mirror of
https://github.com/domainaware/parsedmarc.git
synced 2026-07-14 12:34:56 +00:00
a6778707d7
The forensic→failure rename (#659) left a few loose ends and one deliberate hold-back. This closes them. Leftover rename misses (broken paths / stale canonical names): - CONTRIBUTING.md, dashboard-dev-bootstrap.sh: samples/forensic/* → samples/failure/* - dashboard-dev-bootstrap.sh, dashboards/README.md: dmarc_forensic_dashboard.xml → dmarc_failure_dashboard.xml (the file was already renamed; the import path and view name were not) - docs/source/usage.md: PARSEDMARC_GENERAL_SAVE_FORENSIC → ..._SAVE_FAILURE example - samples/parsedmarc.ini: save_forensic → save_failure - pyproject.toml, README.md: canonical "failure" naming (ci.ini intentionally keeps save_forensic to smoke-test the deprecated alias.) Archive subfolder rename + on-startup migration: - New failure reports now archive to <archive>/Failure (was <archive>/Forensic). - _migrate_forensic_archive_folder() runs once on startup (best-effort): renames Forensic→Failure when no Failure folder exists yet, merges the two when both exist, no-ops when there's no legacy folder, and logs-and-skips a mailbox it can't reorganize (warn, don't crash). This consolidates pre- and post-rename failure reports into one folder, replacing the previously documented decision to keep the folder named Forensic to avoid a split archive. Uses the folder-management API (folder_exists / rename_folder / merge_folders) added in mailsuite 2.1.0; the pin is bumped to >=2.1.0. Grafana dashboard (the rename PR updated OSD/Splunk/ES-OS but not Grafana): - Forensic panel titles + the datasource label → Failure; the fo-column display label and its linked byName field-override matcher both → "Failure Policy" (changed together so the column-width override keeps matching). - dev-bootstrap Grafana ES datasource: dmarc_forensic* → dmarc_f* (matches both pre-rename dmarc_forensic* and post-rename dmarc_failure*, like the OSD/Kibana dashboards); RESEED wipe loop now also clears dmarc_failure* indices. - Removed dashboards/grafana/Grafana-DMARC_Reports.json-new_panel.json, an orphan export accidentally committed in #736 and referenced by nothing. Tests (tests/test_init.py): - TestMigrateForensicArchiveFolderMaildir: real on-disk Maildir round-trips via mailsuite's MaildirConnection (no mocks) — rename, merge, no-op, and the full get_dmarc_reports_from_mailbox orchestration. Runs in CI (no network/creds). - TestMigrateForensicArchiveFolderErrorHandling: the one path a real Maildir can't reproduce — a backend that raises mid-operation must warn, not crash. Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
60 lines
3.1 KiB
Markdown
60 lines
3.1 KiB
Markdown
# parsedmarc
|
|
|
|
[](https://github.com/domainaware/parsedmarc/actions/workflows/python-tests.yml)
|
|
[](https://codecov.io/gh/domainaware/parsedmarc)
|
|
[](https://pypi.org/project/parsedmarc/)
|
|
[](https://pypistats.org/packages/parsedmarc)
|
|
|
|
<p align="center">
|
|
<img src="https://raw.githubusercontent.com/domainaware/parsedmarc/refs/heads/master/docs/source/_static/screenshots/dmarc-summary-charts.png?raw=true" alt="A screenshot of DMARC summary charts in Kibana"/>
|
|
</p>
|
|
|
|
`parsedmarc` is a Python module and CLI utility for parsing DMARC
|
|
reports. When used with Elasticsearch and Kibana (or Splunk), it works
|
|
as a self-hosted open-source alternative to commercial DMARC report
|
|
processing services such as Agari Brand Protection, Dmarcian, OnDMARC,
|
|
ProofPoint Email Fraud Defense, and Valimail.
|
|
|
|
> [!NOTE]
|
|
> __Domain-based Message Authentication, Reporting, and Conformance__ (DMARC) is an email authentication protocol.
|
|
|
|
## Sponsors
|
|
|
|
This is a project is maintained by one developer.
|
|
Please consider [sponsoring my work](https://github.com/sponsors/seanthegeek) if you or your organization benefit from it.
|
|
|
|
## Features
|
|
|
|
- Parses draft and 1.0 standard aggregate/rua DMARC reports
|
|
- Parses failure/ruf DMARC reports (formerly called forensic reports)
|
|
- Parses reports from SMTP TLS Reporting
|
|
- Can parse reports from an inbox over IMAP, Microsoft Graph, or Gmail API
|
|
- Transparently handles gzip or zip compressed reports
|
|
- Consistent data structures
|
|
- Simple JSON and/or CSV output
|
|
- Optionally email the results
|
|
- Optionally send the results to Elasticsearch, Opensearch, and/or Splunk, for
|
|
use with premade dashboards
|
|
- Optionally send reports to Apache Kafka
|
|
|
|
## Python Compatibility
|
|
|
|
This project supports the following Python versions, which are either actively maintained or are the default versions
|
|
for RHEL or Debian.
|
|
|
|
| Version | Supported | Reason |
|
|
|---------|-----------|------------------------------------------------------------|
|
|
| < 3.6 | ❌ | End of Life (EOL) |
|
|
| 3.6 | ❌ | Used in RHEL 8, but not supported by project dependencies |
|
|
| 3.7 | ❌ | End of Life (EOL) |
|
|
| 3.8 | ❌ | End of Life (EOL) |
|
|
| 3.9 | ❌ | Used in Debian 11 and RHEL 9, but not supported by project dependencies |
|
|
| 3.10 | ✅ | Actively maintained |
|
|
| 3.11 | ✅ | Actively maintained; supported until June 2028 (Debian 12) |
|
|
| 3.12 | ✅ | Actively maintained; supported until May 2035 (RHEL 10) |
|
|
| 3.13 | ✅ | Actively maintained; supported until June 2030 (Debian 13) |
|
|
| 3.14 | ✅ | Supported (requires `imapclient>=3.1.0`) |
|