6.5.0

2026-08-02 13:42:19 +00:00 · 2019-07-17 11:06:53 -04:00
parent 37c532876c
commit 58c8d88ff8
13 changed files with 338 additions and 909 deletions
@@ -8,7 +8,7 @@
  
  <meta name="viewport" content="width=device-width, initial-scale=1.0">
  
-  <title>parsedmarc documentation - Open source DMARC report analyzer and visualizer &mdash; parsedmarc 6.4.2 documentation</title>
+  <title>parsedmarc documentation - Open source DMARC report analyzer and visualizer &mdash; parsedmarc 6.5.0 documentation</title>
  

  
@@ -58,7 +58,7 @@
            
            
              <div class="version">
-                6.4.2
+                6.5.0
              </div>
            
          
@@ -146,9 +146,7 @@
 </li>
 <li><a class="reference internal" href="#module-parsedmarc">API</a><ul>
 <li><a class="reference internal" href="#module-parsedmarc.elastic">parsedmarc.elastic</a></li>
-<li><a class="reference internal" href="#parsedmarc-splunk">parsedmarc.splunk</a><ul>
-</ul>
-</li>
+<li><a class="reference internal" href="#module-parsedmarc.splunk">parsedmarc.splunk</a></li>
 <li><a class="reference internal" href="#module-parsedmarc.utils">parsedmarc.utils</a></li>
 </ul>
 </li>
@@ -266,9 +264,10 @@ lookalike domain monitoring, check out <a class="reference external" href="https
 <div class="section" id="cli-help">
 <h2>CLI help<a class="headerlink" href="#cli-help" title="Permalink to this headline">¶</a></h2>
 <div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="n">usage</span><span class="p">:</span> <span class="n">parsedmarc</span> <span class="p">[</span><span class="o">-</span><span class="n">h</span><span class="p">]</span> <span class="p">[</span><span class="o">-</span><span class="n">c</span> <span class="n">CONFIG_FILE</span><span class="p">]</span> <span class="p">[</span><span class="o">--</span><span class="n">strip</span><span class="o">-</span><span class="n">attachment</span><span class="o">-</span><span class="n">payloads</span><span class="p">]</span>
-               <span class="p">[</span><span class="o">-</span><span class="n">o</span> <span class="n">OUTPUT</span><span class="p">]</span> <span class="p">[</span><span class="o">-</span><span class="n">n</span> <span class="n">NAMESERVERS</span> <span class="p">[</span><span class="n">NAMESERVERS</span> <span class="o">...</span><span class="p">]]</span>
-               <span class="p">[</span><span class="o">-</span><span class="n">t</span> <span class="n">DNS_TIMEOUT</span><span class="p">]</span> <span class="p">[</span><span class="o">-</span><span class="n">s</span><span class="p">]</span> <span class="p">[</span><span class="o">--</span><span class="n">debug</span><span class="p">]</span> <span class="p">[</span><span class="o">--</span><span class="n">log</span><span class="o">-</span><span class="n">file</span> <span class="n">LOG_FILE</span><span class="p">]</span> <span class="p">[</span><span class="o">-</span><span class="n">v</span><span class="p">]</span>
-               <span class="p">[</span><span class="n">file_path</span> <span class="p">[</span><span class="n">file_path</span> <span class="o">...</span><span class="p">]]</span>
+                  <span class="p">[</span><span class="o">-</span><span class="n">o</span> <span class="n">OUTPUT</span><span class="p">]</span> <span class="p">[</span><span class="o">-</span><span class="n">n</span> <span class="n">NAMESERVERS</span> <span class="p">[</span><span class="n">NAMESERVERS</span> <span class="o">...</span><span class="p">]]</span>
+                  <span class="p">[</span><span class="o">-</span><span class="n">t</span> <span class="n">DNS_TIMEOUT</span><span class="p">]</span> <span class="p">[</span><span class="o">--</span><span class="n">offline</span><span class="p">]</span> <span class="p">[</span><span class="o">-</span><span class="n">s</span><span class="p">]</span> <span class="p">[</span><span class="o">--</span><span class="n">debug</span><span class="p">]</span>
+                  <span class="p">[</span><span class="o">--</span><span class="n">log</span><span class="o">-</span><span class="n">file</span> <span class="n">LOG_FILE</span><span class="p">]</span> <span class="p">[</span><span class="o">-</span><span class="n">v</span><span class="p">]</span>
+                  <span class="p">[</span><span class="n">file_path</span> <span class="p">[</span><span class="n">file_path</span> <span class="o">...</span><span class="p">]]</span>

 <span class="n">Parses</span> <span class="n">DMARC</span> <span class="n">reports</span>

