Skip to content
📥 Populate / browse a SQL database with incoming DMARC aggregate reports
Branch: master
Clone or download
Fetching latest commit…
Cannot retrieve the latest commit at this time.
Type Name Latest commit message Commit time
Failed to load latest commit information.


A (still WIP) tool to populate and browse a SQL database with records from incoming DMARC aggregate reports. The idea is to make detecting misconfigured mail hosts, malicious mail servers, and monitoring outgoing mail traffic easier through constantly monitoring reported mail traffic from DMARC aggregate reports (as described in RFC 7489 section 7.2) in the form of easy-to-run reports and an (optional) interactive web interface.

This tool was built based on requirements needed or requested by West Virginia University's Information Security Services. This project is open-source licensed by the GNU General Public License (v3) found in the LICENSE file in this directory.


Configuration: A single config.yml (see: config-example.yml) or similar static configuration file named config (i.e. config.json, config.xml, config.toml, etc.) is required for basic runtime configuration in the same directory as the dmarcdb binary (i.e. "beside" the binary).

Prerequisite: MaxMind's City and ASN GeoLite2 databases in an accessible folder on the machine and for the user running dmarcdb, with locations configured in the config file.

For stable configuration, logging, and accessibility purposes, it'd be best to just have a singular folder for dmarcdb and it's accompanying files alone (i.e. C:\Program Files\DMARCDB\).


For each command listed below (and also without any commands) on startup, if web is set in the config to true, it will also begin to serve a web browseable interface (data read-only) over the configured port.

  • ./dmarcdb build - Begins the process of building the database with records populated from the mail folder configured as mailFolder

  • ./dmarcdb logs - Prints any error logs received while attempting to processed malformed DMARC aggregate reports or malformed emails

  • ./dmarcdb flush <fails|hosts> - Without parameters, deletes both logged errors and cached hostname lookups. With either extra parameter flush or hosts, will only flush respective option.

Third-Party Technologies

The following (nonexhaustive) list of third-party technolgies were used in this project:

You can’t perform that action at this time.
You signed in with another tab or window. Reload to refresh your session. You signed out in another tab or window. Reload to refresh your session.