splunk.html#HECClient.save_aggregate_reports_to_splunk"><span class="viewcode-link"><span class="pre">[source]</span></span></a><a class="headerlink" href="#parsedmarc.splunk.HECClient.save_aggregate_reports_to_splunk" title="Permalink to this definition"></a></dt>
diff --git a/objects.inv b/objects.inv
index 0952f11..a7a9e9b 100644
Binary files a/objects.inv and b/objects.inv differ
diff --git a/py-modindex.html b/py-modindex.html
index 8086564..6a33e72 100644
--- a/py-modindex.html
+++ b/py-modindex.html
@@ -3,7 +3,7 @@
 <head>
   <meta charset="utf-8" />
   <meta name="viewport" content="width=device-width, initial-scale=1.0" />
-  <title>Python Module Index &mdash; parsedmarc 8.3.0 documentation</title>
+  <title>Python Module Index &mdash; parsedmarc 8.3.1 documentation</title>
       <link rel="stylesheet" href="_static/pygments.css" type="text/css" />
       <link rel="stylesheet" href="_static/css/theme.css" type="text/css" />
   <!--[if lt IE 9]>
@@ -31,7 +31,7 @@
             <a href="index.html" class="icon icon-home"> parsedmarc
           </a>
               <div class="version">
-                8.3.0
+                8.3.1
               </div>
 <div role="search">
   <form id="rtd-search-form" class="wy-form" action="search.html" method="get">
diff --git a/search.html b/search.html
index e269f09..fda7565 100644
--- a/search.html
+++ b/search.html
@@ -3,7 +3,7 @@
 <head>
   <meta charset="utf-8" />
   <meta name="viewport" content="width=device-width, initial-scale=1.0" />
-  <title>Search &mdash; parsedmarc 8.3.0 documentation</title>
+  <title>Search &mdash; parsedmarc 8.3.1 documentation</title>
       <link rel="stylesheet" href="_static/pygments.css" type="text/css" />
       <link rel="stylesheet" href="_static/css/theme.css" type="text/css" />
     
@@ -31,7 +31,7 @@
             <a href="index.html" class="icon icon-home"> parsedmarc
           </a>
               <div class="version">
-                8.3.0
+                8.3.1
               </div>
 <div role="search">
   <form id="rtd-search-form" class="wy-form" action="#" method="get">
diff --git a/searchindex.js b/searchindex.js
index ff91acb..e17af60 100644
--- a/searchindex.js
+++ b/searchindex.js
@@ -1 +1 @@
-Search.setIndex({"docnames": ["index"], "filenames": ["index.rst"], "titles": ["parsedmarc documentation - Open source DMARC report analyzer and visualizer"], "terms": {"want": 0, "thi": 0, "project": 0, "maintain": 0, "one": 0, "develop": 0, "pleas": 0, "consid": 0, "review": 0, "issu": 0, "see": 0, "how": 0, "you": 0, "can": 0, "contribut": 0, "code": 0, "user": 0, "assist": 0, "pin": 0, "would": 0, "particularli": 0, "thank": 0, "all": 0, "contributor": 0, "python": 0, "modul": 0, "pars": 0, "when": 0, "work": 0, "self": 0, "host": 0, "altern": 0, "commerci": 0, "process": 0, "agari": 0, "brand": 0, "protect": 0, "dmarcian": 0, "ondmarc": 0, "proofpoint": 0, "email": 0, "fraud": 0, "defens": 0, "valimail": 0, "draft": 0, "1": 0, "0": 0, "standard": 0, "rua": 0, "failur": 0, "ruf": 0, "from": 0, "over": 0, "imap": 0, "microsoft": 0, "graph": 0, "gmail": 0, "transpar": 0, "handl": 0, "gzip": 0, "zip": 0, "compress": 0, "consist": 0, "data": 0, "structur": 0, "simpl": 0, "result": 0, "send": 0, "premad": 0, "apach": 0, "kafka": 0, "demystifi": 0, "A": 0, "complet": 0, "If": 0, "ar": 0, "look": 0, "check": 0, "out": 0, "sister": 0, "checkdmarc": 0, "against": 0, "spoof": 0, "monitor": 0, "domainawar": 0, "usag": 0, "h": 0, "c": 0, "config_fil": 0, "strip": 0, "attach": 0, "payload": 0, "o": 0, "filenam": 0, "aggregate_json_filenam": 0, "forensic_json_filenam": 0, "aggregate_csv_filenam": 0, "forensic_csv_filenam": 0, "n": 0, "nameserv": 0, "dns_timeout": 0, "offlin": 0, "s": 0, "verbos": 0, "debug": 0, "log": 0, "log_fil": 0, "v": 0, "file_path": 0, "posit": 0, "argument": 0, "more": 0, "path": 0, "mbox": 0, "show": 0, "messag": 0, "exit": 0, "config": 0, "silent": 0, "impli": 0, "remov": 0, "write": 0, "given": 0, "directori": 0, "queri": 0, "number": 0, "second": 0, "wait": 0, "answer": 0, "dn": 0, "default": 0, "do": 0, "make": 0, "onlin": 0, "geoloc": 0, "onli": 0, "print": 0, "error": 0, "warn": 0, "inform": 0, "version": 0, "program": 0, "start": 0, "6": 0, "most": 0, "were": 0, "move": 0, "describ": 0, "below": 0, "suppli": 0, "ini": 0, "etc": 0, "For": 0, "exampl": 0, "comment": 0, "gener": 0, "save_aggreg": 0, "true": 0, "save_forens": 0, "com": 0, "dmarcresport": 0, "password": 0, "upersecur": 0, "mailbox": 0, "watch": 0, "delet": 0, "fals": 0, "127": 0, "9200": 0, "ssl": 0, "splunk_hec": 0, "url": 0, "http": 0, "splunkhec": 0, "token": 0, "hectokengoesher": 0, "s3": 0, "bucket": 0, "my": 0, "syslog": 0, "server": 0, "localhost": 0, "port": 0, "514": 0, "The": 0, "full": 0, "set": 0, "bool": 0, "save": 0, "strip_attachment_payload": 0, "str": 0, "place": 0, "ip_db_path": 0, "custom": 0, "mmdb": 0, "maxmind": 0, "dbip": 0, "comma": 0, "separ": 0, "resolv": 0, "cloudflar": 0, "public": 0, "float": 0, "timeout": 0, "period": 0, "n_proc": 0, "int": 0, "parallel": 0, "mode": 0, "chunk_siz": 0, "give": 0, "each": 0, "larger": 0, "than": 0, "improv": 0, "perform": 0, "thousand": 0, "reports_fold": 0, "folder": 0, "label": 0, "where": 0, "incom": 0, "found": 0, "archive_fold": 0, "sort": 0, "archiv": 0, "idl": 0, "command": 0, "thei": 0, "arriv": 0, "poll": 0, "ms": 0, "new": 0, "after": 0, "them": 0, "instead": 0, "batch_siz": 0, "read": 0, "befor": 0, "10": 0, "limit": 0, "hostnam": 0, "ip": 0, "address": 0, "993": 0, "charact": 0, "must": 0, "escap": 0, "anoth": 0, "so": 0, "wherev": 0, "8": 0, "section": 0, "have": 0, "been": 0, "your": 0, "recommend": 0, "still": 0, "try": 0, "encrypt": 0, "tl": 0, "connect": 0, "skip_certificate_verif": 0, "skip": 0, "certif": 0, "verif": 0, "msgraph": 0, "auth_method": 0, "authent": 0, "method": 0, "type": 0, "usernamepassword": 0, "devicecod": 