@@ -289,7 +288,8 @@ lookalike domain monitoring, check out <a class="reference external" href="https
                        <span class="n">nameservers</span><span class="p">)</span>
  <span class="o">-</span><span class="n">t</span> <span class="n">DNS_TIMEOUT</span><span class="p">,</span> <span class="o">--</span><span class="n">dns_timeout</span> <span class="n">DNS_TIMEOUT</span>
                        <span class="n">number</span> <span class="n">of</span> <span class="n">seconds</span> <span class="n">to</span> <span class="n">wait</span> <span class="k">for</span> <span class="n">an</span> <span class="n">answer</span> <span class="kn">from</span> <span class="nn">DNS</span>
-                        <span class="p">(</span><span class="n">default</span><span class="p">:</span> <span class="mf">6.0</span><span class="p">)</span>
+                        <span class="p">(</span><span class="n">default</span><span class="p">:</span> <span class="mf">2.0</span><span class="p">)</span>
+  <span class="o">--</span><span class="n">offline</span>             <span class="n">Do</span> <span class="ow">not</span> <span class="n">make</span> <span class="n">online</span> <span class="n">queries</span> <span class="k">for</span> <span class="n">geolocation</span> <span class="ow">or</span> <span class="n">DNS</span>
  <span class="o">-</span><span class="n">s</span><span class="p">,</span> <span class="o">--</span><span class="n">silent</span>          <span class="n">only</span> <span class="nb">print</span> <span class="n">errors</span> <span class="ow">and</span> <span class="n">warnings</span>
  <span class="o">--</span><span class="n">debug</span>               <span class="nb">print</span> <span class="n">debugging</span> <span class="n">information</span>
  <span class="o">--</span><span class="n">log</span><span class="o">-</span><span class="n">file</span> <span class="n">LOG_FILE</span>   <span class="n">output</span> <span class="n">logging</span> <span class="n">to</span> <span class="n">a</span> <span class="n">file</span>
@@ -338,6 +338,7 @@ lookalike domain monitoring, check out <a class="reference external" href="https
 <li><p><code class="docutils literal notranslate"><span class="pre">save_forensic</span></code> - bool: Save forensic report data to the Elasticsearch and/or Splunk</p></li>
 <li><p><code class="docutils literal notranslate"><span class="pre">strip_attachment_payloads</span></code> - bool: Remove attachment payloads from results</p></li>
 <li><p><code class="docutils literal notranslate"><span class="pre">output</span></code> - str: Directory to place JSON and CSV files in</p></li>
+<li><p><code class="docutils literal notranslate"><span class="pre">offline</span></code> - bool: Do not use online queries for geolocation or DNS</p></li>
 <li><p><code class="docutils literal notranslate"><span class="pre">nameservers</span></code> -  str: A comma separated list of DNS resolvers (Default: <a class="reference external" href="https://1.1.1.1/">Cloudflare’s public resolvers</a>)</p></li>
 <li><p><code class="docutils literal notranslate"><span class="pre">dns_timeout</span></code> - float: DNS timeout period</p></li>
 <li><p><code class="docutils literal notranslate"><span class="pre">debug</span></code> - bool: Print debugging messages</p></li>
@@ -1619,12 +1620,6 @@ that enforce with a DMARC quarantine or reject policy.</p>
 <div class="section" id="module-parsedmarc">
 <span id="api"></span><h2>API<a class="headerlink" href="#module-parsedmarc" title="Permalink to this headline">¶</a></h2>
 <p>A Python package for parsing DMARC reports</p>
-<dl class="exception">
-<dt id="parsedmarc.IMAPError">
-<em class="property">exception </em><code class="sig-prename descclassname">parsedmarc.</code><code class="sig-name descname">IMAPError</code><a class="reference internal" href="_modules/parsedmarc.html#IMAPError"><span class="viewcode-link">[source]</span></a><a class="headerlink" href="#parsedmarc.IMAPError" title="Permalink to this definition">¶</a></dt>
-<dd><p>Raised when an IMAP error occurs</p>
-</dd></dl>
-
 <dl class="exception">
 <dt id="parsedmarc.InvalidAggregateReport">
 <em class="property">exception </em><code class="sig-prename descclassname">parsedmarc.</code><code class="sig-name descname">InvalidAggregateReport</code><a class="reference internal" href="_modules/parsedmarc.html#InvalidAggregateReport"><span class="viewcode-link">[source]</span></a><a class="headerlink" href="#parsedmarc.InvalidAggregateReport" title="Permalink to this definition">¶</a></dt>
@@ -1649,15 +1644,9 @@ that enforce with a DMARC quarantine or reject policy.</p>
 <dd><p>Raised whenever the parser fails for some reason</p>
 </dd></dl>

