DMARC / TLS-RP Report Viewer

Improvements
1

I know this is a long shot,
did anyone look into implementing a
“DMARC/ TLS-RP Report Viewer”
to MIAB that would sit in Admin section?

Would this one work?

I know that by default none of the reports are received,
and it would also require editing “_dmarc.” TXT v=DMARC1; p=reject;
and amending “ruf” and/or “rua” fields

and creating new “_smtp._tls.” TXT “v=TLSRPTv1; rua=mailto:email@address.name” to receive the TLS-RP Reports,
but could be a great tool to troubleshoot problems in the future …

2

I actually implemented this using GitHub - cry-inc/dmarc-report-viewer: Lightweight Standalone DMARC and SMTP TLS Report Viewer with IMAP Client
But to be honest I never look at it :sweat_smile:

1 Like
3

Would you care to share / HowTo?
(I guess it will be handy when problems arise :wink:

What does @JoshData think of implementing this in MIAB?

I have found online DMARC XML to Human Converter
[Geo Statement - DMARC advisor]
that I have to manually upload the files to,
nothing for the TLS-RP Report :frowning:

The TLS-RP Reports I get from Google are *.json.gz
so a nice tool to work with them is jgze
[GitHub - xpgcrx/jgze: A lightweight CLI tool to edit .json.gz files seamlessly. Edit gzipped JSON files directly in your favorite editor with automatic formatting and compression handling.]

4

Putting it in a pull request has been low on my todo list, as I judge the chance for it to be merged quite low at this time.

But for now you can check my github. There’s no separate branch with the changes, but in short I think it’s this:

  • Add email aliases for receiving tls rpt and dmarc reports. These mails land in a folder of the Admin (management/mailconfig.py)
  • Change dns records to register these aliases (management/dns_update.py)
  • installation of the report tool (see setup/additionals.sh)
  • Use the mailinabox admin portal to proxy the login (like the munin implementation) (see management/daemon.py)

I’m sure this list is incomplete, but if you’re persistent you might get through :grin:

One thing that must be improved is that the dmarc report configuration file contains the password to the admin mail account. 1) that’s not good security 2) it must be manually kept in sync.