0, "clientsecret": 0, "m365": 0, "requir": 0, "auth": 0, "client_id": 0, "app": 0, "registr": 0, "client": 0, "id": 0, "client_secret": 0, "secret": 0, "tenant_id": 0, "azur": 0, "ad": 0, "tenant": 0, "except": 0, "name": 0, "current": 0, "could": 0, "share": 0, "ha": 0, "creat": 0, "admin": 0, "grant": 0, "readwrit": 0, "deleg": 0, "permiss": 0, "differ": 0, "usernam": 0, "need": 0, "applic": 0, "also": 0, "restrict": 0, "specif": 0, "sinc": 0, "allow": 0, "applicationaccesspolici": 0, "exchang": 0, "powershel": 0, "scope": 0, "polici": 0, "add": 0, "enabl": 0, "secur": 0, "group": 0, "accessright": 0, "restrictaccess": 0, "appid": 0, "policyscopegroupid": 0, "descript": 0, "e": 0, "g": 0, "special": 0, "encod": 0, "cert_path": 0, "trust": 0, "index_suffix": 0, "suffix": 0, "appli": 0, "monthly_index": 0, "monthli": 0, "daili": 0, "number_of_shard": 0, "shard": 0, "number_of_replica": 0, "replica": 0, "event": 0, "collector": 0, "hec": 0, "passsword": 0, "aggregate_top": 0, "topic": 0, "forensic_top": 0, "smtp": 0, "25": 0, "starttl": 0, "header": 0, "subject": 0, "upload": 0, "region_nam": 0, "region": 0, "endpoint_url": 0, "endpoint": 0, "access_key_id": 0, "kei": 0, "secret_access_kei": 0, "udp": 0, "gmail_api": 0, "gmail_api_credentials_fil": 0, "contain": 0, "credenti": 0, "none": 0, "disabl": 0, "gmail_api_token_fil": 0, "gmail_api_include_spam_trash": 0, "includ": 0, "spam": 0, "trash": 0, "search": 0, "gmail_api_scop": 0, "acquir": 0, "www": 0, "googleapi": 0, "modifi": 0, "It": 0, "strongli": 0, "By": 0, "which": 0, "much": 0, "faster": 0, "reliabl": 0, "googl": 0, "cisco": 0, "opendn": 0, "even": 0, "local": 0, "should": 0, "network": 0, "block": 0, "request": 0, "outsid": 0, "becaus": 0, "mai": 0, "known": 0, "instanc": 0, "highli": 0, "regul": 0, "industri": 0, "sensit": 0, "healthcar": 0, "financ": 0, "legitim": 0, "outgo": 0, "fail": 0, "possibl": 0, "appear": 0, "later": 0, "origin": 0, "sometim": 0, "bodi": 0, "organ": 0, "ani": 0, "kind": 0, "privaci": 0, "reason": 0, "while": 0, "sent": 0, "least": 0, "normal": 0, "receiv": 0, "veri": 0, "few": 0, "approach": 0, "collect": 0, "manual": 0, "malici": 0, "non": 0, "here": 0, "org": 0, "wiki": 0, "actual": 0, "older": 0, "schema": 0, "rfc": 0, "7480": 0, "appendix": 0, "wide": 0, "produc": 0, "regardless": 0, "xml_schema": 0, "report_metadata": 0, "org_nam": 0, "acm": 0, "org_email": 0, "norepli": 0, "org_extra_contact_info": 0, "report_id": 0, "9391651994964116463": 0, "begin_d": 0, "2012": 0, "04": 0, "27": 0, "20": 0, "00": 0, "end_dat": 0, "28": 0, "19": 0, "59": 0, "policy_publish": 0, "adkim": 0, "r": 0, "aspf": 0, "p": 0, "sp": 0, "pct": 0, "100": 0, "fo": 0, "ip_address": 0, "72": 0, "150": 0, "241": 0, "94": 0, "countri": 0, "reverse_dn": 0, "adsl": 0, "shv": 0, "bellsouth": 0, "net": 0, "base_domain": 0, "count": 0, "policy_evalu": 0, "disposit": 0, "pass": 0, "policy_override_reason": 0, "identifi": 0, "header_from": 0, "envelope_from": 0, "envelope_to": 0, "null": 0, "auth_result": 0, "selector": 0, "mfrom": 0, "source_ip_address": 0, "source_countri": 0, "source_reverse_dn": 0, "source_base_domain": 0, "spf_align": 0, "dkim_align": 0, "dmarc_align": 0, "policy_override_com": 0, "dkim_domain": 0, "dkim_selector": 0, "dkim_result": 0, "spf_domain": 0, "spf_scope": 0, "spf_result": 0, "github": 0, "xennn": 0, "anonym": 0, "feedback_typ": 0, "user_ag": 0, "lua": 0, "original_mail_from": 0, "sharepoint": 0, "de": 0, "original_rcpt_to": 0, "peter": 0, "pan": 0, "arrival_d": 0, "mon": 0, "01": 0, "oct": 0, "2018": 0, "11": 0, "0200": 0, "message_id": 0, "38": 0, "e7": 0, "30937": 0, "bd6e1bb5": 0, "mailrelai": 0, "authentication_result": 0, "di": 0, "delivery_result": 0, "auth_failur": 0, "reported_domain": 0, "arrival_date_utc": 0, "09": 0, "authentication_mechan": 0, "original_envelope_id": 0, "sample_headers_onli": 0, "servernameon": 0, "tby": 0, "cest": 0, "ndate": 0, "nmessag": 0, "nto": 0, "nfrom": 0, "utf": 0, "b": 0, "sw50zxjha3rpdmugv2v0dgjld2vyymvylcocymvyc2ljahq": 0, "nsubject": 0, "nmime": 0, "nx": 0, "mailer": 0, "foundat": 0, "2010": 0, "ncontent": 0, "text": 0, "html": 0, "charset": 0, "transfer": 0, "quot": 0, "printabl": 0, "head": 0, "base": 0, "href": 0, "3d": 0, "nwettbewerb": 0, "doctyp": 0, "w3c": 0, "dtd": 0, "en": 0, "meta": 0, "content": 0, "08": 0, "0240": 0, "003": 0, "parsed_sampl": 0, "display_nam": 0, "interakt": 0, "wettbewerb": 0, "\u00fcbersicht": 0, "to_domain": 0, "timezon": 0, "mime": 0, "date": 0, "x": 0, "hop": 0, "date_utc": 0, "delai": 0, "has_defect": 0, "To": 0, "reply_to": 0, "cc": 0, "bcc": 0, "filename_safe_subject": 0, "tracker": 0, "system": 0, "behind": 0, "web": 0, "proxi": 0, "edit": 0, "environ": 0, "detail": 0, "http_proxi": 0, "prox": 0, "3128": 0, "https_proxi": 0, "ftp_proxi": 0, "Or": 0, "up": 0, "ensur": 0, "patch": 0, "updat": 0, "rollup": 0, "22": 0, "kb4295699": 0, "2013": 0, "cumul": 0, "21": 0, "kb4099855": 0, "2016": 0, "kb4134118": 0, "7": 0, "static": 0, "copi": 0, "lite": 0, "databas": 0, "ipdb": 0, "distribut": 0, "under": 0, "term": 0, "creativ": 0, "common": 0, "attribut": 0, "4": 0, "intern": 0, "licens": 0, "fallback": 0, "geolite2": 0, "howev": 0, "cannot": 0, "releas": 0, "tool": 0, "prefer": 0, "solut": 0, "locat": 0, "overridden": 0, "On": 0, "debian": 0, "buster": 0, "sudo": 0, "apt": 0, "get": 0, "y": 0, "ubuntu": 0, "repositori": 0, "ppa": 0, "cento": 0, "rhel": 0, "dnf": 0, "latest": 0, "build": 0, "linux": 0, "maco": 0, "window": 0, "download": 0, "page": 0, "decemb": 0, "30th": 0, "2019": 0, "free": 0, "account": 0, "order": 0, "compli": 0, "variou": 0, "regist": 0, "sign": 0, "Then": 0, "navig": 0, "wa": 0, "format": 0, "i": 0, "newer": 0, "Be": 0, "sure": 0, "select": 0, "correct": 0, "onc": 0, "pre": 0, "fill": 0, "geoip": 0, "conf": 0, "systemdr": 0, "programdata": 0, "first": 0, "time": 0, "citi": 0, "asn": 0, "weekli": 0, "everi": 