-<dl class="exception">
-<dt id="parsedmarc.SMTPError">
-<em class="property">exception </em><code class="sig-prename descclassname">parsedmarc.</code><code class="sig-name descname">SMTPError</code><a class="reference internal" href="_modules/parsedmarc.html#SMTPError"><span class="viewcode-link">[source]</span></a><a class="headerlink" href="#parsedmarc.SMTPError" title="Permalink to this definition">¶</a></dt>
-<dd><p>Raised when a SMTP error occurs</p>
-</dd></dl>
-
 <dl class="function">
 <dt id="parsedmarc.email_results">
-<code class="sig-prename descclassname">parsedmarc.</code><code class="sig-name descname">email_results</code><span class="sig-paren">(</span><em class="sig-param">results</em>, <em class="sig-param">host</em>, <em class="sig-param">mail_from</em>, <em class="sig-param">mail_to</em>, <em class="sig-param">port=0</em>, <em class="sig-param">ssl=False</em>, <em class="sig-param">user=None</em>, <em class="sig-param">password=None</em>, <em class="sig-param">subject=None</em>, <em class="sig-param">attachment_filename=None</em>, <em class="sig-param">message=None</em>, <em class="sig-param">ssl_context=None</em><span class="sig-paren">)</span><a class="reference internal" href="_modules/parsedmarc.html#email_results"><span class="viewcode-link">[source]</span></a><a class="headerlink" href="#parsedmarc.email_results" title="Permalink to this definition">¶</a></dt>
+<code class="sig-prename descclassname">parsedmarc.</code><code class="sig-name descname">email_results</code><span class="sig-paren">(</span><em class="sig-param">results</em>, <em class="sig-param">host</em>, <em class="sig-param">mail_from</em>, <em class="sig-param">mail_to</em>, <em class="sig-param">mail_cc=None</em>, <em class="sig-param">mail_bcc=None</em>, <em class="sig-param">port=0</em>, <em class="sig-param">require_encryption=False</em>, <em class="sig-param">verify=True</em>, <em class="sig-param">username=None</em>, <em class="sig-param">password=None</em>, <em class="sig-param">subject=None</em>, <em class="sig-param">attachment_filename=None</em>, <em class="sig-param">message=None</em><span class="sig-paren">)</span><a class="reference internal" href="_modules/parsedmarc.html#email_results"><span class="viewcode-link">[source]</span></a><a class="headerlink" href="#parsedmarc.email_results" title="Permalink to this definition">¶</a></dt>
 <dd><p>Emails parsing results as a zip file</p>
 <dl class="field-list simple">
 <dt class="field-odd">Parameters</dt>
@@ -1665,15 +1654,17 @@ that enforce with a DMARC quarantine or reject policy.</p>
 <li><p><strong>results</strong> (<em>OrderedDict</em>) – Parsing results</p></li>
 <li><p><strong>host</strong> – Mail server hostname or IP address</p></li>
 <li><p><strong>mail_from</strong> – The value of the message from header</p></li>
-<li><p><strong>mail_to</strong> – A list of addresses to mail to</p></li>
+<li><p><strong>mail_to</strong> (<em>list</em>) – A list of addresses to mail to</p></li>
+<li><p><strong>mail_cc</strong> (<em>list</em>) – A list of addresses to CC</p></li>
+<li><p><strong>mail_bcc</strong> (<em>list</em>) – A list addresses to BCC</p></li>
 <li><p><strong>port</strong> (<em>int</em>) – Port to use</p></li>
-<li><p><strong>ssl</strong> (<em>bool</em>) – Require a SSL connection from the start</p></li>
-<li><p><strong>user</strong> – An optional username</p></li>
-<li><p><strong>password</strong> – An optional password</p></li>
-<li><p><strong>subject</strong> – Overrides the default message subject</p></li>
-<li><p><strong>attachment_filename</strong> – Override the default attachment filename</p></li>
-<li><p><strong>message</strong> – Override the default plain text body</p></li>
-<li><p><strong>ssl_context</strong> – SSL context options</p></li>
+<li><p><strong>require_encryption</strong> (<em>bool</em>) – Require a secure connection from the start</p></li>
+<li><p><strong>verify</strong> (<em>bool</em>) – verify the SSL/TLS certificate</p></li>
+<li><p><strong>username</strong> (<em>str</em>) – An optional username</p></li>
+<li><p><strong>password</strong> (<em>str</em>) – An optional password</p></li>
+<li><p><strong>subject</strong> (<em>str</em>) – Overrides the default message subject</p></li>
+<li><p><strong>attachment_filename</strong> (<em>str</em>) – Override the default attachment filename</p></li>
+<li><p><strong>(</strong><strong>str</strong> (<em>message</em>) – Override the default plain text body</p></li>
 </ul>
 </dd>
 </dl>
@@ -1699,24 +1690,23 @@ or bytes.</p>

