Quick Start Docker Compose

Quick Start: Docker Compose

The fastest way to run YetAnotherDmarcTool if you manage Docker directly (no Portainer, no Azure). Same containers as every other deployment path — see Deploying with Portainer or Deploying on Azure Container Apps for those instead.

Prerequisites

• Docker and Docker Compose.
• Something to terminate TLS in front of this — nginx, Caddy, Nginx Proxy Manager, Traefik, or similar. The app itself only speaks plain HTTP on :8000, deliberately: TLS termination is a solved problem best left to a dedicated proxy rather than reimplemented here.
• A domain/subdomain pointed at this host to serve it from (e.g. dmarc.yourdomain.com).

1. Clone it

git clone https://github.com/BJD1997/YetAnotherDmarcTool.git
cd YetAnotherDmarcTool

2. Configure it

cp .env.example .env

Open .env and fill in, at minimum:

• PUBLIC_BASE_URL — the HTTPS URL your reverse proxy will expose this at, e.g. https://dmarc.yourdomain.com. Get this right before signing in with Microsoft Entra SSO — it's part of the OAuth redirect URI.
• POSTGRES_PASSWORD and DMARC_APP_DB_PASSWORD — any two strong, distinct passwords.
• FERNET_KEY — 32 random bytes in URL-safe base64. Generate with either:

  openssl rand -base64 32 | tr '+/' '-_'                                    # no Python needed
  python3 -c "from cryptography.fernet import Fernet; print(Fernet.generate_key().decode())"

• PLATFORM_ADMIN_BOOTSTRAP_EMAIL / PLATFORM_ADMIN_BOOTSTRAP_PASSWORD — your own login for the very first account. Change the password after first login; these two vars can then be left as-is (bootstrap is a no-op once an admin already exists).

Everything else in .env.example is optional and individually feature-gated — see the Configuration Reference for the full list and what each one unlocks. The one exception worth knowing up front: ENTRA_MAIL_CLIENT_ID/ENTRA_MAIL_CLIENT_SECRET gates both ways of actually ingesting reports (an organization's own connected mailbox, and the operator-hosted mailbox) — leave it unset and the dashboard still runs and does DNS best-practice checks fine, but no report is ever ingested by any path.

3. Start it

docker compose up -d

migrate runs first (schema migrations + bootstrapping the platform-admin account from step 2), then api and worker start. Point your reverse proxy's upstream at this host's :8000.

4. Log in and set up your first organization

Go to https://<your-domain>/admin, log in with the bootstrap credentials, and create an organization. From there, see Onboarding Your First Organization for the full walkthrough — connecting a mailbox, verifying a domain, adding DKIM selectors, and what "done" looks like.

---

← Getting Started · Deploying with Portainer →