0, "tuesdai": 0, "cron": 0, "job": 0, "schedul": 0, "task": 0, "python3": 0, "pip": 0, "virtualenv": 0, "dev": 0, "libxml2": 0, "libxslt": 0, "python39": 0, "setuptool": 0, "devel": 0, "mkdir": 0, "opt": 0, "useradd": 0, "bin": 0, "m": 0, "u": 0, "venv": 0, "those": 0, "explicitli": 0, "tell": 0, "9": 0, "insid": 0, "like": 0, "abl": 0, "outlook": 0, "ol": 0, "msg": 0, "msgconvert": 0, "libemail": 0, "perl": 0, "same": 0, "two": 0, "mailto": 0, "uri": 0, "tag": 0, "offic": 0, "365": 0, "via": 0, "some": 0, "organis": 0, "In": 0, "case": 0, "gatewai": 0, "modern": 0, "multi": 0, "factor": 0, "sourceforg": 0, "extract": 0, "unzip": 0, "java": 0, "jre": 0, "headless": 0, "properti": 0, "basic": 0, "workstat": 0, "auto": 0, "webdav": 0, "enableew": 0, "office365": 0, "asmx": 0, "listen": 0, "imapport": 0, "1143": 0, "enableproxi": 0, "usesystemproxi": 0, "proxyhost": 0, "proxyport": 0, "proxyus": 0, "proxypassword": 0, "exclud": 0, "noproxyfor": 0, "remot": 0, "allowremot": 0, "bind": 0, "socket": 0, "loopback": 0, "bindaddress": 0, "specifi": 0, "nosecureimap": 0, "keepal": 0, "dure": 0, "larg": 0, "enablekeepal": 0, "retriev": 0, "foldersizelimit": 0, "immedi": 0, "store": 0, "flag": 0, "imapautoexpung": 0, "minut": 0, "imapidledelai": 0, "alwai": 0, "repli": 0, "rfc822": 0, "size": 0, "approxim": 0, "imapalwaysapproxmsgs": 0, "300": 0, "clientsotimeout": 0, "pry": 0, "ey": 0, "chown": 0, "root": 0, "chmod": 0, "rw": 0, "nano": 0, "unit": 0, "target": 0, "execstart": 0, "restart": 0, "restartsec": 0, "5m": 0, "wantedbi": 0, "systemctl": 0, "daemon": 0, "reload": 0, "abov": 0, "whenev": 0, "statu": 0, "crash": 0, "5": 0, "vew": 0, "previou": 0, "well": 0, "newest": 0, "oldest": 0, "journalctl": 0, "interact": 0, "follow": 0, "transport": 0, "wget": 0, "qo": 0, "artifact": 0, "co": 0, "gpg": 0, "echo": 0, "deb": 0, "packag": 0, "stabl": 0, "main": 0, "tee": 0, "d": 0, "other": 0, "rpm": 0, "jvm": 0, "heap": 0, "small": 0, "1g": 0, "caus": 0, "heavi": 0, "load": 0, "fix": 0, "increas": 0, "minimum": 0, "maximum": 0, "level": 0, "gb": 0, "ram": 0, "assign": 0, "valu": 0, "xms4g": 0, "xmx4g": 0, "refer": 0, "without": 0, "pack": 0, "readonlyrest": 0, "product": 0, "doe": 0, "mechan": 0, "its": 0, "own": 0, "nginx": 0, "revers": 0, "provid": 0, "apache2": 0, "yum": 0, "httpd": 0, "cd": 0, "openssl": 0, "req": 0, "x509": 0, "node": 0, "dai": 0, "newkei": 0, "rsa": 0, "4096": 0, "keyout": 0, "crt": 0, "csr": 0, "ca": 0, "prompt": 0, "fqdn": 0, "import": 0, "field": 0, "cert": 0, "rm": 0, "f": 0, "mv": 0, "rx": 0, "site": 0, "avail": 0, "443": 0, "http2": 0, "ssl_certif": 0, "ssl_certificate_kei": 0, "ssl_session_timeout": 0, "1d": 0, "ssl_session_cach": 0, "50m": 0, "ssl_session_ticket": 0, "off": 0, "tweak": 0, "ssl_protocol": 0, "tlsv1": 0, "ssl_cipher": 0, "ecdh": 0, "ecdsa": 0, "aes256": 0, "gcm": 0, "sha384": 0, "chacha20": 0, "poly1305": 0, "aes128": 0, "sha256": 0, "ssl_prefer_server_ciph": 0, "uncom": 0, "next": 0, "line": 0, "add_head": 0, "strict": 0, "max": 0, "ag": 0, "63072000": 0, "includesubdomain": 0, "preload": 0, "frame": 0, "sameorigin": 0, "nosniff": 0, "auth_bas": 0, "login": 0, "auth_basic_user_fil": 0, "htpasswd": 0, "proxy_pass": 0, "5601": 0, "proxy_set_head": 0, "real": 0, "remote_addr": 0, "forward": 0, "proxy_add_x_forwarded_for": 0, "80": 0, "return": 0, "301": 0, "request_uri": 0, "ln": 0, "exampleus": 0, "httpasswd": 0, "now": 0, "right": 0, "click": 0, "link": 0, "export": 0, "ndjson": 0, "object": 0, "tab": 0, "stack": 0, "manag": 0, "overwrit": 0, "exist": 0, "restor": 0, "someon": 0, "els": 0, "break": 0, "control": 0, "chang": 0, "wai": 0, "step": 0, "replac": 0, "match": 0, "checkbox": 0, "dmarc_aggreg": 0, "dmarc_forens": 0, "conform": 0, "easi": 0, "gdpr": 0, "fore": 0, "effici": 0, "xml": 0, "past": 0, "editor": 0, "occurr": 0, "displai": 0, "layout": 0, "although": 0, "slightli": 0, "easier": 0, "flexibl": 0, "filter": 0, "watcher": 0, "io": 0, "human": 0, "friendli": 0, "understand": 0, "switch": 0, "between": 0, "left": 0, "side": 0, "menu": 0, "As": 0, "suggest": 0, "across": 0, "top": 0, "three": 0, "pie": 0, "chart": 0, "percentag": 0, "segment": 0, "just": 0, "especi": 0, "correctli": 0, "remain": 0, "often": 0, "rule": 0, "signatur": 0, "part": 0, "wherea": 0, "reli": 0, "session": 0, "underneath": 0, "passag": 0, "find": 0, "center": 0, "volum": 0, "hover": 0, "mous": 0, "magnifi": 0, "glass": 0, "icon": 0, "our": 0, "recogn": 0, "market": 0, "plu": 0, "That": 0, "might": 0, "busi": 0, "particular": 0, "With": 0, "contact": 0, "lot": 0, "b2c": 0, "high": 0, "come": 0, "consum": 0, "yahoo": 0, "occur": 0, "old": 0, "why": 0, "mention": 0, "earlier": 0, "similar": 0, "observ": 0, "who": 0, "addresse": 0, "parent": 0, "subsidiari": 0, "outdat": 0, "further": 0, "down": 0, "previous": 0, "call": 0, "consolid": 0, "view": 0, "temporari": 0, "upper": 0, "These": 0, "recipi": 0, "avoid": 0, "leak": 0, "notabl": 0, "chines": 0, "webmail": 0, "entir": 0, "dkm": 0, "end": 0, "long": 0, "relat": 0, "publish": 0, "envelop": 0, "vendor": 0, "don": 0, "know": 0, "yet": 0, "ask": 0, "through": 0, "relai": 0, "theirs": 0, "realli": 0, "worst": 0, "subdomain": 0, "alter": 0, "tld": 0, "leav": 0, "vulner": 0, "deploi": 0, "footer": 0, "therebi": 0, "ideal": 0, "joe": 0, "nelson": 0, "fantast": 0, "explain": 0, "exactli": 0, "shouldn": 0, "fulli": 0, "compliant": 0, "rather": 0, "repeat": 0, "hi": 0, "fine": 0, "retain": 0, "2369": 0, "unsubscrib": 0, "2919": 0, "button": 0, "tradit": 0, "disclaim": 0, "addit": 0, "action": 0, "prefix": 0, "came": 0, "post": 0, "platform": 0, "subject_prefix": 0, "from_is_list": 0, "No": 0, "first_strip_reply_to": 0, "reply_goes_to_list": 0, "poster": 0, "include_rfc2369_head": 0, "ye": 0, "include_list_post_head": 0, "include_sender_head": 0, "digest": 0, "msg_header": 0, "msg_footer": 0, "scrub_nondigest": 0, "dmarc_moderation_act": 