/ 
Mail-DMARC-2.20260827
⭐ Starred 35 / dmarc_httpd:

NAME

dmarc_httpd: a web server for DMARC validation and report viewing

SYNOPSIS

A HTTP interface for:

  • local DMARC reports

  • DMARC validator service

Start the HTTP server:

dmarc_httpd

Connect with a web browser to http://localhost:8080.

DESCRIPTION

Serves the report viewer and a JSON API. The viewer is one HTML file, a stylesheet and a few JavaScript modules in the share directory, with no external dependencies, so it works on a host with no route to the internet.

Endpoints

  • / - the report viewer

  • /dmarc/json/validate - POST a JSON request, get a DMARC result. See dmarc_http_client for a usage example.

  • /dmarc/json/report - the report list

  • /dmarc/json/row - one report's rows

  • /dmarc/json/domains - domains reports arrived for

  • /dmarc/json/summary - volume by alignment and disposition, with the preceding window for comparison

  • /dmarc/json/timeseries - the same, one row per UTC day

  • /dmarc/json/sources - one row per sending IP, ranked by failing volume, each bucketed aligned, forwarded or failing

  • /dmarc/json/source - one IP in detail: the From domains, and the SPF and DKIM it presented. Buckets it aligned, broken or unauthenticated, which separates a misconfigured sender from a spoof.

Parameters

since and until are epoch seconds, compared against the report window start, defaulting to the last 30 days. from_domain and author narrow to one domain or reporter. source_ip selects one source, required by /source. /sources also takes start, length and sort_col. Times in these responses are epoch seconds. Volumes are weighted by each record's message count; a record with no count is one message.

Received and outgoing reports

A store also queues the reports this host is preparing to send, which are about other people's domains. The summary, timeseries, sources and domain views count only reports received from others; the report list shows both. Pass reports=outgoing or reports=all to change that. They are told apart by author, so org_name must match the name this host reports under.

REVERSE DNS

Ticking "Resolve hostnames" looks up the PTR of each source IP on display. It is off by default because it sends those IPs to a third party DNS-over-HTTPS resolver. Cloudflare and Google are offered, and "Other" accepts any DoH server answering JSON with CORS headers. A hand-entered resolver is checked as you type and adopted only once it answers. Both settings are per browser.

Lookups happen in the browser so the many IPs with no PTR cannot stall dmarc_httpd.

Web server settings are in the [http] and [https] sections of mail-dmarc.ini. post_max caps the size of a POST body, in bytes, defaulting to 10MB. It cannot be lifted: 0, and anything that is not a byte count, is refused with a warning at startup and the default is used instead. A body over twice the cap is answered by closing the connection rather than with a JSON error.

Databases created before Mail::DMARC 2.2 lack indexes the aggregate views need. share/mail_dmarc_indexes.* adds them, one file per engine.

THANKS

jQuery - http://www.jquery.com/

jqGrid - http://www.trirand.com/blog/

AUTHORS

  • Matt Simerson <msimerson@cpan.org>

  • Davide Migliavacca <shari@cpan.org>

  • Marc Bradshaw <marc@marcbradshaw.net>