Skip to content

📥 Populate / browse a SQL database with incoming DMARC aggregate reports

License

Notifications You must be signed in to change notification settings

AustinDizzy/dmarcdb

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 

History

10 Commits
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 

Repository files navigation

DMARC.db

A (still WIP) tool to populate and browse a SQL database with records from incoming DMARC aggregate reports. The idea is to make detecting misconfigured mail hosts, malicious mail servers, and monitoring outgoing mail traffic easier through constantly monitoring reported mail traffic from DMARC aggregate reports (as described in RFC 7489 section 7.2) in the form of easy-to-run reports and an (optional) interactive web interface.

This tool was built based on requirements needed or requested by West Virginia University's Information Security Services. This project is open-source licensed by the GNU General Public License (v3) found in the LICENSE file in this directory.

Usage

Configuration: A single config.yml (see: config-example.yml) or similar static configuration file named config (i.e. config.json, config.xml, config.toml, etc.) is required for basic runtime configuration in the same directory as the dmarcdb binary (i.e. "beside" the binary).

Prerequisite: MaxMind's City and ASN GeoLite2 databases in an accessible folder on the machine and for the user running dmarcdb, with locations configured in the config file.

For stable configuration, logging, and accessibility purposes, it'd be best to just have a singular folder for dmarcdb and it's accompanying files alone (i.e. C:\Program Files\DMARCDB\).

Commands:

For each command listed below (and also without any commands) on startup, if web is set in the config to true, it will also begin to serve a web browseable interface (data read-only) over the configured port.

  • ./dmarcdb build - Begins the process of building the database with records populated from the mail folder configured as mailFolder

  • ./dmarcdb logs - Prints any error logs received while attempting to processed malformed DMARC aggregate reports or malformed emails

  • ./dmarcdb flush <fails|hosts> - Without parameters, deletes both logged errors and cached hostname lookups. With either extra parameter flush or hosts, will only flush respective option.

Third-Party Technologies

The following (nonexhaustive) list of third-party technolgies were used in this project:

About

📥 Populate / browse a SQL database with incoming DMARC aggregate reports

Topics

Resources

License

Stars

Watchers

Forks

Releases

No releases published

Packages

No packages published