mirror of
https://github.com/domainaware/parsedmarc.git
synced 2026-07-31 04:35:58 +00:00
29a4dd5149
* Document the review lessons from PR #858's review cycle Three rules distilled from the misses: plain-type docstrings are wrong when None is a semantic state; "pre-existing" triage stops applying when the diff extends the set a claim quantifies over; and verify CI's gates (patch coverage), not just its commands — with ad-hoc checks built to fail loudly on empty matches. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * Use the standard unhyphenated "ad hoc" and "post hoc" Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * Consolidate the review lessons thematically instead of chronologically The review section had grown by accretion — a new block of rules per review cycle (#834, #839, #849, #851, #858), each retelling its incident at length, with the same principles recurring under different PR numbers. Regroup all fifteen rules into five themes (prose as prose; nothing is pre-verified; claims vs. what they range over; verify what CI enforces; fresh-context review), keeping every rule and every concrete incident compressed to one clause with its PR number. Cuts the section from ~1,830 to ~1,180 words with no rule lost. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * Make mid-incident glue the fifth disguise, matching the stated count Copilot review: "Nothing is pre-verified" announced four disguises but listed four bullets plus a trailing unbulleted rule — ambiguous by this file's own enumeration-counting standard. Fold mid-incident glue into the enumeration (its mechanism is the same: code that escapes review because of how it was produced) and restore the same-scrutiny-as-a- subagent clause dropped during consolidation. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * Pluralize the review-discipline intro; standardize on American spelling Copilot review round: the intro used distributive singulars against a five-PR enumeration, and the file mixed "behaviour" (older Testing standards text) with "behavior" (newer sections). Standardized the whole file to American spelling per maintainer preference. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> --------- Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
parsedmarc
parsedmarc is a Python module and CLI utility for parsing DMARC
reports. When used with Elasticsearch and Kibana (or Splunk), it works
as a self-hosted open-source alternative to commercial DMARC report
processing services such as Agari Brand Protection, Dmarcian, OnDMARC,
ProofPoint Email Fraud Defense, and Valimail.
Note
Domain-based Message Authentication, Reporting, and Conformance (DMARC) is an email authentication protocol.
Sponsors
This project is maintained by one developer. Please consider sponsoring my work if you or your organization benefit from it.
Features
- Parses aggregate/rua DMARC reports: the legacy draft and 1.0 schemas (RFC 7489) and the new RFC 9990 schema for the final DMARC standard (RFC 9989)
- Parses failure/ruf DMARC reports (RFC 6591 and RFC 9991; formerly called forensic reports)
- Parses reports from SMTP TLS Reporting (TLS-RPT, RFC 8460)
- Can parse reports from an inbox over IMAP, Microsoft Graph, or Gmail API
- Transparently handles gzip or zip compressed reports
- Consistent data structures
- Simple JSON and/or CSV output
- Optionally email the results
- Optionally send the results to Elasticsearch, OpenSearch, Splunk, or PostgreSQL, for use with premade dashboards
- Optionally send the results to Apache Kafka, Amazon S3, Azure Log Analytics (Microsoft Sentinel), a Graylog (GELF) endpoint, a syslog server, or an HTTP webhook
Python Compatibility
This project supports the following Python versions, which are either actively maintained or are the default versions for RHEL or Debian.
| Version | Supported | Reason |
|---|---|---|
| < 3.6 | ❌ | End of Life (EOL) |
| 3.6 | ❌ | Used in RHEL 8, but not supported by project dependencies |
| 3.7 | ❌ | End of Life (EOL) |
| 3.8 | ❌ | End of Life (EOL) |
| 3.9 | ❌ | Used in Debian 11 and RHEL 9, but not supported by project dependencies |
| 3.10 | ✅ | Actively maintained |
| 3.11 | ✅ | Actively maintained; supported until June 2028 (Debian 12) |
| 3.12 | ✅ | Actively maintained; supported until May 2035 (RHEL 10) |
| 3.13 | ✅ | Actively maintained; supported until June 2030 (Debian 13) |
| 3.14 | ✅ | Supported (requires imapclient>=3.1.0) |