mirror of
https://github.com/domainaware/parsedmarc.git
synced 2026-05-01 17:52:31 +00:00
Sean Whalen
d7366d088f
Rebased on top of master @ 2cda5bf (9.9.0), which added the ASN
source attribution work (#712, #713, #714, #715). Individual Copilot
iteration commits squashed into this single commit — the per-commit
history on the feature branch was iterative (add tests, fix lint,
move field, revert, etc.) and not worth preserving; GitHub squash-
merges PRs anyway.
### DMARCbis fields (new)
New fields from the DMARCbis XSD, plumbed through types, parsing, CSV
output, and the Elasticsearch / OpenSearch mappings:
- ``np`` — non-existent subdomain policy (``none`` / ``quarantine`` /
``reject``)
- ``testing`` — testing mode flag (``n`` / ``y``), replaces RFC 7489
``pct``
- ``discovery_method`` — policy discovery method (``psl`` /
``treewalk``)
- ``generator`` — report generator software identifier (metadata)
- ``human_result`` — optional descriptive text on DKIM / SPF results
RFC 7489 reports parse with ``None`` for DMARCbis-only fields.
### Forensic → failure rename
Forensic reports have been renamed to failure reports throughout the
project to reflect the proper naming since RFC 7489.
- Core: ``types.py``, ``__init__.py`` — ``ForensicReport`` →
``FailureReport``, ``parse_forensic_report`` →
``parse_failure_report``, report type ``"failure"``.
- Output modules: ``elastic.py``, ``opensearch.py``, ``splunk.py``,
``kafkaclient.py``, ``syslog.py``, ``gelf.py``, ``webhook.py``,
``loganalytics.py``, ``s3.py``.
- CLI: ``cli.py`` — args, config keys, index names
(``dmarc_failure``).
- Docs + dashboards: all markdown, Grafana JSON, Kibana NDJSON,
Splunk XML.
Backward compatibility preserved: old function / type names remain as
aliases (``parse_forensic_report = parse_failure_report``,
``ForensicReport = FailureReport``, etc.), CLI accepts both the old
(``save_forensic``, ``forensic_topic``) and new (``save_failure``,
``failure_topic``) config keys, and updated dashboards query both
old and new index / sourcetype names so data from before and after
the rename appears together.
### Rebase notes
Merge conflicts resolved in ``parsedmarc/constants.py`` (took bis's
10.0.0 bump), ``parsedmarc/__init__.py`` (combined bis's "failure"
wording with master's IPinfo MMDB mention), ``parsedmarc/elastic.py``
and ``parsedmarc/opensearch.py`` (kept master's ``source_asn`` /
``source_asn_name`` / ``source_asn_domain`` on the failure doc path
while renaming ``forensic_report`` → ``failure_report``), and
``CHANGELOG.md`` (10.0.0 entry now sits above the 9.9.0 entry).
All 324 tests pass; ``ruff check`` / ``ruff format --check`` clean.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
78 lines
3.2 KiB
Markdown
78 lines
3.2 KiB
Markdown
# parsedmarc documentation - Open source DMARC report analyzer and visualizer
|
|
|
|
[](https://github.com/domainaware/parsedmarc/actions/workflows/python-tests.yml)
|
|
[](https://codecov.io/gh/domainaware/parsedmarc)
|
|
[](https://pypi.org/project/parsedmarc/)
|
|
[](https://pypistats.org/packages/parsedmarc)
|
|
|
|
:::{note}
|
|
|
|
This is a project is maintained by one developer.
|
|
Please consider [sponsoring my work](https://github.com/sponsors/seanthegeek) if you or your organization benefit from it.
|
|
:::
|
|
|
|
```{image} _static/screenshots/dmarc-summary-charts.png
|
|
:align: center
|
|
:alt: A screenshot of DMARC summary charts in Kibana
|
|
:scale: 50 %
|
|
:target: _static/screenshots/dmarc-summary-charts.png
|
|
```
|
|
|
|
`parsedmarc` is a Python module and CLI utility for parsing DMARC reports.
|
|
When used with Elasticsearch and Kibana (or Splunk), or with OpenSearch and Grafana, it works as a self-hosted
|
|
open source alternative to commercial DMARC report processing services such
|
|
as Agari Brand Protection, Dmarcian, OnDMARC, ProofPoint Email Fraud Defense,
|
|
and Valimail.
|
|
|
|
## Features
|
|
|
|
- Parses draft and 1.0 standard aggregate/rua DMARC reports
|
|
- Parses failure/ruf DMARC reports
|
|
- Parses reports from SMTP TLS Reporting
|
|
- Can parse reports from an inbox over IMAP, Microsoft Graph, or Gmail API
|
|
- Transparently handles gzip or zip compressed reports
|
|
- Consistent data structures
|
|
- Simple JSON and/or CSV output
|
|
- Optionally email the results
|
|
- Optionally send the results to Elasticsearch, Opensearch, and/or Splunk, for use
|
|
with premade dashboards
|
|
- Optionally send reports to Apache Kafka
|
|
|
|
## Python Compatibility
|
|
|
|
This project supports the following Python versions, which are either actively maintained or are the default versions
|
|
for RHEL or Debian.
|
|
|
|
| Version | Supported | Reason |
|
|
|---------|-----------|------------------------------------------------------------|
|
|
| < 3.6 | ❌ | End of Life (EOL) |
|
|
| 3.6 | ❌ | Used in RHEL 8, but not supported by project dependencies |
|
|
| 3.7 | ❌ | End of Life (EOL) |
|
|
| 3.8 | ❌ | End of Life (EOL) |
|
|
| 3.9 | ❌ | Used in Debian 11 and RHEL 9, but not supported by project dependencies |
|
|
| 3.10 | ✅ | Actively maintained |
|
|
| 3.11 | ✅ | Actively maintained; supported until June 2028 (Debian 12) |
|
|
| 3.12 | ✅ | Actively maintained; supported until May 2035 (RHEL 10) |
|
|
| 3.13 | ✅ | Actively maintained; supported until June 2030 (Debian 13) |
|
|
| 3.14 | ✅ | Supported (requires `imapclient>=3.1.0`) |
|
|
|
|
```{toctree}
|
|
:caption: 'Contents'
|
|
:maxdepth: 2
|
|
|
|
installation
|
|
usage
|
|
output
|
|
elasticsearch
|
|
opensearch
|
|
kibana
|
|
splunk
|
|
davmail
|
|
dmarc
|
|
contributing
|
|
api
|
|
```
|