mirror of
https://github.com/domainaware/parsedmarc.git
synced 2026-05-20 19:05:24 +00:00
Sean Whalen
6926e69d01
* Add 105 ASN-domain coverage-gap entries (commercial brands, universities, ISPs) Sweeps the top ~250 unmapped as_domain entries from the IPinfo Lite MMDB by IPv4 weight. Three buckets: 1. Globally-known commercial brands where the as_name and the well-established public brand identity match (UPS, Best Buy, Marriott, ING, Raytheon, Henkel, Experian, Tucows, Verisign, JD.com, Newfold Digital — alias from enduranceinternational.com, Hyundai Home Shopping, Qihoo 360, Kingsoft, SIAC). 2. Accredited educational institutions where the .edu / .ac.* / .edu.* TLD restriction is itself a corroborating source alongside the MMDB as_name (Texas Tech, U Wyoming, U Alaska, Western Washington, U Guadalajara, UNC Greensboro, Northern Arizona, U Miami, Texas Tech HSC, U Hong Kong + 3 sister HK universities, U Melbourne, JAIST, Maria Curie-Sklodowska, DoDEA, Clark County School District, AIST, Japan Atomic Energy Agency, Connecticut State Colleges, Kennesaw State, RESTENA Luxembourg, NKN India). 3. Regional ISPs / MSPs / hosters verified per-case via web search for two-corroborating-sources confirmation: Spectranet (Nigeria), Brisanet (Brazil), Hondutel (Honduras), WestCall (Russia), AKADO Telecom (formerly Comcor), HT Eronet (Bosnia), Trooli (UK), Spitfire (UK), Intermax (Netherlands), Sogetel (Quebec), Synoptek, Union Wireless (Wyoming), Bigleaf Networks, OzarksGo (Arkansas), Acantho (Hera Group, Italy), Istekki (Finland), AIS Advanced Wireless Network (Thailand), CSI Piemonte, Baxet Group, Verixi (Belgium), SBA Edge, Iron Mountain Data Centers (formerly Web Werks India), CITIC Telecom CPC (acquired Linx Telecommunications), Optus (Singtel), Tele2 Kazakhstan, Movistar (Telefónica México), C Spire (Mississippi), Wananchi Group (Kenya), Asiatech, Respina, Fanap Telecom, Sabanet, Mobinnet, Pishgaman (Iran), Power Line Datacenter (HK), Airtek Solutions (Venezuela), Tata Teleservices, ParsOnline, WorldLink Communications (Nepal), Sarenet (Spain), CETIN (Serbia), IPKO (Kosovo), Sure (Channel Islands), Swoop (Australia), Deutsche Glasfaser, ePLDT, Epic (formerly Vodafone Malta), Tigo Bolivia, Multipolar Technology, Silversky, YOU Broadband (Vodafone Idea India). Also adds: - Government / civic: USPS, DC, City of Toronto, City of Boston, Canton of Bern, Networking Tasmania, St. Joseph's Health Care London, Enoch Pratt Free Library. - Logistics: UPS, JR East, Post Danmark. - MSP: Otsuka Corporation, ANS (UK). - IaaS: IABG Teleport. Skipped — single-source / parking / parent-too-generic concerns: globalcapacity.com (post-acquisition operator unclear), various opaque AS-id-named domains, cox enterprises (multi-product conglomerate, no clean type fit). Sortlists.py runs cleanly. All 105 type values validate against base_reverse_dns_types.txt. No collisions with existing map keys. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * Add 37 more ASN-domain coverage entries (Asian telcos, regional ISPs) Continues the coverage-gap sweep. Each entry verified per-case via web search for two-corroborating-sources confirmation (domain-WHOIS / homepage content + MMDB as_name + an established third-party directory like Wikipedia or industry trade press). - Major established brands: Fujitsu (web.ad.jp), True Corporation (Thailand), One NZ (formerly Vodafone NZ), Partners Telecom Colombia (formerly WOM), Angola Telecom, Gabon Telecom (Maroc Telecom