mirror of
https://github.com/domainaware/parsedmarc.git
synced 2026-02-27 19:46:24 +00:00
2b35b785c6
* Set global TOC collapse to false * Split documentation I tried to split the index.md file into logical parts, not changing the contents. I did add a space and change one HTTP URL to HTTPS. --------- Co-authored-by: Sean Whalen <44679+seanthegeek@users.noreply.github.com>
190 lines
7.5 KiB
Markdown
190 lines
7.5 KiB
Markdown
# Sample outputs
|
|
|
|
## Sample aggregate report output
|
|
|
|
Here are the results from parsing the [example](https://dmarc.org/wiki/FAQ#I_need_to_implement_aggregate_reports.2C_what_do_they_look_like.3F)
|
|
report from the dmarc.org wiki. It's actually an older draft of
|
|
the 1.0 report schema standardized in
|
|
[RFC 7480 Appendix C](https://tools.ietf.org/html/rfc7489#appendix-C).
|
|
This draft schema is still in wide use.
|
|
|
|
`parsedmarc` produces consistent, normalized output, regardless
|
|
of the report schema.
|
|
|
|
### JSON aggregate report
|
|
|
|
```json
|
|
{
|
|
"xml_schema": "draft",
|
|
"report_metadata": {
|
|
"org_name": "acme.com",
|
|
"org_email": "noreply-dmarc-support@acme.com",
|
|
"org_extra_contact_info": "http://acme.com/dmarc/support",
|
|
"report_id": "9391651994964116463",
|
|
"begin_date": "2012-04-27 20:00:00",
|
|
"end_date": "2012-04-28 19:59:59",
|
|
"errors": []
|
|
},
|
|
"policy_published": {
|
|
"domain": "example.com",
|
|
"adkim": "r",
|
|
"aspf": "r",
|
|
"p": "none",
|
|
"sp": "none",
|
|
"pct": "100",
|
|
"fo": "0"
|
|
},
|
|
"records": [
|
|
{
|
|
"source": {
|
|
"ip_address": "72.150.241.94",
|
|
"country": "US",
|
|
"reverse_dns": "adsl-72-150-241-94.shv.bellsouth.net",
|
|
"base_domain": "bellsouth.net"
|
|
},
|
|
"count": 2,
|
|
"alignment": {
|
|
"spf": true,
|
|
"dkim": false,
|
|
"dmarc": true
|
|
},
|
|
"policy_evaluated": {
|
|
"disposition": "none",
|
|
"dkim": "fail",
|
|
"spf": "pass",
|
|
"policy_override_reasons": []
|
|
},
|
|
"identifiers": {
|
|
"header_from": "example.com",
|
|
"envelope_from": "example.com",
|
|
"envelope_to": null
|
|
},
|
|
"auth_results": {
|
|
"dkim": [
|
|
{
|
|
"domain": "example.com",
|
|
"selector": "none",
|
|
"result": "fail"
|
|
}
|
|
],
|
|
"spf": [
|
|
{
|
|
"domain": "example.com",
|
|
"scope": "mfrom",
|
|
"result": "pass"
|
|
}
|
|
]
|
|
}
|
|
}
|
|
]
|
|
}
|
|
```
|
|
|
|
### CSV aggregate report
|
|
|
|
```text
|
|
xml_schema,org_name,org_email,org_extra_contact_info,report_id,begin_date,end_date,errors,domain,adkim,aspf,p,sp,pct,fo,source_ip_address,source_country,source_reverse_dns,source_base_domain,count,spf_aligned,dkim_aligned,dmarc_aligned,disposition,policy_override_reasons,policy_override_comments,envelope_from,header_from,envelope_to,dkim_domains,dkim_selectors,dkim_results,spf_domains,spf_scopes,spf_results
|
|
draft,acme.com,noreply-dmarc-support@acme.com,http://acme.com/dmarc/support,9391651994964116463,2012-04-27 20:00:00,2012-04-28 19:59:59,,example.com,r,r,none,none,100,0,72.150.241.94,US,adsl-72-150-241-94.shv.bellsouth.net,bellsouth.net,2,True,False,True,none,,,example.com,example.com,,example.com,none,fail,example.com,mfrom,pass
|
|
```
|
|
|
|
## Sample forensic report output
|
|
|
|
Thanks to Github user [xennn](https://github.com/xennn) for the anonymized
|
|
[forensic report email sample](<https://github.com/domainaware/parsedmarc/raw/master/samples/forensic/DMARC%20Failure%20Report%20for%20domain.de%20(mail-from%3Dsharepoint%40domain.de%2C%20ip%3D10.10.10.10).eml>).