 <dl class="function">
 <dt id="parsedmarc.get_dmarc_reports_from_inbox">
-<code class="sig-prename descclassname">parsedmarc.</code><code class="sig-name descname">get_dmarc_reports_from_inbox</code><span class="sig-paren">(</span><em class="sig-param">host=None</em>, <em class="sig-param">user=None</em>, <em class="sig-param">password=None</em>, <em class="sig-param">connection=None</em>, <em class="sig-param">port=None</em>, <em class="sig-param">ssl=True</em>, <em class="sig-param">ssl_context=None</em>, <em class="sig-param">move_supported=None</em>, <em class="sig-param">reports_folder='INBOX'</em>, <em class="sig-param">archive_folder='Archive'</em>, <em class="sig-param">delete=False</em>, <em class="sig-param">test=False</em>, <em class="sig-param">nameservers=None</em>, <em class="sig-param">dns_timeout=6.0</em>, <em class="sig-param">strip_attachment_payloads=False</em>, <em class="sig-param">results=None</em><span class="sig-paren">)</span><a class="reference internal" href="_modules/parsedmarc.html#get_dmarc_reports_from_inbox"><span class="viewcode-link">[source]</span></a><a class="headerlink" href="#parsedmarc.get_dmarc_reports_from_inbox" title="Permalink to this definition">¶</a></dt>
-<dd><p>Fetches and parses DMARC reports from sn inbox</p>
+<code class="sig-prename descclassname">parsedmarc.</code><code class="sig-name descname">get_dmarc_reports_from_inbox</code><span class="sig-paren">(</span><em class="sig-param">connection=None</em>, <em class="sig-param">host=None</em>, <em class="sig-param">user=None</em>, <em class="sig-param">password=None</em>, <em class="sig-param">port=None</em>, <em class="sig-param">ssl=True</em>, <em class="sig-param">verify=True</em>, <em class="sig-param">reports_folder='INBOX'</em>, <em class="sig-param">archive_folder='Archive'</em>, <em class="sig-param">delete=False</em>, <em class="sig-param">test=False</em>, <em class="sig-param">offline=False</em>, <em class="sig-param">nameservers=None</em>, <em class="sig-param">dns_timeout=6.0</em>, <em class="sig-param">strip_attachment_payloads=False</em>, <em class="sig-param">results=None</em><span class="sig-paren">)</span><a class="reference internal" href="_modules/parsedmarc.html#get_dmarc_reports_from_inbox"><span class="viewcode-link">[source]</span></a><a class="headerlink" href="#parsedmarc.get_dmarc_reports_from_inbox" title="Permalink to this definition">¶</a></dt>
+<dd><p>Fetches and parses DMARC reports from an inbox</p>
 <dl class="field-list simple">
 <dt class="field-odd">Parameters</dt>
 <dd class="field-odd"><ul class="simple">
+<li><p><strong>connection</strong> – An IMAPClient connection to reuse</p></li>
 <li><p><strong>host</strong> – The mail server hostname or IP address</p></li>
 <li><p><strong>user</strong> – The mail server user</p></li>
 <li><p><strong>password</strong> – The mail server password</p></li>
-<li><p><strong>connection</strong> – An IMAPCLient connection to reuse</p></li>
 <li><p><strong>port</strong> – The mail server port</p></li>
 <li><p><strong>ssl</strong> (<em>bool</em>) – Use SSL/TLS</p></li>
-<li><p><strong>ssl_context</strong> (<em>SSLContext</em>) – A SSL context</p></li>
-<li><p><strong>move_supported</strong> – Indicate if the IMAP server supports the MOVE command</p></li>
-<li><p><strong>if None</strong><strong>)</strong> (<em>(</em><em>autodetect</em>) – </p></li>
+<li><p><strong>verify</strong> (<em>bool</em>) – Verify SSL/TLS certificate</p></li>
 <li><p><strong>reports_folder</strong> – The IMAP folder where reports can be found</p></li>
 <li><p><strong>archive_folder</strong> – The folder to move processed mail to</p></li>
 <li><p><strong>delete</strong> (<em>bool</em>) – Delete  messages after processing them</p></li>
 <li><p><strong>test</strong> (<em>bool</em>) – Do not move or delete messages after processing them</p></li>
+<li><p><strong>offline</strong> (<em>bool</em>) – Do not query onfline for geolocation or DNS</p></li>
 <li><p><strong>nameservers</strong> (<em>list</em>) – A list of DNS nameservers to query</p></li>
 <li><p><strong>dns_timeout</strong> (<em>float</em>) – Set the DNS query timeout</p></li>
 <li><p><strong>strip_attachment_payloads</strong> (<em>bool</em>) – Remove attachment payloads from</p></li>
@@ -1764,13 +1754,14 @@ or bytes.</p>

 <dl class="function">
 <dt id="parsedmarc.parse_aggregate_report_file">
-<code class="sig-prename descclassname">parsedmarc.</code><code class="sig-name descname">parse_aggregate_report_file</code><span class="sig-paren">(</span><em class="sig-param">_input</em>, <em class="sig-param">nameservers=None</em>, <em class="sig-param">dns_timeout=2.0</em>, <em class="sig-param">parallel=False</em><span class="sig-paren">)</span><a class="reference internal" href="_modules/parsedmarc.html#parse_aggregate_report_file"><span class="viewcode-link">[source]</span></a><a class="headerlink" href="#parsedmarc.parse_aggregate_report_file" title="Permalink to this definition">¶</a></dt>
+<code class="sig-prename descclassname">parsedmarc.</code><code class="sig-name descname">parse_aggregate_report_file</code><span class="sig-paren">(</span><em class="sig-param">_input</em>, <em class="sig-param">offline=False</em>, <em class="sig-param">nameservers=None</em>, <em class="sig-param">dns_timeout=2.0</em>, <em class="sig-param">parallel=False</em><span class="sig-paren">)</span><a class="reference internal" href="_modules/parsedmarc.html#parse_aggregate_report_file"><span class="viewcode-link">[source]</span></a><a class="headerlink" href="#parsedmarc.parse_aggregate_report_file" title="Permalink to this definition">¶</a></dt>
 <dd><p>Parses a file at the given path, a file-like object. or bytes as a
 aggregate DMARC report</p>
 <dl class="field-list simple">
 <dt class="field-odd">Parameters</dt>
 <dd class="field-odd"><ul class="simple">
 <li><p><strong>_input</strong> – A path to a file, a file like object, or bytes</p></li>
+<li><p><strong>offline</strong> (<em>bool</em>) – Do not query online for geolocation or DNS</p></li>
 <li><p><strong>nameservers</strong> (<em>list</em>) – A list of one or more nameservers to use</p></li>
 <li><p><strong>public DNS resolvers by default</strong><strong>)</strong> (<em>(</em><em>Cloudflare's</em>) – </p></li>
 <li><p><strong>dns_timeout</strong> (<em>float</em>) – Sets the DNS timeout in seconds</p></li>
@@ -1788,12 +1779,13 @@ aggregate DMARC report</p>

