mirror of
https://github.com/domainaware/parsedmarc.git
synced 2026-04-24 14:29:27 +00:00
35dda7c0a6
sortlists.py had three bugs that let bad data through: - The `type` column validator was keyed on "Type" (capital T) but the CSV header is "type" (lowercase), so every row bypassed validation. - `types` was read via `f.readlines()` without stripping, so even if the key had matched, values like `"ISP\n"` would never equal `"ISP"`. - The map was sorted case-sensitively, but README and AGENTS.md both state the map is sorted alphabetically case-insensitive. Fixing the validator surfaced eight pre-existing rows with invalid or inconsistent `type` values. All are now corrected: - Two types listed in README but missing from base_reverse_dns_types.txt (Religion, Utilities) have been added so the README and authoritative types file agree. - dhl.com, ghm-grenoble.fr, regusnet.com had lowercase-casing type values (`logistics`, `healthcare`, `Real estate`) corrected to match the canonical spellings. - lodestonegroup.com was typed `Insurance`, which is not a listed industry; reclassified as `Finance` (the closest listed category for an insurance brokerage). Also fixes one stale map entry: `rt.ru` was listed as `RT,Government Media`, conflating Rostelecom (the Russian telco that owns and uses rt.ru) with RT / Russia Today (which uses rt.com). Corrected to `Rostelecom,ISP`. Switching to case-insensitive sort moves exactly one row — the sole mixed-case key `United-domains.de` — from the top of the file (where ASCII ordering placed it before all lowercase keys) into the "united" range where human readers would expect it. Co-authored-by: Sean Whalen <seanthegeek@users.noreply.github.com> Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
parsedmarc
parsedmarc is a Python module and CLI utility for parsing DMARC
reports. When used with Elasticsearch and Kibana (or Splunk), it works
as a self-hosted open-source alternative to commercial DMARC report
processing services such as Agari Brand Protection, Dmarcian, OnDMARC,
ProofPoint Email Fraud Defense, and Valimail.
Note
Domain-based Message Authentication, Reporting, and Conformance (DMARC) is an email authentication protocol.
Sponsors
This is a project is maintained by one developer. Please consider sponsoring my work if you or your organization benefit from it.
Features
- Parses draft and 1.0 standard aggregate/rua DMARC reports
- Parses forensic/failure/ruf DMARC reports
- Parses reports from SMTP TLS Reporting
- Can parse reports from an inbox over IMAP, Microsoft Graph, or Gmail API
- Transparently handles gzip or zip compressed reports
- Consistent data structures
- Simple JSON and/or CSV output
- Optionally email the results
- Optionally send the results to Elasticsearch, Opensearch, and/or Splunk, for use with premade dashboards
- Optionally send reports to Apache Kafka
Python Compatibility
This project supports the following Python versions, which are either actively maintained or are the default versions for RHEL or Debian.
| Version | Supported | Reason |
|---|---|---|
| < 3.6 | ❌ | End of Life (EOL) |
| 3.6 | ❌ | Used in RHEL 8, but not supported by project dependencies |
| 3.7 | ❌ | End of Life (EOL) |
| 3.8 | ❌ | End of Life (EOL) |
| 3.9 | ❌ | Used in Debian 11 and RHEL 9, but not supported by project dependencies |
| 3.10 | ✅ | Actively maintained |
| 3.11 | ✅ | Actively maintained; supported until June 2028 (Debian 12) |
| 3.12 | ✅ | Actively maintained; supported until May 2035 (RHEL 10) |
| 3.13 | ✅ | Actively maintained; supported until June 2030 (Debian 13) |
| 3.14 | ✅ | Supported (requires imapclient>=3.1.0) |