Documentation
Run DMARC Analyzer yourself.
Everything you need to self-host: a Docker quick start, Kubernetes, the configuration reference, connecting the mailbox your reports arrive in, and day-two operations.
Getting started
- Install with Docker Get DMARC Analyzer running in a few minutes with Docker Compose using the prebuilt image — no build step, no account, and your data stays on your server.
- First steps After installing, set up a client, a domain, and a mailbox source, publish a DMARC record, and learn what to expect as the first reports arrive.
- Choosing a deployment Bundled or external PostgreSQL, one container or two, Docker Compose or Kubernetes — what each choice costs and when it is worth making.
- Kubernetes Install DMARC Analyzer with the Helm chart — the same two deployment choices as Compose, a migration Job, secret handling, backup and restore.
Using the console
- Using the console A tour of the DMARC Analyzer console — every screen, who can see it, how the analytics windows pick their dates, and what the status labels actually mean.
- Dashboard and domain list What the four dashboard cards actually count, what "Needs attention" means, and how to read the domain list — including what an em dash is telling you.
- Domain detail and enforcement The per-domain drill-down — record inspection, the path-to-enforcement recommendation, and how to diagnose a failing source from its raw authentication results.
- Investigating threats What the Threats page counts as a failing source, why not every entry is an attacker, and how to work through the list without breaking legitimate mail.
- Alerts and notifications The two alert rules and their thresholds, how triage works, why an alert wasn't emailed, and how recipients and the monthly digest are configured.
- Clients, users and audit Managing tenants and accounts — retention and legal hold per client, the three roles and per-client grants, the audit trail, and onboarding a client end to end.
Configuration
- Configuration reference Every environment variable DMARC Analyzer reads — runtime mode, database, encryption key, worker tuning, and OIDC single sign-on — with defaults.
- Connecting a mailbox Point DMARC Analyzer at the inbox your rua= reports arrive in — IMAP settings, app passwords, how domains are auto-created, and how backfill works.
- Single sign-on (OIDC) Let operators sign in with your existing identity provider over OIDC, alongside or instead of local passwords, with roles still enforced in-app.
- Running behind a reverse proxy Terminate TLS in front of DMARC Analyzer with Caddy, nginx or Traefik — and set the one thing that keeps your audit trail recording real callers.
Operations
- Upgrading and backup Pull a new image, let migrations run, and know what to back up — a continuous configuration export, a pre-upgrade database dump, and the encryption key.
- Security What DMARC Analyzer stores, how mailbox credentials and passwords are protected, how sessions and roles work, and the handful of settings worth getting right.
- Troubleshooting Fixes for the common problems — no reports arriving, mailbox authentication failures, a worker that stopped, parse failures, and lost admin access.
- Monitoring and alerting What to probe, what to alert on, and the one fact that matters most — the worker has no HTTP surface, so watch the data move, not just the endpoints.
- Data protection and GDPR What personal data DMARC reports actually contain, where it lives in a self-hosted install, and how retention, legal hold and erasure work in practice.
Looking for DMARC itself rather than this software? Start with the guides and glossary. Design notes, the roadmap and architecture decisions live in the repository.