 <dl class="function">
 <dt id="parsedmarc.parse_aggregate_report_xml">
-<code class="sig-prename descclassname">parsedmarc.</code><code class="sig-name descname">parse_aggregate_report_xml</code><span class="sig-paren">(</span><em class="sig-param">xml</em>, <em class="sig-param">nameservers=None</em>, <em class="sig-param">timeout=2.0</em>, <em class="sig-param">parallel=False</em><span class="sig-paren">)</span><a class="reference internal" href="_modules/parsedmarc.html#parse_aggregate_report_xml"><span class="viewcode-link">[source]</span></a><a class="headerlink" href="#parsedmarc.parse_aggregate_report_xml" title="Permalink to this definition">¶</a></dt>
+<code class="sig-prename descclassname">parsedmarc.</code><code class="sig-name descname">parse_aggregate_report_xml</code><span class="sig-paren">(</span><em class="sig-param">xml</em>, <em class="sig-param">offline=False</em>, <em class="sig-param">nameservers=None</em>, <em class="sig-param">timeout=2.0</em>, <em class="sig-param">parallel=False</em><span class="sig-paren">)</span><a class="reference internal" href="_modules/parsedmarc.html#parse_aggregate_report_xml"><span class="viewcode-link">[source]</span></a><a class="headerlink" href="#parsedmarc.parse_aggregate_report_xml" title="Permalink to this definition">¶</a></dt>
 <dd><p>Parses a DMARC XML report string and returns a consistent OrderedDict</p>
 <dl class="field-list simple">
 <dt class="field-odd">Parameters</dt>
 <dd class="field-odd"><ul class="simple">
 <li><p><strong>xml</strong> (<em>str</em>) – A string of DMARC aggregate report XML</p></li>
+<li><p><strong>offline</strong> (<em>bool</em>) – Do not query online for geolocation or DNS</p></li>
 <li><p><strong>nameservers</strong> (<em>list</em>) – A list of one or more nameservers to use</p></li>
 <li><p><strong>public DNS resolvers by default</strong><strong>)</strong> (<em>(</em><em>Cloudflare's</em>) – </p></li>
 <li><p><strong>timeout</strong> (<em>float</em>) – Sets the DNS timeout in seconds</p></li>
@@ -1811,12 +1803,13 @@ aggregate DMARC report</p>

 <dl class="function">
 <dt id="parsedmarc.parse_forensic_report">
-<code class="sig-prename descclassname">parsedmarc.</code><code class="sig-name descname">parse_forensic_report</code><span class="sig-paren">(</span><em class="sig-param">feedback_report</em>, <em class="sig-param">sample</em>, <em class="sig-param">msg_date</em>, <em class="sig-param">nameservers=None</em>, <em class="sig-param">dns_timeout=2.0</em>, <em class="sig-param">strip_attachment_payloads=False</em>, <em class="sig-param">parallel=False</em><span class="sig-paren">)</span><a class="reference internal" href="_modules/parsedmarc.html#parse_forensic_report"><span class="viewcode-link">[source]</span></a><a class="headerlink" href="#parsedmarc.parse_forensic_report" title="Permalink to this definition">¶</a></dt>
+<code class="sig-prename descclassname">parsedmarc.</code><code class="sig-name descname">parse_forensic_report</code><span class="sig-paren">(</span><em class="sig-param">feedback_report</em>, <em class="sig-param">sample</em>, <em class="sig-param">msg_date</em>, <em class="sig-param">offline=False</em>, <em class="sig-param">nameservers=None</em>, <em class="sig-param">dns_timeout=2.0</em>, <em class="sig-param">strip_attachment_payloads=False</em>, <em class="sig-param">parallel=False</em><span class="sig-paren">)</span><a class="reference internal" href="_modules/parsedmarc.html#parse_forensic_report"><span class="viewcode-link">[source]</span></a><a class="headerlink" href="#parsedmarc.parse_forensic_report" title="Permalink to this definition">¶</a></dt>
 <dd><p>Converts a DMARC forensic report and sample to a <code class="docutils literal notranslate"><span class="pre">OrderedDict</span></code></p>
 <dl class="field-list simple">
 <dt class="field-odd">Parameters</dt>
 <dd class="field-odd"><ul class="simple">
 <li><p><strong>feedback_report</strong> (<em>str</em>) – A message’s feedback report as a string</p></li>
+<li><p><strong>offline</strong> (<em>bool</em>) – Do not query online for geolocation or DNS</p></li>
 <li><p><strong>sample</strong> (<em>str</em>) – The RFC 822 headers or RFC 822 message sample</p></li>
 <li><p><strong>msg_date</strong> (<em>str</em>) – The message’s date header</p></li>
 <li><p><strong>nameservers</strong> (<em>list</em>) – A list of one or more nameservers to use</p></li>
@@ -1838,12 +1831,13 @@ aggregate DMARC report</p>

