DMARC_HTTPD(1)

NAME
dmarc_httpd: a web server for DMARC validation and report viewing

SYNOPSIS
A HTTP interface for:

•   local DMARC reports

•   DMARC validator service

Start the HTTP server:

    dmarc_httpd

Connect with a web browser to http://localhost:8080 <http://localhost:8080/>.

DESCRIPTION
Serves the report viewer and a JSON API. The viewer is one HTML file, a stylesheet and a few JavaScript modules in the share directory, with no external dependencies, so it works on a host with no route to the internet.

  Endpoints

•   / - the report viewer

•   /dmarc/json/validate - POST a JSON request, get a DMARC result. See dmarc_http_client for a usage example.

•   /dmarc/json/report - the report list

•   /dmarc/json/row - one report's rows

•   /dmarc/json/domains - domains reports arrived for

•   /dmarc/json/summary - volume by alignment and disposition, with the preceding window for comparison

•   /dmarc/json/timeseries - the same, one row per UTC day

•   /dmarc/json/sources - one row per sending IP, ranked by failing volume, each bucketed "aligned", "forwarded" or "failing"

•   /dmarc/json/source - one IP in detail: the From domains, and the SPF and DKIM it presented. Buckets it "aligned", "broken" or "unauthenticated", which separates a misconfigured sender from a spoof.

  Parameters
"since" and "until" are epoch seconds, compared against the report window start, defaulting to the last 30 days. "from_domain" and "author" narrow to one domain or reporter. "source_ip" selects one source, required by /source. /sources also takes "start", "length" and "sort_col". Times in these responses are epoch seconds. Volumes are weighted by each record's message count; a record with no count is one message.

  Received and outgoing reports
A store also queues the reports this host is preparing to send, which are about other people's domains. The summary, timeseries, sources and domain views count only reports received from others; the report list shows both. Pass "reports=outgoing" or "reports=all" to change that. They are told apart by author, so "org_name" must match the name this host reports under.

REVERSE DNS
Ticking "Resolve hostnames" looks up the PTR of each source IP on display. It is off by default because it sends those IPs to a third party DNS-over-HTTPS resolver. Cloudflare and Google are offered, and "Other" accepts any DoH server answering JSON with CORS headers. A hand-entered resolver is checked as you type and adopted only once it answers. Both settings are per browser.

Lookups happen in the browser so the many IPs with no PTR cannot stall dmarc_httpd.

Web server settings are in the [http] and [https] sections of mail-dmarc.ini. "post_max" caps the size of a POST body, in bytes, defaulting to 10MB. It cannot be lifted: 0, and anything that is not a byte count, is refused with a warning at startup and the default is used instead. A body over twice the cap is answered by closing the connection rather than with a JSON error.

Databases created before Mail::DMARC 2.2 lack indexes the aggregate views need. share/mail_dmarc_indexes.* adds them, one file per engine.

THANKS
jQuery - http://www.jquery.com/

jqGrid - http://www.trirand.com/blog/

AUTHORS

•   Matt Simerson <msimerson@cpan.org>

•   Davide Migliavacca <shari@cpan.org>

•   Marc Bradshaw <marc@marcbradshaw.net>