0, "accept": 0, "dmarc_quarentine_moderation_act": 0, "dmarc_none_moderation_act": 0, "ident": 0, "blank": 0, "convert": 0, "plaintext": 0, "rfc2369": 0, "explicit": 0, "replyo": 0, "goe": 0, "mung": 0, "mitig": 0, "uncondition": 0, "templat": 0, "unfortun": 0, "postoriu": 0, "ui": 0, "empti": 0, "ll": 0, "touch": 0, "var": 0, "member": 0, "regular": 0, "languag": 0, "core": 0, "go": 0, "legal": 0, "administr": 0, "longer": 0, "wrap": 0, "interfer": 0, "mobil": 0, "hand": 0, "accident": 0, "intend": 0, "choos": 0, "fit": 0, "commun": 0, "16": 0, "2017a": 0, "higher": 0, "rewrit": 0, "enforc": 0, "quarantin": 0, "reject": 0, "invalidaggregatereport": 0, "rais": 0, "invalid": 0, "encount": 0, "invaliddmarcreport": 0, "invalidforensicreport": 0, "parsererror": 0, "parser": 0, "email_result": 0, "mail_from": 0, "mail_to": 0, "mail_cc": 0, "mail_bcc": 0, "require_encrypt": 0, "verifi": 0, "attachment_filenam": 0, "paramet": 0, "ordereddict": 0, "overrid": 0, "plain": 0, "extract_xml": 0, "input_": 0, "byte": 0, "input": 0, "get_dmarc_reports_from_mailbox": 0, "mailboxconnect": 0, "create_fold": 0, "fetch": 0, "dict": 0, "whether": 0, "destin": 0, "aggregate_report": 0, "forensic_report": 0, "get_dmarc_reports_from_mbox": 0, "get_report_zip": 0, "parse_aggregate_report_fil": 0, "_input": 0, "keep_al": 0, "callabl": 0, "keep": 0, "aliv": 0, "function": 0, "parse_aggregate_report_xml": 0, "string": 0, "parse_forensic_report": 0, "feedback_report": 0, "msg_date": 0, "feedback": 0, "822": 0, "parse_report_email": 0, "report_typ": 0, "parse_report_fil": 0, "parsed_aggregate_reports_to_csv": 0, "flat": 0, "parsed_aggregate_reports_to_csv_row": 0, "parsed_forensic_reports_to_csv": 0, "parsed_forensic_reports_to_csv_row": 0, "save_output": 0, "output_directori": 0, "watch_inbox": 0, "mailbox_connect": 0, "callback": 0, "check_timeout": 0, "30": 0, "respons": 0, "until": 0, "alreadysav": 0, "elasticsearcherror": 0, "create_index": 0, "migrate_index": 0, "aggregate_index": 0, "forensic_index": 0, "map": 0, "save_aggregate_report_to_elasticsearch": 0, "save_forensic_report_to_elasticsearch": 0, "set_host": 0, "use_ssl": 0, "ssl_cert_path": 0, "60": 0, "singl": 0, "chain": 0, "class": 0, "hecclient": 0, "access_token": 0, "save_aggregate_reports_to_splunk": 0, "dictionari": 0, "save_forensic_reports_to_splunk": 0, "splunkerror": 0, "downloaderror": 0, "rasi": 0, "emailparsererror": 0, "convert_outlook_msg": 0, "msg_byte": 0, "decode_base64": 0, "decod": 0, "base64": 0, "pad": 0, "being": 0, "get_base_domain": 0, "use_fresh_psl": 0, "publicsuffix": 0, "public_suffix_list": 0, "dat": 0, "fresh": 0, "get_filename_safe_str": 0, "safe": 0, "param": 0, "get_ip_address_countri": 0, "db_path": 0, "iso": 0, "associ": 0, "ipv4": 0, "ipv6": 0, "And": 0, "get_ip_address_info": 0, "cach": 0, "expiringdict": 0, "storag": 0, "get_reverse_dn": 0, "human_timestamp_to_datetim": 0, "human_timestamp": 0, "to_utc": 0, "readabl": 0, "timestamp": 0, "datetim": 0, "utc": 0, "human_timestamp_to_timestamp": 0, "unix": 0, "yyyi": 0, "mm": 0, "dd": 0, "hh": 0, "ss": 0, "is_mbox": 0, "is_outlook_msg": 0, "parse_email": 0, "simplifi": 0, "binari": 0, "query_dn": 0, "record_typ": 0, "timestamp_to_datetim": 0, "timestamp_to_human": 0}, "objects": {"": [[0, 0, 0, "-", "parsedmarc"]], "parsedmarc": [[0, 1, 1, "", "InvalidAggregateReport"], [0, 1, 1, "", "InvalidDMARCReport"], [0, 1, 1, "", "InvalidForensicReport"], [0, 1, 1, "", "ParserError"], [0, 0, 0, "-", "elastic"], [0, 2, 1, "", "email_results"], [0, 2, 1, "", "extract_xml"], [0, 2, 1, "", "get_dmarc_reports_from_mailbox"], [0, 2, 1, "", "get_dmarc_reports_from_mbox"], [0, 2, 1, "", "get_report_zip"], [0, 2, 1, "", "parse_aggregate_report_file"], [0, 2, 1, "", "parse_aggregate_report_xml"], [0, 2, 1, "", "parse_forensic_report"], [0, 2, 1, "", "parse_report_email"], [0, 2, 1, "", "parse_report_file"], [0, 2, 1, "", "parsed_aggregate_reports_to_csv"], [0, 2, 1, "", "parsed_aggregate_reports_to_csv_rows"], [0, 2, 1, "", "parsed_forensic_reports_to_csv"], [0, 2, 1, "", "parsed_forensic_reports_to_csv_rows"], [0, 2, 1, "", "save_output"], [0, 0, 0, "-", "splunk"], [0, 0, 0, "-", "utils"], [0, 2, 1, "", "watch_inbox"]], "parsedmarc.elastic": [[0, 1, 1, "", "AlreadySaved"], [0, 1, 1, "", "ElasticsearchError"], [0, 2, 1, "", "create_indexes"], [0, 2, 1, "", "migrate_indexes"], [0, 2, 1, "", "save_aggregate_report_to_elasticsearch"], [0, 2, 1, "", "save_forensic_report_to_elasticsearch"], [0, 2, 1, "", "set_hosts"]], "parsedmarc.splunk": [[0, 3, 1, "", "HECClient"], [0, 1, 1, "", "SplunkError"]], "parsedmarc.splunk.HECClient": [[0, 4, 1, "", "save_aggregate_reports_to_splunk"], [0, 4, 1, "", "save_forensic_reports_to_splunk"]], "parsedmarc.utils": [[0, 1, 1, "", "DownloadError"], [0, 1, 1, "", "EmailParserError"], [0, 2, 1, "", "convert_outlook_msg"], [0, 2, 1, "", "decode_base64"], [0, 2, 1, "", "get_base_domain"], [0, 2, 1, "", "get_filename_safe_string"], [0, 2, 1, "", "get_ip_address_country"], [0, 2, 1, "", "get_ip_address_info"], [0, 2, 1, "", "get_reverse_dns"], [0, 2, 1, "", "human_timestamp_to_datetime"], [0, 2, 1, "", "human_timestamp_to_timestamp"], [0, 2, 1, "", "is_mbox"], [0, 2, 1, "", "is_outlook_msg"], [0, 2, 1, "", "parse_email"], [0, 2, 1, "", "query_dns"], [0, 2, 1, "", "timestamp_to_datetime"], [0, 2, 1, "", "timestamp_to_human"]]}, "objtypes": {"0": "py:module", "1": "py:exception", "2": "py:function", "3": "py:class", "4": "py:method"}, "objnames": {"0": ["py", "module", "Python module"], "1": ["py", "exception", "Python exception"], "2": ["py", "function", "Python function"], "3": ["py", "class", "Python class"], "4": ["py", "method", "Python method"]}, "titleterms": {"parsedmarc": 0, "document": 0, "open": 0, "sourc": 0, "dmarc": 0, "report": 0, "analyz": 0, "visual": 0, "featur": 0, "resourc": 0, "guid": 0, "spf": 0, "record": 0, "valid": 0, "lookalik": 