 <dl class="function">
 <dt id="parsedmarc.parse_report_email">
-<code class="sig-prename descclassname">parsedmarc.</code><code class="sig-name descname">parse_report_email</code><span class="sig-paren">(</span><em class="sig-param">input_</em>, <em class="sig-param">nameservers=None</em>, <em class="sig-param">dns_timeout=2.0</em>, <em class="sig-param">strip_attachment_payloads=False</em>, <em class="sig-param">parallel=False</em><span class="sig-paren">)</span><a class="reference internal" href="_modules/parsedmarc.html#parse_report_email"><span class="viewcode-link">[source]</span></a><a class="headerlink" href="#parsedmarc.parse_report_email" title="Permalink to this definition">¶</a></dt>
+<code class="sig-prename descclassname">parsedmarc.</code><code class="sig-name descname">parse_report_email</code><span class="sig-paren">(</span><em class="sig-param">input_</em>, <em class="sig-param">offline=False</em>, <em class="sig-param">nameservers=None</em>, <em class="sig-param">dns_timeout=2.0</em>, <em class="sig-param">strip_attachment_payloads=False</em>, <em class="sig-param">parallel=False</em><span class="sig-paren">)</span><a class="reference internal" href="_modules/parsedmarc.html#parse_report_email"><span class="viewcode-link">[source]</span></a><a class="headerlink" href="#parsedmarc.parse_report_email" title="Permalink to this definition">¶</a></dt>
 <dd><p>Parses a DMARC report from an email</p>
 <dl class="field-list simple">
 <dt class="field-odd">Parameters</dt>
 <dd class="field-odd"><ul class="simple">
 <li><p><strong>input_</strong> – An emailed DMARC report in RFC 822 format, as bytes or a string</p></li>
+<li><p><strong>offline</strong> (<em>bool</em>) – Do not query online for geolocation on DNS</p></li>
 <li><p><strong>nameservers</strong> (<em>list</em>) – A list of one or more nameservers to use</p></li>
 <li><p><strong>dns_timeout</strong> (<em>float</em>) – Sets the DNS timeout in seconds</p></li>
 <li><p><strong>strip_attachment_payloads</strong> (<em>bool</em>) – Remove attachment payloads from</p></li>
@@ -1866,7 +1860,7 @@ aggregate DMARC report</p>

 <dl class="function">
 <dt id="parsedmarc.parse_report_file">
-<code class="sig-prename descclassname">parsedmarc.</code><code class="sig-name descname">parse_report_file</code><span class="sig-paren">(</span><em class="sig-param">input_</em>, <em class="sig-param">nameservers=None</em>, <em class="sig-param">dns_timeout=2.0</em>, <em class="sig-param">strip_attachment_payloads=False</em>, <em class="sig-param">parallel=False</em><span class="sig-paren">)</span><a class="reference internal" href="_modules/parsedmarc.html#parse_report_file"><span class="viewcode-link">[source]</span></a><a class="headerlink" href="#parsedmarc.parse_report_file" title="Permalink to this definition">¶</a></dt>
+<code class="sig-prename descclassname">parsedmarc.</code><code class="sig-name descname">parse_report_file</code><span class="sig-paren">(</span><em class="sig-param">input_</em>, <em class="sig-param">nameservers=None</em>, <em class="sig-param">dns_timeout=2.0</em>, <em class="sig-param">strip_attachment_payloads=False</em>, <em class="sig-param">offline=False</em>, <em class="sig-param">parallel=False</em><span class="sig-paren">)</span><a class="reference internal" href="_modules/parsedmarc.html#parse_report_file"><span class="viewcode-link">[source]</span></a><a class="headerlink" href="#parsedmarc.parse_report_file" title="Permalink to this definition">¶</a></dt>
 <dd><p>Parses a DMARC aggregate or forensic file at the given path, a
 file-like object. or bytes</p>
 <dl class="field-list simple">
@@ -1878,6 +1872,7 @@ file-like object. or bytes</p>
 <li><p><strong>dns_timeout</strong> (<em>float</em>) – Sets the DNS timeout in seconds</p></li>
 <li><p><strong>strip_attachment_payloads</strong> (<em>bool</em>) – Remove attachment payloads from</p></li>
 <li><p><strong>report results</strong> (<em>forensic</em>) – </p></li>
+<li><p><strong>offline</strong> (<em>bool</em>) – Do not make online queries for geolocation or DNS</p></li>
 <li><p><strong>parallel</strong> (<em>bool</em>) – Parallel processing</p></li>
 </ul>
 </dd>
@@ -1942,32 +1937,36 @@ headers</p>

