Connecting an IMAP Mailbox

Connecting an IMAP Mailbox

From v0.3.0, any mailbox that speaks IMAP can be an organization's report mailbox: Fastmail, a self-hosted Postfix/Dovecot server, Google Workspace with an app password, and so on. It works for every organization, whatever it signs in with. An organization connects one mailbox of its own; the hosted reporting addresses keep working alongside it, per domain.

Setting it up

Settings → General → Mailbox connection (or the setup wizard's Mailbox step), choose Another mailbox (IMAP), and fill in:

• IMAP server and security: SSL/TLS (usually port 993) or STARTTLS (usually port 143). Unencrypted IMAP isn't offered, and the server's certificate must be valid for its name.
• Username and password: use a mailbox just for DMARC reports, and an app password where your provider offers one. The password is stored encrypted and never shown again.
• Reports arrive in: the folder to read, usually INBOX.
• Move processed reports to: where each report goes once it's stored. Default DMARC processed; it's created if it doesn't exist.

Click Test connection: it signs in and opens the folder without changing anything, and fills in the mail server ID. Then Save & start syncing. Settings that don't work aren't saved.

The mail server ID

Anyone can send a "report" to your reporting address, so YADT checks where each report really came from. With IMAP it relies on your own mail server: when mail arrives, the server writes its verdict in an Authentication-Results header that starts with its ID, for example mx.fastmail.com. A sender can add fake headers like that, so YADT only believes the top one with your server's ID (RFC 8601).

Test connection reads the ID from the newest message in the folder. If the folder is still empty, the first sync detects it instead, leaves the messages unread, and Settings shows the detected ID with Use this. Reports are only read once the ID is set, so nothing is stored that can't be checked.

If your mail server doesn't add Authentication-Results headers at all, the reports can't be checked: they're listed as left out on each domain's report pages. Turning the report sender check off (Settings → General) counts them anyway, at the cost of the fake-report protection.

What happens to the messages

Every 10 minutes, unread messages in the folder are read:

• a report is stored, then marked read and moved to the processed folder;
• a message that isn't a report is only marked read and stays where it is;
• messages over 25 MB are skipped and marked read.

Resync now in Settings starts a sync straight away, and Recent syncs shows each sync's result.

---

← Onboarding Your First Organization · Home

A Microsoft 365 mailbox without Microsoft sign-in

From v0.3.0, an organization that signs in another way (local accounts, Google, its own provider) can still connect a Microsoft 365 report mailbox. Settings → Mailbox → Microsoft 365 mailbox → Test sign-in with Microsoft: sign in once with a Microsoft work account of the organization, its email on one of the organization's verified domains. That tenant becomes the mailbox's tenant; then the Global Admin grants mail access as usual. A tenant that another organization on the server already uses is refused, so no organization can read another's reports.

The hosted mailbox over IMAP

The server's shared hosted mailbox (the <name>+<tag>@... addresses) can be read over IMAP too: HOSTED_REPORTS_SOURCE=imap with the HOSTED_REPORTS_IMAP_* settings (see Configuration Reference). Reports are routed to the right organization by the address they were sent to, then marked read and moved like an organization's own IMAP mailbox.