0, "domain": 0, "cli": 0, "help": 0, "configur": 0, "file": 0, "sampl": 0, "aggreg": 0, "output": 0, "json": 0, "csv": 0, "forens": 0, "bug": 0, "instal": 0, "geoipupd": 0, "setup": 0, "option": 0, "depend": 0, "test": 0, "multipl": 0, "access": 0, "an": 0, "inbox": 0, "us": 0, "owa": 0, "ew": 0, "run": 0, "davmail": 0, "systemd": 0, "servic": 0, "elasticsearch": 0, "kibana": 0, "upgrad": 0, "index": 0, "pattern": 0, "retent": 0, "splunk": 0, "dashboard": 0, "summari": 0, "align": 0, "what": 0, "sender": 0, "won": 0, "t": 0, "support": 0, "dkim": 0, "about": 0, "mail": 0, "list": 0, "best": 0, "practic": 0, "mailman": 0, "2": 0, "3": 0, "workaround": 0, "listserv": 0, "api": 0, "elast": 0, "util": 0, "indic": 0, "tabl": 0}, "envversion": {"sphinx.domains.c": 2, "sphinx.domains.changeset": 1, "sphinx.domains.citation": 1, "sphinx.domains.cpp": 6, "sphinx.domains.index": 1, "sphinx.domains.javascript": 2, "sphinx.domains.math": 2, "sphinx.domains.python": 3, "sphinx.domains.rst": 2, "sphinx.domains.std": 2, "sphinx.ext.todo": 2, "sphinx.ext.viewcode": 1, "sphinx": 56}})
\ No newline at end of file
+Search.setIndex({"docnames": ["index"], "filenames": ["index.md"], "titles": ["parsedmarc documentation - Open source DMARC report analyzer and visualizer"], "terms": {"want": 0, "thi": 0, "i": 0, "project": 0, "maintain": 0, "one": 0, "develop": 0, "pleas": 0, "consid": 0, "review": 0, "issu": 0, "see": 0, "how": 0, "you": 0, "can": 0, "contribut": 0, "code": 0, "user": 0, "assist": 0, "pin": 0, "would": 0, "particularli": 0, "thank": 0, "all": 0, "contributor": 0, "python": 0, "modul": 0, "pars": 0, "when": 0, "work": 0, "self": 0, "host": 0, "altern": 0, "commerci": 0, "process": 0, "agari": 0, "brand": 0, "protect": 0, "dmarcian": 0, "ondmarc": 0, "proofpoint": 0, "email": 0, "fraud": 0, "defens": 0, "valimail": 0, "draft": 0, "1": 0, "0": 0, "standard": 0, "rua": 0, "failur": 0, "ruf": 0, "from": 0, "over": 0, "imap": 0, "microsoft": 0, "graph": 0, "gmail": 0, "transpar": 0, "handl": 0, "gzip": 0, "zip": 0, "compress": 0, "consist": 0, "data": 0, "structur": 0, "simpl": 0, "result": 0, "send": 0, "premad": 0, "apach": 0, "kafka": 0, "demystifi": 0, "A": 0, "complet": 0, "If": 0, "ar": 0, "look": 0, "check": 0, "out": 0, "sister": 0, "checkdmarc": 0, "against": 0, "spoof": 0, "monitor": 0, "domainawar": 0, "usag": 0, "h": 0, "c": 0, "config_fil": 0, "strip": 0, "attach": 0, "payload": 0, "o": 0, "filenam": 0, "aggregate_json_filenam": 0, "forensic_json_filenam": 0, "aggregate_csv_filenam": 0, "forensic_csv_filenam": 0, "n": 0, "nameserv": 0, "dns_timeout": 0, "offlin": 0, "": 0, "verbos": 0, "debug": 0, "log": 0, "log_fil": 0, "v": 0, "file_path": 0, "posit": 0, "argument": 0, "more": 0, "path": 0, "mbox": 0, "show": 0, "messag": 0, "exit": 0, "config": 0, "silent": 0, "impli": 0, "remov": 0, "write": 0, "given": 0, "directori": 0, "queri": 0, "number": 0, "second": 0, "wait": 0, "answer": 0, "dn": 0, "default": 0, "do": [], "make": 0, "onlin": 0, "geoloc": 0, "onli": 0, "print": 0, "error": 0, "warn": 0, "inform": 0, "version": 0, "program": 0, "start": 0, "6": 0, "most": 0, "were": 0, "move": 0, "describ": 0, "below": 0, "suppli": 0, "ini": 0, "etc": 0, "For": 0, "exampl": 0, "comment": 0, "gener": 0, "save_aggreg": 0, "true": 0, "save_forens": 0, "com": 0, "dmarcresport": 0, "password": 0, "upersecur": 0, "mailbox": 0, "watch": 0, "delet": 0, "fals": 0, "127": 0, "9200": 0, "ssl": 0, "splunk_hec": 0, "url": 0, "http": 0, "splunkhec": 0, "token": 0, "hectokengoesher": 0, "s3": 0, "bucket": 0, "my": 0, "syslog": 0, "server": 0, "localhost": 0, "port": 0, "514": 0, "The": 0, "full": 0, "set": 0, "bool": 0, "save": 0, "strip_attachment_payload": 0, "str": 0, "place": 0, "ip_db_path": 0, "custom": 0, "mmdb": 0, "maxmind": 0, "dbip": 0, "comma": 0, "separ": 0, "resolv": 0, "cloudflar": 0, "public": 0, "float": 0, "timeout": 0, "period": 0, "n_proc": 0, "int": 0, "parallel": 0, "mode": 0, "chunk_siz": 0, "give": 0, "each": 0, "larger": 0, "than": 0, "improv": 0, "perform": 0, "thousand": 0, "reports_fold": 0, "folder": 0, "label": 0, "where": 0, "incom": 0, "found": 0, "archive_fold": 0, "sort": 0, "archiv": 0, "idl": 0, "command": 0, "thei": 0, "arriv": 0, "poll": 0, "m": 0, "new": 0, "after": 0, "them": 0, "instead": 0, "batch_siz": 0, "read": 0, "befor": 0, "10": 0, "limit": 0, "check_timeout": 0, "respons": 0, "until": 0, "next": 0, "mai": 0, "30": 0, "hostnam": 0, "ip": 0, "address": 0, "993": 0, "charact": 0, "must": 0, "escap": 0, "anoth": 0, "so": 0, "wherev": 0, "8": 0, "section": 0, "have": 0, "been": 0, "your": 0, "recommend": 0, "still": 0, "try": 0, "encrypt": 0, "tl": 0, "connect": 0, "skip_certificate_verif": 0, "skip": 0, "certif": 0, "verif": 0, "msgraph": 0, "auth_method": 0, "authent": 0, "method": 0, "type": 0, "usernamepassword": 0, "devicecod": 0, "clientsecret": 0, "m365": 0, "requir": 0, "auth": 0, "client_id": 0, "app": 0, "registr": 0, "client": 0, "id": 0, "client_secret": 0, "secret": 0, "tenant_id": 0, "azur": 0, "ad": 0, "tenant": 0, "except": 0, "name": 0, "current": 0, "could": 0, "share": 0, "ha": 0, "token_fil": 0, "creat": 0, "admin": 0, "grant": 0, "readwrit": 0, "deleg": 0, "permiss": 0, "differ": 0, "usernam": 0, "need": 0, "applic": 0, "also": 0, "restrict": 0, "specif": 0, "sinc": 0, "allow": 0, "applicationaccesspolici": 0, "exchang": 0, "powershel": 0, "scope": 0, "polici": 0, "add": 0, "enabl": 0, "secur": 0, "group": 0, "accessright": 0, "restrictaccess": 0, "appid": 0, "policyscopegroupid": 0, "descript": 0, "e": 0, "g": 0, "special": 0, "encod": 0, "cert_path": 0, "trust": 0, "index_suffix": 0, "suffix": 0, "appli": 0, "monthly_index": 0, "monthli": 0, "daili": 0, "number_of_shard": 0, "shard": 0, "number_of_replica": 0, "replica": 0, "event": 0, "collector": 0, "hec": 0, "passsword": 0, "aggregate_top": 0, "topic": 0, "forensic_top": 