 <dl class="function">
 <dt id="parsedmarc.watch_inbox">
-<code class="sig-prename descclassname">parsedmarc.</code><code class="sig-name descname">watch_inbox</code><span class="sig-paren">(</span><em class="sig-param">host</em>, <em class="sig-param">username</em>, <em class="sig-param">password</em>, <em class="sig-param">callback</em>, <em class="sig-param">port=None</em>, <em class="sig-param">ssl=True</em>, <em class="sig-param">ssl_context=None</em>, <em class="sig-param">reports_folder='INBOX'</em>, <em class="sig-param">archive_folder='Archive'</em>, <em class="sig-param">delete=False</em>, <em class="sig-param">test=False</em>, <em class="sig-param">wait=30</em>, <em class="sig-param">nameservers=None</em>, <em class="sig-param">dns_timeout=6.0</em>, <em class="sig-param">strip_attachment_payloads=False</em><span class="sig-paren">)</span><a class="reference internal" href="_modules/parsedmarc.html#watch_inbox"><span class="viewcode-link">[source]</span></a><a class="headerlink" href="#parsedmarc.watch_inbox" title="Permalink to this definition">¶</a></dt>
+<code class="sig-prename descclassname">parsedmarc.</code><code class="sig-name descname">watch_inbox</code><span class="sig-paren">(</span><em class="sig-param">host</em>, <em class="sig-param">username</em>, <em class="sig-param">password</em>, <em class="sig-param">callback</em>, <em class="sig-param">port=None</em>, <em class="sig-param">ssl=True</em>, <em class="sig-param">verify=True</em>, <em class="sig-param">reports_folder='INBOX'</em>, <em class="sig-param">archive_folder='Archive'</em>, <em class="sig-param">delete=False</em>, <em class="sig-param">test=False</em>, <em class="sig-param">idle_timeout=30</em>, <em class="sig-param">offline=False</em>, <em class="sig-param">nameservers=None</em>, <em class="sig-param">dns_timeout=6.0</em>, <em class="sig-param">strip_attachment_payloads=False</em><span class="sig-paren">)</span><a class="reference internal" href="_modules/parsedmarc.html#watch_inbox"><span class="viewcode-link">[source]</span></a><a class="headerlink" href="#parsedmarc.watch_inbox" title="Permalink to this definition">¶</a></dt>
 <dd><p>Use an IDLE IMAP connection to parse incoming emails, and pass the results
-to a callback function</p>
-<dl class="field-list simple">
-<dt class="field-odd">Parameters</dt>
-<dd class="field-odd"><ul class="simple">
-<li><p><strong>host</strong> – The mail server hostname or IP address</p></li>
-<li><p><strong>username</strong> – The mail server username</p></li>
-<li><p><strong>password</strong> – The mail server password</p></li>
-<li><p><strong>callback</strong> – The callback function to receive the parsing results</p></li>
-<li><p><strong>port</strong> – The mail server port</p></li>
-<li><p><strong>ssl</strong> (<em>bool</em>) – Use SSL/TLS</p></li>
-<li><p><strong>ssl_context</strong> (<em>SSLContext</em>) – A SSL context</p></li>
-<li><p><strong>reports_folder</strong> – The IMAP folder where reports can be found</p></li>
-<li><p><strong>archive_folder</strong> – The folder to move processed mail to</p></li>
-<li><p><strong>delete</strong> (<em>bool</em>) – Delete  messages after processing them</p></li>
-<li><p><strong>test</strong> (<em>bool</em>) – Do not move or delete messages after processing them</p></li>
-<li><p><strong>wait</strong> (<em>int</em>) – Number of seconds to wait for a IMAP IDLE response</p></li>
-<li><p><strong>nameservers</strong> (<em>list</em>) – A list of one or more nameservers to use</p></li>
-<li><p><strong>public DNS resolvers by default</strong><strong>)</strong> (<em>(</em><em>Cloudflare's</em>) – </p></li>
-<li><p><strong>dns_timeout</strong> (<em>float</em>) – Set the DNS query timeout</p></li>
-<li><p><strong>strip_attachment_payloads</strong> (<em>bool</em>) – Replace attachment payloads in</p></li>
-<li><p><strong>report samples with None</strong> (<em>forensic</em>) – </p></li>
-</ul>
-</dd>
-</dl>
+to a callback function
+:param host: The mail server hostname or IP address
+:param username: The mail server username
+:param password: The mail server password
+:param callback: The callback function to receive the parsing results
+:param port: The mail server port
+:param ssl: Use SSL/TLS
+:type ssl: bool
+:param verify: Verify the TLS/SSL certificate
+:type verify: bool
+:param reports_folder: The IMAP folder where reports can be found
+:param archive_folder: The folder to move processed mail to
+:param delete: Delete  messages after processing them
+:type delete: bool
+:param test: Do not move or delete messages after processing them
+:type test: bool
+:param idle_timeout: Number of seconds to wait for a IMAP IDLE response
+:type idle_timeout: int
+:param offline: Do not query online for geolocation or DNS
+:type offline: bool
+:param nameservers: A list of one or more nameservers to use
+:type nameservers: list
+:param (Cloudflare’s public DNS resolvers by default):
+:param dns_timeout: Set the DNS query timeout
+:type dns_timeout: float
+:param strip_attachment_payloads: Replace attachment payloads in
+:type strip_attachment_payloads: bool
+:param forensic report samples with None:</p>
 </dd></dl>

