dmarc-srg
dmarc-srg copied to clipboard
liuch
Error report summary
I would like a utility that will generate a summary of errors. When the user runs it, there should be an ignore type, where I can ignore SPF softfails. And the database can keep a record of when I as a user last requested an error report, and only list reports with a loaded_time after the last report.
It should be a single table that shows each domain on it's own row, summarizing reports containing the requested errors in their own column. If there were no such errors, it should not send an email at all.
That is maybe the most robust, straight forward and useful to people who want hourly or daily summaries of errors (if any came in). More straightforward than my initial thoughts on the subject, which I will include below in case you like them better.
Generate a report with error types for domain as all, a list, or by user, where type may be all or a comma separated list of dmarc, dkim, spfsoft, spfhard, as well as the typical period parameter. Ideally, without a period, the default behaviour would be to send all reported errors of the above types since the last time this user ran an error report summary.
The period should be from when the report is requested, and be based on when it was fetched and loaded in to the database. That is, lastndays=1 won't get from yesterday's reporting period, but the last 24 hours of reports by time they were received. That way none are missed, like if a report is delayed in coming in.
One concern I have is missing a delayed report. For example, if I have a cron job sending out just the error summary, and it sends every day, but an error report for the last day's reporting period comes in after I send it, it would not be caught in any reporting period. It would be good to have up-to-the-minute errors, since the last error summary was requested, rather than it being based on the reporting period.
Thanks for this. I made a collection of scripts that did something very similar a couple of years ago, but my approach was fundamentally flawed, and Google's habit of resending the same report more than once is causing strain on it. DMARC-SRG is a very good replacement for it.