subsidiary), Sony Global Solutions, BEKKOAME (now part of GMO Internet), CS Loxinfo (now AIS), National Telecom (Thailand, formerly CAT Telecom). - Regional cable / fiber operators in Japan (ZTV, Oita Cable Telecom, StarCat Cable Network, Community Network Center), Korea (Hyundai HCN, Areum Broadcasting Network), Taiwan (Peicity / TaipeiNet, Taiwan Optical Platform), China (Shaanxi Broadcast & TV, Qinghai Telecom under China Telecom umbrella, China Telecom Tianjin under same), Russia (Almatel, Seven Sky / Iskratelecom, Good Line / E-Light-Telecom in Kuzbass). - Other regional ISPs / hosters: Orange Jordan (go.com.jo via Jordan Telecom Group), FASTtelco (Kuwait), Cyberzone (Panama-based hosting), Moselle Télécom (French regional), Africa on Cloud (South African IaaS), Computer Engineering & Consulting (CEC, Japan MSP), Macquarie Government (Australian sovereign data centers), Meteverse (Canadian/Korean edge cloud), Ningxia West Cloud Data (operator of AWS China Ningxia region), 21Vianet (Chinese hosting), China Broadcasting Network, China Networks Inter-Exchange (CNIX). - Education: MANDA Darmstadt (TU Darmstadt + Hochschule Darmstadt shared MAN). Skipped — single source / ambiguous: globalcapacity.com (post-GTT- acquisition operator unclear), abcle.co.kr (single source, type unclear), dr.com.tr (Andromeda TV connection couldn't be confirmed). Sortlists.py runs cleanly. All type values validate against base_reverse_dns_types.txt. No collisions. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Sean Whalen <seanthegeek@users.noreply.github.com> Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
parsedmarc
parsedmarc is a Python module and CLI utility for parsing DMARC
reports. When used with Elasticsearch and Kibana (or Splunk), it works
as a self-hosted open-source alternative to commercial DMARC report
processing services such as Agari Brand Protection, Dmarcian, OnDMARC,
ProofPoint Email Fraud Defense, and Valimail.
Note
Domain-based Message Authentication, Reporting, and Conformance (DMARC) is an email authentication protocol.
Sponsors
This is a project is maintained by one developer. Please consider sponsoring my work if you or your organization benefit from it.
Features
- Parses draft and 1.0 standard aggregate/rua DMARC reports
- Parses forensic/failure/ruf DMARC reports
- Parses reports from SMTP TLS Reporting
- Can parse reports from an inbox over IMAP, Microsoft Graph, or Gmail API
- Transparently handles gzip or zip compressed reports
- Consistent data structures
- Simple JSON and/or CSV output
- Optionally email the results
- Optionally send the results to Elasticsearch, Opensearch, and/or Splunk, for use with premade dashboards
- Optionally send reports to Apache Kafka
Python Compatibility
This project supports the following Python versions, which are either actively maintained or are the default versions for RHEL or Debian.
| Version | Supported | Reason |
|---|---|---|
| < 3.6 | ❌ | End of Life (EOL) |
| 3.6 | ❌ | Used in RHEL 8, but not supported by project dependencies |
| 3.7 | ❌ | End of Life (EOL) |
| 3.8 | ❌ | End of Life (EOL) |
| 3.9 | ❌ | Used in Debian 11 and RHEL 9, but not supported by project dependencies |
| 3.10 | ✅ | Actively maintained |
| 3.11 | ✅ | Actively maintained; supported until June 2028 (Debian 12) |
| 3.12 | ✅ | Actively maintained; supported until May 2035 (RHEL 10) |
| 3.13 | ✅ | Actively maintained; supported until June 2030 (Debian 13) |
| 3.14 | ✅ | Supported (requires imapclient>=3.1.0) |