 <div class="section" id="module-parsedmarc.elastic">
@@ -2072,11 +2071,9 @@ index</p></li>
 <div class="toctree-wrapper compound">
 </div>
 </div>
-<div class="section" id="parsedmarc-splunk">
-<h3>parsedmarc.splunk<a class="headerlink" href="#parsedmarc-splunk" title="Permalink to this headline">¶</a></h3>
-<div class="toctree-wrapper compound">
-</div>
-<span class="target" id="module-parsedmarc.splunk"></span><dl class="class">
+<div class="section" id="module-parsedmarc.splunk">
+<span id="parsedmarc-splunk"></span><h3>parsedmarc.splunk<a class="headerlink" href="#module-parsedmarc.splunk" title="Permalink to this headline">¶</a></h3>
+<dl class="class">
 <dt id="parsedmarc.splunk.HECClient">
 <em class="property">class </em><code class="sig-prename descclassname">parsedmarc.splunk.</code><code class="sig-name descname">HECClient</code><span class="sig-paren">(</span><em class="sig-param">url</em>, <em class="sig-param">access_token</em>, <em class="sig-param">index</em>, <em class="sig-param">source='parsedmarc'</em>, <em class="sig-param">verify=True</em>, <em class="sig-param">timeout=60</em><span class="sig-paren">)</span><a class="reference internal" href="_modules/parsedmarc/splunk.html#HECClient"><span class="viewcode-link">[source]</span></a><a class="headerlink" href="#parsedmarc.splunk.HECClient" title="Permalink to this definition">¶</a></dt>
 <dd><p>A client for a Splunk HTTP Events Collector (HEC)</p>
@@ -2209,7 +2206,7 @@ standard RFC 822 format</p>

 <dl class="function">
 <dt id="parsedmarc.utils.get_ip_address_country">
-<code class="sig-prename descclassname">parsedmarc.utils.</code><code class="sig-name descname">get_ip_address_country</code><span class="sig-paren">(</span><em class="sig-param">ip_address</em>, <em class="sig-param">parallel=False</em><span class="sig-paren">)</span><a class="reference internal" href="_modules/parsedmarc/utils.html#get_ip_address_country"><span class="viewcode-link">[source]</span></a><a class="headerlink" href="#parsedmarc.utils.get_ip_address_country" title="Permalink to this definition">¶</a></dt>
+<code class="sig-prename descclassname">parsedmarc.utils.</code><code class="sig-name descname">get_ip_address_country</code><span class="sig-paren">(</span><em class="sig-param">ip_address</em>, <em class="sig-param">parallel=False</em>, <em class="sig-param">offline=False</em><span class="sig-paren">)</span><a class="reference internal" href="_modules/parsedmarc/utils.html#get_ip_address_country"><span class="viewcode-link">[source]</span></a><a class="headerlink" href="#parsedmarc.utils.get_ip_address_country" title="Permalink to this definition">¶</a></dt>
 <dd><p>Uses the MaxMind Geolite2 Country database to return the ISO code for the
 country associated with the given IPv4 or IPv6 address</p>
 <dl class="field-list simple">
@@ -2217,6 +2214,7 @@ country associated with the given IPv4 or IPv6 address</p>
 <dd class="field-odd"><ul class="simple">
 <li><p><strong>ip_address</strong> (<em>str</em>) – The IP address to query for</p></li>
 <li><p><strong>parallel</strong> (<em>bool</em>) – Parallel processing</p></li>
+<li><p><strong>offline</strong> (<em>bool</em>) – Do not make online queries for geolocation and DNS</p></li>
 </ul>
 </dd>
 <dt class="field-even">Returns</dt>
@@ -2230,13 +2228,14 @@ country associated with the given IPv4 or IPv6 address</p>

 <dl class="function">
 <dt id="parsedmarc.utils.get_ip_address_info">
-<code class="sig-prename descclassname">parsedmarc.utils.</code><code class="sig-name descname">get_ip_address_info</code><span class="sig-paren">(</span><em class="sig-param">ip_address</em>, <em class="sig-param">cache=None</em>, <em class="sig-param">nameservers=None</em>, <em class="sig-param">timeout=2.0</em>, <em class="sig-param">parallel=False</em><span class="sig-paren">)</span><a class="reference internal" href="_modules/parsedmarc/utils.html#get_ip_address_info"><span class="viewcode-link">[source]</span></a><a class="headerlink" href="#parsedmarc.utils.get_ip_address_info" title="Permalink to this definition">¶</a></dt>
+<code class="sig-prename descclassname">parsedmarc.utils.</code><code class="sig-name descname">get_ip_address_info</code><span class="sig-paren">(</span><em class="sig-param">ip_address</em>, <em class="sig-param">cache=None</em>, <em class="sig-param">offline=False</em>, <em class="sig-param">nameservers=None</em>, <em class="sig-param">timeout=2.0</em>, <em class="sig-param">parallel=False</em><span class="sig-paren">)</span><a class="reference internal" href="_modules/parsedmarc/utils.html#get_ip_address_info"><span class="viewcode-link">[source]</span></a><a class="headerlink" href="#parsedmarc.utils.get_ip_address_info" title="Permalink to this definition">¶</a></dt>
 <dd><p>Returns reverse DNS and country information for the given IP address</p>
 <dl class="field-list simple">
 <dt class="field-odd">Parameters</dt>
 <dd class="field-odd"><ul class="simple">
 <li><p><strong>ip_address</strong> (<em>str</em>) – The IP address to check</p></li>
 <li><p><strong>cache</strong> (<em>ExpiringDict</em>) – Cache storage</p></li>
+<li><p><strong>offline</strong> (<em>bool</em>) – Do not make online queries for geolocation or DNS</p></li>
 <li><p><strong>nameservers</strong> (<em>list</em>) – A list of one or more nameservers to use</p></li>
 <li><p><strong>public DNS resolvers by default</strong><strong>)</strong> (<em>(</em><em>Cloudflare's</em>) – </p></li>
 <li><p><strong>timeout</strong> (<em>float</em>) – Sets the DNS timeout in seconds</p></li>