0, "smtp": 0, "25": 0, "starttl": 0, "header": 0, "subject": 0, "upload": 0, "region_nam": 0, "region": 0, "endpoint_url": 0, "endpoint": 0, "access_key_id": 0, "kei": 0, "secret_access_kei": 0, "udp": 0, "gmail_api": 0, "credentials_fil": 0, "contain": 0, "credenti": 0, "none": 0, "disabl": 0, "include_spam_trash": 0, "includ": 0, "spam": 0, "trash": 0, "search": 0, "acquir": 0, "www": 0, "googleapi": 0, "modifi": 0, "oauth2_port": 0, "tcp": 0, "local": 0, "listen": 0, "oauth2": 0, "8080": 0, "It": 0, "strongli": 0, "By": 0, "which": 0, "much": 0, "faster": 0, "reliabl": 0, "googl": 0, "cisco": 0, "opendn": 0, "even": 0, "should": 0, "network": 0, "block": 0, "request": 0, "outsid": 0, "becaus": 0, "known": 0, "instanc": 0, "highli": 0, "regul": 0, "industri": 0, "sensit": 0, "healthcar": 0, "financ": 0, "legitim": 0, "outgo": 0, "fail": 0, "possibl": 0, "appear": 0, "later": 0, "origin": 0, "sometim": 0, "bodi": 0, "organ": 0, "ani": 0, "kind": 0, "privaci": 0, "reason": 0, "while": 0, "sent": 0, "least": 0, "normal": 0, "receiv": 0, "veri": 0, "few": 0, "approach": 0, "collect": 0, "manual": 0, "malici": 0, "non": 0, "here": 0, "org": 0, "wiki": 0, "actual": 0, "older": 0, "schema": 0, "rfc": 0, "7480": 0, "appendix": 0, "wide": 0, "produc": 0, "regardless": 0, "xml_schema": 0, "report_metadata": 0, "org_nam": 0, "acm": 0, "org_email": 0, "norepli": 0, "org_extra_contact_info": 0, "report_id": 0, "9391651994964116463": 0, "begin_d": 0, "2012": 0, "04": 0, "27": 0, "20": 0, "00": 0, "end_dat": 0, "28": 0, "19": 0, "59": 0, "policy_publish": 0, "adkim": 0, "r": 0, "aspf": 0, "p": 0, "sp": 0, "pct": 0, "100": 0, "fo": 0, "ip_address": 0, "72": 0, "150": 0, "241": 0, "94": 0, "countri": 0, "u": 0, "reverse_dn": 0, "adsl": 0, "shv": 0, "bellsouth": 0, "net": 0, "base_domain": 0, "count": 0, "policy_evalu": 0, "disposit": 0, "pass": 0, "policy_override_reason": 0, "identifi": 0, "header_from": 0, "envelope_from": 0, "envelope_to": 0, "null": 0, "auth_result": 0, "selector": 0, "mfrom": 0, "source_ip_address": 0, "source_countri": 0, "source_reverse_dn": 0, "source_base_domain": 0, "spf_align": 0, "dkim_align": 0, "dmarc_align": 0, "policy_override_com": 0, "dkim_domain": 0, "dkim_selector": 0, "dkim_result": 0, "spf_domain": 0, "spf_scope": 0, "spf_result": 0, "github": 0, "xennn": 0, "anonym": 0, "feedback_typ": 0, "user_ag": 0, "lua": 0, "original_mail_from": 0, "sharepoint": 0, "de": 0, "original_rcpt_to": 0, "peter": 0, "pan": 0, "arrival_d": 0, "mon": 0, "01": 0, "oct": 0, "2018": 0, "11": 0, "0200": 0, "message_id": 0, "38": 0, "e7": 0, "30937": 0, "bd6e1bb5": 0, "mailrelai": 0, "authentication_result": 0, "di": 0, "delivery_result": 0, "auth_failur": 0, "reported_domain": 0, "arrival_date_utc": 0, "09": 0, "authentication_mechan": 0, "original_envelope_id": 0, "sample_headers_onli": 0, "servernameon": 0, "tby": 0, "cest": 0, "ndate": 0, "nmessag": 0, "nto": 0, "nfrom": 0, "utf": 0, "b": 0, "sw50zxjha3rpdmugv2v0dgjld2vyymvylcocymvyc2ljahq": 0, "nsubject": 0, "nmime": 0, "nx": 0, "mailer": 0, "foundat": 0, "2010": 0, "ncontent": 0, "text": 0, "html": 0, "charset": 0, "transfer": 0, "quot": 0, "printabl": 0, "head": 0, "base": 0, "href": 0, "3d": 0, "nwettbewerb": 0, "doctyp": 0, "w3c": 0, "dtd": 0, "en": 0, "meta": 0, "content": 0, "08": 0, "0240": 0, "003": 0, "parsed_sampl": 0, "display_nam": 0, "interakt": 0, "wettbewerb": 0, "\u00fcbersicht": 0, "to_domain": 0, "timezon": 0, "mime": 0, "date": 0, "x": 0, "hop": 0, "date_utc": 0, "delai": 0, "has_defect": 0, "To": 0, "reply_to": 0, "cc": 0, "bcc": 0, "filename_safe_subject": 0, "tracker": 0, "system": 0, "behind": 0, "web": 0, "proxi": 0, "edit": 0, "environ": 0, "detail": 0, "http_proxi": 0, "prox": 0, "3128": 0, "https_proxi": 0, "ftp_proxi": 0, "Or": 0, "up": 0, "ensur": 0, "patch": 0, "updat": 0, "rollup": 0, "22": 0, "kb4295699": 0, "2013": 0, "cumul": 0, "21": 0, "kb4099855": 0, "2016": 0, "kb4134118": 0, "7": 0, "static": 0, "copi": 0, "lite": 0, "databas": 0, "ipdb": 0, "distribut": 0, "under": 0, "term": 0, "creativ": 0, "common": 0, "attribut": 0, "4": 0, "intern": 0, "licens": 0, "fallback": 0, "geolite2": 0, "howev": 0, "cannot": 0, "releas": 0, "tool": 0, "prefer": 0, "solut": 0, "locat": 0, "overridden": 0, "On": 0, "debian": 0, "buster": 0, "sudo": 0, "apt": 0, "get": 0, "y": 0, "ubuntu": 0, "repositori": 0, "ppa": 0, "cento": 0, "rhel": 0, "dnf": 0, "latest": 0, "build": 0, "linux": 0, "maco": 0, "window": 0, "download": 0, "page": 0, "decemb": 0, "30th": 0, "2019": 0, "free": 0, "account": 0, "order": 0, "compli": 0, "variou": 0, "regist": 0, "sign": 0, "Then": 0, "navig": 0, "wa": 0, "format": 0, "newer": 0, "Be": 0, "sure": 0, "select": 0, "correct": 0, "onc": 0, "pre": 0, "fill": 0, "geoip": 0, "conf": 0, "systemdr": 0, "programdata": 0, "first": 0, "time": 0, "citi": 0, "asn": 0, "weekli": 0, "everi": 0, "tuesdai": 0, "cron": 0, "job": 0, "schedul": 0, "task": 0, "python3": 0, "pip": 0, "virtualenv": 0, "dev": 0, "libxml2": 0, "libxslt": 0, "python39": 0, "setuptool": 0, "devel": 0, "mkdir": 0, "opt": 0, "useradd": 0, "bin": 0, "venv": 0, "those": 0, "explicitli": 0, "tell": 0, "9": 0, "insid": 0, "like": 0, "abl": 0, "outlook": 0, "ol": 0, "msg": 0, "msgconvert": 0, "libemail": 0, "perl": 0, "same": 0, "two": 0, "mailto": 0, "uri": 0, "tag": 0, "offic": 0, "365": 0, "via": 0, "some": 0, "In": 0, "case": 0, "gatewai": 0, "modern": 0, "multi": 0, "factor": 0, "sourceforg": 0, "extract": 0, "unzip": 0, "java": 0, "jre": 0, "headless": 0, "properti": 0, "basic": 0, "workstat": 0, "auto": 0, "webdav": 0, "enableew": 0, "office365": 0, "asmx": 0, "imapport": 0, "1143": 0, "enableproxi": 0, "usesystemproxi": 0, "proxyhost": 0, "proxyport": 0, "proxyus": 0, "proxypassword": 0, "exclud": 0, "noproxyfor": 0, "remot": 0, "allowremot": 0, "bind": 0, "socket": 0, "loopback": 0, "bindaddress": 0, "specifi": 0, "nosecureimap": 