Skip to content
MailDock Docs

DMARC aggregate reports

Purpose. See who is sending mail as your domains and whether it authenticates — the evidence needed to move a domain from p=none to p=reject, and the earliest sign of spoofing or a forgotten third-party sender.

Behaviour.

  • Every domain’s generated DMARC record says rua=mailto:dmarc-reports@<domain>. Setup creates one hidden system mailbox dmarc-reports@<first domain> — found by that address as well as the flag, because noreply@ is a system mailbox too (Password reset by email) (mailbox.system = true: not listed, not deletable, 1 GB quota, random password); every later domain gets a same-domain alias dmarc-reports@<domain> → that mailbox (visible under Aliases) — except while that domain is routed to another server: its aliases stop applying, so its reports go to its own mail server and are not ingested here, as the DMARC row of its DNS & routing section says. Same-domain addresses need no _report._dmarc authorisation records.
  • The worker’s dmarc-ingest job (every 30 min, DMARC_INGEST_INTERVAL_MINUTES) logs in to the system mailbox as the Dovecot master user, takes every unseen message, decodes .xml, .xml.gz and .zip attachments, stores each aggregate report (dmarc_report, deduplicated on (domain_id, org_name, report_id) — per domain as well as per reporter, because one report id from one organisation can legitimately cover several of your domains, and keying on the pair alone would discard all but the first) against the domain in policy_published, and marks the mail seen. Reports for unknown domains are skipped; undecodable attachments are counted as errors in the job log. The same mailbox receives TLS-RPT reports, which this job also ingests (MTA-STS and TLS-RPT).
  • Domains → → DMARC (GET /domains/{id}/dmarc?days=30): reports, message count, % DMARC-aligned (DKIM or SPF pass), DKIM / SPF pass rates, dispositions, and a per-source-IP table with the reporting organisations. Your own server’s IP should be 100 % aligned; other IPs are third-party senders (add them to SPF / have them sign) or spoofing.

Configuration. The worker’s DOVECOT_MASTER_PASSWORD (shared with the API, written by mailctl install) and DMARC_INGEST_INTERVAL_MINUTES (default 30). Without the password, or before setup has created the system mailbox, the job logs disabled.

Limits & edge cases.

  • Aggregate (rua) reports only; forensic (ruf) reports are not requested or parsed.
  • Installs upgraded from before this feature get the system mailbox and the aliases on the API’s next boot (idempotent reconciliation in server.ts); the mailbox is created in setup’s first domain.
  • Reports are retained indefinitely (a few KB each); a retention job is a later item.
  • The DMARC section shows the window ending now; reporters send daily, so the last 24 h is usually empty.