Skip to content

DMARC Reporting

DMARC Reporting done via Rspamd DMARC Module.

Rspamd documentation can be found here: https://rspamd.com/doc/modules/dmarc.html

Important:

  1. Change example.com, mail.example.com and Example to reflect your setup

  2. DMARC reporting requires additional attention, especially over the first few days

  3. All receiving domains hosted on mailcow send from one reporting domain. It is recommended to use the parent domain of your MAILCOW_HOSTNAME:

    • If your MAILCOW_HOSTNAME is mail.example.com change the following config to domain = "example.com";
    • Set email equally, e.g. email = "noreply-dmarc@example.com";

  4. It is optional but recommended to create an email user noreply-dmarc in mailcow to handle bounces.

Enable DMARC reporting

Create the file data/conf/rspamd/local.d/dmarc.conf and set the following content:

reporting {
    enabled = true;
    email = 'noreply-dmarc@example.com';
    domain = 'example.com';
    org_name = 'Example';
    helo = 'rspamd';
    smtp = 'postfix';
    smtp_port = 25;
    from_name = 'Example DMARC Report';
    msgid_from = 'rspamd.mail.example.com';
    max_entries = 2k;
    keys_expire = 2d;
}

Create or modify docker-compose.override.yml in the mailcow-dockerized base directory:

version: '2.1'

services:
  rspamd-mailcow:
    environment:
      - MASTER=${MASTER:-y}
    labels:
      ofelia.enabled: "true"
      ofelia.job-exec.rspamd_dmarc_reporting_yesterday.schedule: "@every 24h"
      ofelia.job-exec.rspamd_dmarc_reporting_yesterday.command: "/bin/bash -c \"[[ $${MASTER} == y ]] && /usr/bin/rspamadm dmarc_report $(date --date yesterday '+%Y%m%d') > /var/lib/rspamd/dmarc_reports_last_log 2>&1 || exit 0\""
  ofelia-mailcow:
    depends_on:
      - rspamd-mailcow

Start the mailcow stack with:

docker compose up -d

docker-compose up -d

Send a copy reports to yourself

To receive a hidden copy of reports generated by Rspamd you can set a bcc_addrs list in the reporting config section of data/conf/rspamd/local.d/dmarc.conf:

reporting {
    enabled = true;
    email = 'noreply-dmarc@example.com';
    bcc_addrs = ["noreply-dmarc@example.com","parsedmarc@example.com"];
[...]

Rspamd will load changes in real time, so you won't need to restart the container at this point.

This can be useful if you...

  • ...want to check that your DMARC reports are sent correctly and authenticated.
  • ...want to analyze your own reports to get statistics, i.e. to use with ParseDMARC or other analytic systems.

Troubleshooting

Check when the report schedule last ran:

docker compose exec rspamd-mailcow date -r /var/lib/rspamd/dmarc_reports_last_log

docker-compose exec rspamd-mailcow date -r /var/lib/rspamd/dmarc_reports_last_log

See the latest report output:

docker compose exec rspamd-mailcow cat /var/lib/rspamd/dmarc_reports_last_log

docker-compose exec rspamd-mailcow cat /var/lib/rspamd/dmarc_reports_last_log

Manually trigger a DMARC report:

docker compose exec rspamd-mailcow rspamadm dmarc_report

docker-compose exec rspamd-mailcow rspamadm dmarc_report

Validate that Rspamd has recorded data in Redis: Change 20220428 to date which you interested in.

docker compose exec redis-mailcow redis-cli SMEMBERS "dmarc_idx;20220428"

docker-compose exec redis-mailcow redis-cli SMEMBERS "dmarc_idx;20220428"

Take one of the lines from output you interested in and request it, f.e.:

docker compose exec redis-mailcow redis-cli ZRANGE "dmarc_rpt;microsoft.com;mailto:d@rua.agari.com;20220428" 0 49

docker-compose exec redis-mailcow redis-cli ZRANGE "dmarc_rpt;microsoft.com;mailto:d@rua.agari.com;20220428" 0 49

Change DMARC reporting frequency

In the example above reports are sent once every 24 hours and send reports for yesterday. This will be okay for most setups.

If you have a large mail volume and want to run the DMARC reporting more than once a day you need create second schedule and run it with dmarc_report $(date '+%Y%m%d') to process the current day. You have to make sure that the first run on each day also processes the last report from the day before, so it needs to be started twice, one time with $(date --date yesterday '+%Y%m%d') at 0 5 0 * * * (00:05 AM) and then with $(date '+%Y%m%d') with desired interval.

The Ofelia schedule has the same implementation as cron in Go, supported syntax described at cron Documentation

To change schedule:

  1. Edit docker-compose.override.yml:
version: '2.1'

services:
  rspamd-mailcow:
    environment:
      - MASTER=${MASTER:-y}
    labels:
      ofelia.enabled: "true"
      ofelia.job-exec.rspamd_dmarc_reporting_yesterday.schedule: "0 5 0 * * *"
      ofelia.job-exec.rspamd_dmarc_reporting_yesterday.command: "/bin/bash -c \"[[ $${MASTER} == y ]] && /usr/bin/rspamadm dmarc_report $(date --date yesterday '+%Y%m%d') > /var/lib/rspamd/dmarc_reports_last_log 2>&1 || exit 0\""
      ofelia.job-exec.rspamd_dmarc_reporting_today.schedule: "@every 12h"
      ofelia.job-exec.rspamd_dmarc_reporting_today.command: "/bin/bash -c \"[[ $${MASTER} == y ]] && /usr/bin/rspamadm dmarc_report $(date '+%Y%m%d') > /var/lib/rspamd/dmarc_reports_last_log 2>&1 || exit 0\""
  ofelia-mailcow:
    depends_on:
      - rspamd-mailcow

  1. Restart the desired containers with:

    docker compose up -d

    docker-compose up -d

  2. Restart the ofelia container only:

    docker compose restart ofelia-mailcow

    docker-compose restart ofelia-mailcow

Disable DMARC Reporting

To disable reporting:

  1. Set enabled to false in data/conf/rspamd/local.d/dmarc.conf

  2. Revert changes done in docker-compose.override.yml to rspamd-mailcow and ofelia-mailcow

  3. Restart the desired containers with:

    docker compose up -d

    docker-compose up -d
Last update: 2023-01-09 15:44:30