|
|
|
|
### JSON forensic report
|
|
|
|
```json
|
|
{
|
|
"feedback_type": "auth-failure",
|
|
"user_agent": "Lua/1.0",
|
|
"version": "1.0",
|
|
"original_mail_from": "sharepoint@domain.de",
|
|
"original_rcpt_to": "peter.pan@domain.de",
|
|
"arrival_date": "Mon, 01 Oct 2018 11:20:27 +0200",
|
|
"message_id": "<38.E7.30937.BD6E1BB5@ mailrelay.de>",
|
|
"authentication_results": "dmarc=fail (p=none, dis=none) header.from=domain.de",
|
|
"delivery_result": "policy",
|
|
"auth_failure": [
|
|
"dmarc"
|
|
],
|
|
"reported_domain": "domain.de",
|
|
"arrival_date_utc": "2018-10-01 09:20:27",
|
|
"source": {
|
|
"ip_address": "10.10.10.10",
|
|
"country": null,
|
|
"reverse_dns": null,
|
|
"base_domain": null
|
|
},
|
|
"authentication_mechanisms": [],
|
|
"original_envelope_id": null,
|
|
"dkim_domain": null,
|
|
"sample_headers_only": false,
|
|
"sample": "Received: from Servernameone.domain.local (Servernameone.domain.local [10.10.10.10])\n\tby mailrelay.de (mail.DOMAIN.de) with SMTP id 38.E7.30937.BD6E1BB5; Mon, 1 Oct 2018 11:20:27 +0200 (CEST)\nDate: 01 Oct 2018 11:20:27 +0200\nMessage-ID: <38.E7.30937.BD6E1BB5@ mailrelay.de>\nTo: <peter.pan@domain.de>\nfrom: \"=?utf-8?B?SW50ZXJha3RpdmUgV2V0dGJld2VyYmVyLcOcYmVyc2ljaHQ=?=\" <sharepoint@domain.de>\nSubject: Subject\nMIME-Version: 1.0\nX-Mailer: Microsoft SharePoint Foundation 2010\nContent-Type: text/html; charset=utf-8\nContent-Transfer-Encoding: quoted-printable\n\n<html><head><base href=3D'\nwettbewerb' /></head><body><!DOCTYPE HTML PUBLIC \"-//W3C//DTD HTML 3.2//EN\"=\n><HTML><HEAD><META NAME=3D\"Generator\" CONTENT=3D\"MS Exchange Server version=\n 08.01.0240.003\"></html>\n",
|
|
"parsed_sample": {
|
|
"from": {
|
|
"display_name": "Interaktive Wettbewerber-Übersicht",
|
|
"address": "sharepoint@domain.de",
|
|
"local": "sharepoint",
|
|
"domain": "domain.de"
|
|
},
|
|
"to_domains": [
|
|
"domain.de"
|
|
],
|
|
"to": [
|
|
{
|
|
"display_name": null,
|
|
"address": "peter.pan@domain.de",
|
|
"local": "peter.pan",
|
|
"domain": "domain.de"
|
|
}
|
|
],
|
|
"subject": "Subject",
|
|
"timezone": "+2",
|
|
"mime-version": "1.0",
|
|
"date": "2018-10-01 09:20:27",
|
|
"content-type": "text/html; charset=utf-8",
|
|
"x-mailer": "Microsoft SharePoint Foundation 2010",
|
|
"body": "<html><head><base href='\nwettbewerb' /></head><body><!DOCTYPE HTML PUBLIC \"-//W3C//DTD HTML 3.2//EN\"><HTML><HEAD><META NAME=\"Generator\" CONTENT=\"MS Exchange Server version 08.01.0240.003\"></html>",
|
|
"received": [
|
|
{
|
|
"from": "Servernameone.domain.local Servernameone.domain.local 10.10.10.10",
|
|
"by": "mailrelay.de mail.DOMAIN.de",
|
|
"with": "SMTP id 38.E7.30937.BD6E1BB5",
|
|
"date": "Mon, 1 Oct 2018 11:20:27 +0200 CEST",
|
|
"hop": 1,
|
|
"date_utc": "2018-10-01 09:20:27",
|
|
"delay": 0
|
|
}
|
|
],
|
|
"content-transfer-encoding": "quoted-printable",
|
|
"message-id": "<38.E7.30937.BD6E1BB5@ mailrelay.de>",
|
|
"has_defects": false,
|
|
"headers": {
|
|
"Received": "from Servernameone.domain.local (Servernameone.domain.local [10.10.10.10])\n\tby mailrelay.de (mail.DOMAIN.de) with SMTP id 38.E7.30937.BD6E1BB5; Mon, 1 Oct 2018 11:20:27 +0200 (CEST)",
|
|
"Date": "01 Oct 2018 11:20:27 +0200",
|
|
"Message-ID": "<38.E7.30937.BD6E1BB5@ mailrelay.de>",
|
|
"To": "<peter.pan@domain.de>",
|
|
"from": "\"Interaktive Wettbewerber-Übersicht\" <sharepoint@domain.de>",
|
|
"Subject": "Subject",
|
|
"MIME-Version": "1.0",
|
|
"X-Mailer": "Microsoft SharePoint Foundation 2010",
|
|
"Content-Type": "text/html; charset=utf-8",
|
|
"Content-Transfer-Encoding": "quoted-printable"
|
|
},
|
|
"reply_to": [],
|
|
"cc": [],
|
|
"bcc": [],
|
|
"attachments": [],
|
|
"filename_safe_subject": "Subject"
|
|
}
|
|
}
|
|
```
|
|
|
|
### CSV forensic report
|
|
|
|
```text
|
|
feedback_type,user_agent,version,original_envelope_id,original_mail_from,original_rcpt_to,arrival_date,arrival_date_utc,subject,message_id,authentication_results,dkim_domain,source_ip_address,source_country,source_reverse_dns,source_base_domain,delivery_result,auth_failure,reported_domain,authentication_mechanisms,sample_headers_only
|
|
auth-failure,Lua/1.0,1.0,,sharepoint@domain.de,peter.pan@domain.de,"Mon, 01 Oct 2018 11:20:27 +0200",2018-10-01 09:20:27,Subject,<38.E7.30937.BD6E1BB5@ mailrelay.de>,"dmarc=fail (p=none, dis=none) header.from=domain.de",,10.10.10.10,,,,policy,dmarc,domain.de,,False
|
|
```
|