Run DMARC Analyzer yourself.
Everything you need to self-host: a Docker quick start, Kubernetes, the configuration reference, connecting the mailbox your reports arrive in, and day-two operations.
What you are running
DMARC Analyzer is one application with two jobs. A polling loop connects outbound to the mailbox your reports arrive in, parses the aggregate XML, and writes the result to PostgreSQL; a web console reads that database and is the part you and your clients look at. Both come out of the same image, so the default deployment is a single container plus a database, and splitting them apart is a decision you can defer until a sync pass is heavy enough to compete with the console for CPU.
None of it needs to face the internet. The application never accepts inbound SMTP and never needs an inbound connection to collect reports, so running it on a private network with no ingress at all is a legitimate choice — the console is the only thing anyone has to reach, and only if you want them to. What gets stored is statistical: sending addresses, message counts and a pass or fail per report, never the contents of anyone's mail.
Three choices shape a deployment — bundled or external PostgreSQL, one container or two, Compose or Kubernetes — and they are independent of each other. Every combination reads the same environment variables, so moving between them is a deployment change rather than a reconfiguration. That is the main reason it is safe to take the defaults now and revisit them once you know how much mail you are actually ingesting.
Getting started
- Install with Docker Get DMARC Analyzer running in minutes with Docker Compose and the prebuilt image — no build step, no account, data stays on your server.
- First steps After installing, set up a client, a domain, and a mailbox source, publish a DMARC record, and learn what to expect as the first reports arrive.
- Choosing a deployment Bundled or external PostgreSQL, one container or two, Docker Compose or Kubernetes — what each choice costs and when it is worth making.
- Kubernetes Install DMARC Analyzer with the Helm chart — the same two deployment choices as Compose, a migration Job, secret handling, backup and restore.
Using the console
- Using the console A tour of the DMARC Analyzer console — every screen, who can see it, how the analytics windows pick their dates, and what the status labels actually mean.
- Dashboard and domain list What the four dashboard cards actually count, what "Needs attention" means, and how to read the domain list — including what an em dash is telling you.
- Domain detail and enforcement The per-domain drill-down — record inspection, the path-to-enforcement recommendation, and how to diagnose a failing source from its raw authentication results.
- Investigating threats What the Threats page counts as a failing source, why not every entry is an attacker, and how to work through the list without breaking legitimate mail.
- Alerts and notifications The two alert rules and their thresholds, how triage works, why an alert wasn't emailed, and how recipients and the monthly digest are configured.
- Clients, users and audit Managing tenants and accounts — retention and legal hold per client, the three roles and per-client grants, the audit trail, and onboarding a client end to end.
- Transport security Read the per-domain MTA-STS and TLS-RPT panel — what the monitoring checks mean, how TLS failures are grouped, and when it is safe to enforce.
Configuration
- Configuration reference Every environment variable DMARC Analyzer reads — runtime mode, database, encryption key, worker tuning, and OIDC single sign-on — with defaults.
- Connecting a mailbox Point DMARC Analyzer at where your rua= reports land — IMAP, POP3 or an S3 bucket, app passwords, and how domains are auto-created.
- Running behind a reverse proxy Terminate TLS in front of DMARC Analyzer with Caddy, nginx or Traefik — and set the one thing that keeps your audit trail recording real callers.
- Single sign-on (OIDC) Let operators sign in with your existing identity provider over OIDC, alongside or instead of local passwords, with roles still enforced in-app.
- Hosting MTA-STS policies Serve every domain's MTA-STS policy file from your own instance — one CNAME and one TXT record per domain, with certificates issued automatically.
- Microsoft Entra ID Set up SSO with Microsoft Entra ID — register the app, add the client secret Entra requires, and get the redirect URI right first time.
- Google Set up SSO with a Google Cloud OAuth client — a secret shown exactly once, and a redirect-URI trap that surfaces the moment you go live.
- Keycloak Set up SSO with Keycloak — a dedicated realm and a public PKCE client, with one default worth overriding for a properly secured setup.
- Zitadel Set up SSO with Zitadel — a PKCE app with no client secret to store, rotate or leak, walked through the v4 console screen by screen.
- Authentik Set up SSO with Authentik — two objects rather than one, a confidential client by default, and grant types worth trimming before you finish.
Operations
- Upgrading and backup Pull a new image, let migrations run, and know what to back up — a continuous configuration export, a pre-upgrade database dump, and the encryption key.
- Security What DMARC Analyzer stores, how mailbox credentials and passwords are protected, how roles work, and the settings worth getting right.
- Troubleshooting Fixes for the common problems — no reports arriving, mailbox authentication failures, a worker that stopped, parse failures, and lost admin access.
- Monitoring and alerting What to probe, what to alert on, and the one fact that matters most — the worker has no HTTP surface, so watch the data move, not just the endpoints.
- Data protection and GDPR What personal data DMARC reports actually contain, where it lives in a self-hosted install, and how retention, legal hold and erasure work in practice.
- Using the API Script against the same API the console uses: signing in, the bearer token that pushes reports in, what each role may call, and the renames that fail quietly.
Looking for DMARC itself rather than this software? Start with the guides and glossary. Design notes, the roadmap and architecture decisions live in the repository.