0, "keepal": 0, "dure": 0, "larg": 0, "enablekeepal": 0, "retriev": 0, "foldersizelimit": 0, "immedi": 0, "store": 0, "flag": 0, "imapautoexpung": 0, "minut": 0, "imapidledelai": 0, "alwai": 0, "repli": 0, "rfc822": 0, "size": 0, "approxim": 0, "imapalwaysapproxmsgs": 0, "300": 0, "clientsotimeout": 0, "pry": 0, "ey": 0, "chown": 0, "root": 0, "chmod": 0, "rw": 0, "nano": 0, "unit": 0, "target": 0, "execstart": 0, "restart": 0, "restartsec": 0, "5m": 0, "wantedbi": 0, "systemctl": 0, "daemon": 0, "reload": 0, "abov": 0, "whenev": 0, "statu": 0, "crash": 0, "5": 0, "vew": 0, "previou": 0, "well": 0, "newest": 0, "oldest": 0, "journalctl": 0, "interact": 0, "follow": 0, "transport": 0, "wget": 0, "qo": 0, "artifact": 0, "co": 0, "gpg": 0, "echo": 0, "deb": 0, "packag": 0, "stabl": 0, "main": 0, "tee": 0, "d": 0, "other": 0, "rpm": 0, "jvm": 0, "heap": 0, "small": 0, "1g": 0, "caus": 0, "heavi": 0, "load": 0, "fix": 0, "increas": 0, "minimum": 0, "maximum": 0, "level": 0, "gb": 0, "ram": 0, "assign": 0, "valu": 0, "xms4g": 0, "xmx4g": 0, "refer": 0, "without": 0, "pack": 0, "readonlyrest": 0, "product": 0, "doe": 0, "mechan": 0, "its": 0, "own": 0, "nginx": 0, "revers": 0, "provid": 0, "apache2": 0, "yum": 0, "httpd": 0, "cd": 0, "openssl": 0, "req": 0, "x509": 0, "node": 0, "dai": 0, "newkei": 0, "rsa": 0, "4096": 0, "keyout": 0, "crt": 0, "csr": 0, "ca": 0, "prompt": 0, "fqdn": 0, "import": 0, "field": 0, "cert": 0, "rm": 0, "f": 0, "mv": 0, "rx": 0, "site": 0, "avail": 0, "443": 0, "http2": 0, "ssl_certif": 0, "ssl_certificate_kei": 0, "ssl_session_timeout": 0, "1d": 0, "ssl_session_cach": 0, "50m": 0, "ssl_session_ticket": 0, "off": 0, "tweak": 0, "ssl_protocol": 0, "tlsv1": 0, "ssl_cipher": 0, "ecdh": 0, "ecdsa": 0, "aes256": 0, "gcm": 0, "sha384": 0, "chacha20": 0, "poly1305": 0, "aes128": 0, "sha256": 0, "ssl_prefer_server_ciph": 0, "uncom": 0, "line": 0, "add_head": 0, "strict": 0, "max": 0, "ag": 0, "63072000": 0, "includesubdomain": 0, "preload": 0, "frame": 0, "sameorigin": 0, "nosniff": 0, "auth_bas": 0, "login": 0, "auth_basic_user_fil": 0, "htpasswd": 0, "proxy_pass": 0, "5601": 0, "proxy_set_head": 0, "real": 0, "remote_addr": 0, "forward": 0, "proxy_add_x_forwarded_for": 0, "80": 0, "return": 0, "301": 0, "request_uri": 0, "ln": 0, "exampleus": 0, "httpasswd": 0, "now": 0, "right": 0, "click": 0, "link": 0, "export": 0, "ndjson": 0, "object": 0, "tab": 0, "stack": 0, "manag": 0, "overwrit": 0, "exist": 0, "restor": 0, "someon": 0, "els": 0, "break": 0, "control": 0, "chang": 0, "wai": 0, "step": 0, "replac": 0, "match": 0, "checkbox": 0, "dmarc_aggreg": 0, "dmarc_forens": 0, "conform": 0, "easi": 0, "gdpr": 0, "fore": 0, "effici": 0, "xml": 0, "past": 0, "editor": 0, "occurr": 0, "displai": 0, "layout": 0, "although": 0, "slightli": 0, "easier": 0, "flexibl": 0, "filter": 0, "watcher": 0, "io": 0, "human": 0, "friendli": 0, "understand": 0, "switch": 0, "between": 0, "left": 0, "side": 0, "menu": 0, "As": 0, "suggest": 0, "across": 0, "top": 0, "three": 0, "pie": 0, "chart": 0, "percentag": 0, "segment": 0, "just": 0, "especi": 0, "correctli": 0, "remain": 0, "often": 0, "rule": 0, "signatur": 0, "part": 0, "wherea": 0, "reli": 0, "session": 0, "underneath": 0, "passag": 0, "find": 0, "center": 0, "volum": 0, "hover": 0, "mous": 0, "magnifi": 0, "glass": 0, "icon": 0, "our": 0, "recogn": 0, "market": 0, "plu": 0, "That": 0, "might": 0, "busi": 0, "particular": 0, "With": 0, "contact": 0, "lot": 0, "b2c": 0, "high": 0, "come": 0, "consum": 0, "yahoo": 0, "occur": 0, "old": 0, "why": 0, "mention": 0, "earlier": 0, "similar": 0, "observ": 0, "who": 0, "addresse": 0, "parent": 0, "subsidiari": 0, "outdat": 0, "further": 0, "down": 0, "previous": 0, "call": 0, "consolid": 0, "view": 0, "temporari": 0, "upper": 0, "These": 0, "recipi": 0, "avoid": 0, "leak": 0, "notabl": 0, "chines": 0, "webmail": 0, "entir": 0, "dkm": 0, "end": 0, "long": 0, "relat": 0, "publish": 0, "envelop": 0, "vendor": 0, "don": 0, "know": 0, "yet": 0, "ask": 0, "through": 0, "relai": 0, "theirs": 0, "realli": 0, "worst": 0, "subdomain": 0, "alter": 0, "tld": 0, "leav": 0, "vulner": 0, "deploi": 0, "footer": 0, "therebi": 0, "ideal": 0, "joe": 0, "nelson": 0, "fantast": 0, "explain": 0, "exactli": 0, "shouldn": 0, "fulli": 0, "compliant": 0, "rather": 0, "repeat": 0, "hi": 0, "fine": 0, "retain": 0, "2369": 0, "unsubscrib": 0, "2919": 0, "button": 0, "tradit": 0, "disclaim": 0, "addit": 0, "action": 0, "prefix": 0, "came": 0, "post": 0, "platform": 0, "subject_prefix": 0, "from_is_list": 0, "No": 0, "first_strip_reply_to": 0, "reply_goes_to_list": 0, "poster": 0, "include_rfc2369_head": 0, "ye": 0, "include_list_post_head": 0, "include_sender_head": 0, "digest": 0, "msg_header": 0, "msg_footer": 0, "scrub_nondigest": 0, "dmarc_moderation_act": 0, "accept": 0, "dmarc_quarantine_moderation_act": 0, "dmarc_none_moderation_act": 0, "ident": 0, "blank": 0, "convert": 0, "plaintext": 0, "rfc2369": 0, "explicit": 0, "replyto": 0, "goe": 0, "mung": 0, "mitig": 0, "uncondition": 0, "templat": 0, "unfortun": 0, "postoriu": 0, "ui": 0, "empti": 0, "ll": 0, "touch": 0, "var": 0, "member": 0, "regular": 0, "languag": 0, "core": 0, "go": 0, "legal": 0, "administr": 0, "longer": 0, "wrap": 0, "interfer": 0, "mobil": 0, "hand": 0, "accident": 0, "intend": 0, "choos": 0, "fit": 0, "commun": 0, "16": 0, "2017a": 0, "higher": 0, "rewrit": 0, "enforc": 0, "quarantin": 0, "reject": 0, "invalidaggregatereport": 0, "rais": 0, "invalid": 0, "encount": 0, "invaliddmarcreport": 0, "invalidforensicreport": 0, "parsererror": 0, "parser": 0, "email_result": 0, "mail_from": 0, "mail_to": 0, "mail_cc": 0, "mail_bcc": 0, "require_encrypt": 0, "verifi": 0, "attachment_filenam": 0, "paramet": 0, "ordereddict": 0, "overrid": 0, "plain": 0, "extract_xml": 0, "input_": 0, "byte": 0, "input": 0, "get_dmarc_reports_from_mailbox": 0, "mailboxconnect": 0, "create_fold": 0, "fetch": 0, "dict": 0, "whether": 0, "destin": 0, "aggregate_report": 0, "forensic_report": 0, "get_dmarc_reports_from_mbox": 0, "get_report_zip": 0, "parse_aggregate_report_fil": 0, "_input": 0, "keep_al": 0, "callabl": 0, "keep": 0, "aliv": 0, "function": 0, "parse_aggregate_report_xml": 0, "string": 0, "parse_forensic_report": 0, "feedback_report": 0, "msg_date": 0, "feedback": 0, "822": 0, "parse_report_email": 0, "report_typ": 0, "parse_report_fil": 0, "parsed_aggregate_reports_to_csv": 0, "flat": 0, "parsed_aggregate_reports_to_csv_row": 0, "parsed_forensic_reports_to_csv": 0, "parsed_forensic_reports_to_csv_row": 0, "save_output": 0, "output_directori": 0, "watch_inbox": 0, "mailbox_connect": 0, "callback": 0, "alreadysav": 0, "elasticsearcherror": 0, "create_index": 0, "migrate_index": 0, "aggregate_index": 0, "forensic_index": 0, "map": 0, "save_aggregate_report_to_elasticsearch": 0, "save_forensic_report_to_elasticsearch": 0, "set_host": 0, "use_ssl": 0, "ssl_cert_path": 0, "60": 0, "singl": 0, "chain": 0, "class": 0, "hecclient": 0, "access_token": 0, "initi": 0, "param": 0, "save_aggregate_reports_to_splunk": 0, "dictionari": 0, "save_forensic_reports_to_splunk": 0, "splunkerror": 0, "downloaderror": 0, "rasi": 0, "emailparsererror": 0, "convert_outlook_msg": 0, "msg_byte": 0, "decode_base64": 0, "decod": 0, "base64": 0, "pad": 0, "being": 0, "get_base_domain": 0, "use_fresh_psl": 0, "publicsuffix": 0, "public_suffix_list": 0, "dat": 0, "fresh": 0, "get_filename_safe_str": 0, "safe": 0, "get_ip_address_countri": 0, "db_path": 0, "iso": 0, "associ": 0, "ipv4": 0, "ipv6": 0, "And": 0, "get_ip_address_info": 0, "cach": 0, "expiringdict": 0, "storag": 0, "get_reverse_dn": 0, "human_timestamp_to_datetim": 0, "human_timestamp": 0, "to_utc": 0, "readabl": 0, "timestamp": 0, "datetim": 0, "utc": 0, "human_timestamp_to_timestamp": 0, "unix": 0, "yyyi": 0, "mm": 0, "dd": 0, "hh": 0, "ss": 0, "is_mbox": 0, "is_outlook_msg": 0, "parse_email": 0, "simplifi": 0, "binari": 0, "query_dn": 0, "record_typ": 0, "timestamp_to_datetim": 0, "timestamp_to_human": 0}, "objects": {"": [[0, 0, 0, "-", "parsedmarc"]], "parsedmarc": [[0, 1, 1, "", "InvalidAggregateReport"], [0, 1, 1, "", "InvalidDMARCReport"], [0, 1, 1, "", "InvalidForensicReport"], [0, 1, 1, "", "ParserError"], [0, 0, 0, "-", "elastic"], [0, 2, 1, "", "email_results"], [0, 2, 1, "", "extract_xml"], [0, 2, 1, "", "get_dmarc_reports_from_mailbox"], [0, 2, 1, "", "get_dmarc_reports_from_mbox"], [0, 2, 1, "", "get_report_zip"], [0, 2, 1, "", "parse_aggregate_report_file"], [0, 2, 1, "", "parse_aggregate_report_xml"], [0, 2, 1, "", "parse_forensic_report"], [0, 2, 1, "", "parse_report_email"], [0, 2, 1, "", "parse_report_file"], [0, 2, 1, "", "parsed_aggregate_reports_to_csv"], [0, 2, 1, "", "parsed_aggregate_reports_to_csv_rows"], [0, 2, 1, "", "parsed_forensic_reports_to_csv"], [0, 2, 1, "", "parsed_forensic_reports_to_csv_rows"], [0, 2, 1, "", "save_output"], [0, 0, 0, "-", "splunk"], [0, 0, 0, "-", "utils"], [0, 2, 1, "", "watch_inbox"]], "parsedmarc.elastic": [[0, 1, 1, "", "AlreadySaved"], [0, 1, 1, "", "ElasticsearchError"], [0, 2, 1, "", "create_indexes"], [0, 2, 1, "", "migrate_indexes"], [0, 2, 1, "", "save_aggregate_report_to_elasticsearch"], [0, 2, 1, "", "save_forensic_report_to_elasticsearch"], [0, 2, 1, "", "set_hosts"]], "parsedmarc.splunk": [[0, 3, 1, "", "HECClient"], [0, 1, 1, "", "SplunkError"]], "parsedmarc.splunk.HECClient": [[0, 4, 1, "", "save_aggregate_reports_to_splunk"], [0, 4, 1, "", "save_forensic_reports_to_splunk"]], "parsedmarc.utils": [[0, 1, 1, "", "DownloadError"], [0, 1, 1, "", "EmailParserError"], [0, 2, 1, "", "convert_outlook_msg"], [0, 2, 1, "", "decode_base64"], [0, 2, 1, "", "get_base_domain"], [0, 2, 1, "", "get_filename_safe_string"], [0, 2, 1, "", "get_ip_address_country"], [0, 2, 1, "", "get_ip_address_info"], [0, 2, 1, "", "get_reverse_dns"], [0, 2, 1, "", "human_timestamp_to_datetime"], [0, 2, 1, "", "human_timestamp_to_timestamp"], [0, 2, 1, "", "is_mbox"], [0, 2, 1, "", "is_outlook_msg"], [0, 2, 1, "", "parse_email"], [0, 2, 1, "", "query_dns"], [0, 2, 1, "", "timestamp_to_datetime"], [0, 2, 1, "", "timestamp_to_human"]]}, "objtypes": {"0": "py:module", "1": "py:exception", "2": "py:function", "3": "py:class", "4": "py:method"}, "objnames": {"0": ["py", "module", "Python module"], "1": ["py", "exception", "Python exception"], "2": ["py", "function", "Python function"], "3": ["py", "class", "Python class"], "4": ["py", "method", "Python method"]}, "titleterms": {"parsedmarc": 0, "document": 0, "open": 0, "sourc": 0, "dmarc": 0, "report": 0, "analyz": 0, "visual": 0, "featur": 0, "resourc": 0, "guid": 0, "spf": 0, "record": 0, "valid": 0, "lookalik": 0, "domain": 0, "cli": 0, "help": 0, "configur": 0, "file": 0, "sampl": 0, "aggreg": 0, "output": 0, "json": 0, "csv": 0, "forens": 0, "bug": 0, "instal": 0, "geoipupd": 0, "setup": 0, "option": 0, "depend": 0, "test": 0, "multipl": 0, "access": 0, "an": 0, "inbox": 0, "us": 0, "owa": 0, "ew": 0, "run": 0, "davmail": 0, "systemd": 0, "servic": 0, "elasticsearch": 0, "kibana": 0, "upgrad": 0, "index": 0, "pattern": 0, "retent": 0, "splunk": 0, "dashboard": 0, "summari": 0, "align": 0, "what": 0, "sender": 0, "won": 0, "t": 0, "support": 0, "dkim": 0, "about": 0, "mail": 0, "list": 0, "best": 0, "practic": 0, "mailman": 0, "2": 0, "3": 0, "workaround": 0, "listserv": 0, "api": 0, "elast": 0, "util": 0, "indic": 0, "tabl": 0, "do": 0}, "envversion": {"sphinx.domains.c": 2, "sphinx.domains.changeset": 1, "sphinx.domains.citation": 1, "sphinx.domains.cpp": 6, "sphinx.domains.index": 1, "sphinx.domains.javascript": 2, "sphinx.domains.math": 2, "sphinx.domains.python": 3, "sphinx.domains.rst": 2, "sphinx.domains.std": 2, "sphinx.ext.todo": 2, "sphinx.ext.viewcode": 1, "sphinx": 56}})
\ No newline at end of file
