mailreports reads the daily DMARC and TLS reports from your mailbox and explains them in plain words instead of XML and result codes: your own server, authorised services, forwarders and senders that should not be there.
Free under AGPL-3.0 · No cloud, no telemetry · amd64 and arm64
From raw reports to clear answers.
Point the rua= address of your DMARC record and your TLS-RPT record at a mailbox. mailreports fetches, stores and explains everything that arrives there.
Explained in plain words
Every report record as a sentence: which sender, how many emails, signed or not, and what the receiver did with them.
Sender classification
Your own server, authorised services by DKIM selector, forwarders and unknown senders, with reverse DNS, country and network. Add a known sender with one click from its page.
TLS reports
Whether other servers reached yours over an encrypted connection, for MTA-STS and DANE, with the reason for every failure.
Straight from the mailbox
IMAP over TLS, reports as XML, JSON, gzip or zip. Mails are moved or flagged, never deleted, or left untouched in read-only mode.
Notifications
Pushover, ntfy, webhook or email when something fails, at most once a day per finding, plus an optional weekly summary.
Overview and history
Pass rate, daily history and published policy per domain, also as JSON and Prometheus metrics.
DNS check
DMARC, SPF with its lookup limit, DKIM keys, MX with DANE, MTA-STS, TLS-RPT and BIMI, checked daily, with a message when a record changes or a new problem appears.
Sender pages and search
The history of every sending IP and a search across addresses, host names, reporters, report IDs and DKIM selectors.
Export and retention
Download original reports, export records as CSV and delete old data automatically after a set number of days.
Every record, explained.
“These 118 emails came from Newsletter service: correctly signed with example.org.” Or: an unknown sender tried to send as your domain and was rejected. Below each explanation: the DKIM signatures, the SPF check and both sender addresses.
Know when to tighten.
Once the reports show that all your known senders pass, mailreports suggests the next stricter policy with the record to publish. If not, it lists what needs fixing first.
Alerts where you look.
Set up Pushover, ntfy, a webhook or email right in the app and send a test message to check it. Tokens and passwords are stored encrypted.
Secure sign-in, built in
Two-factor and passkeysAccounts with administrator and read-only roles, codes from an authenticator app, recovery codes, passkeys and security keys.
Single sign-onSign in through an OpenID Connect provider such as Authelia, alongside the normal sign-in, or let your reverse proxy handle the login.
Hardened by defaultUntrusted reports parsed safely, a strict Content Security Policy, CSRF protection, a sign-in log and a read-only container without root.
One container, one SQLite file.
Enter your mailbox in .env and your own mail server in sources.toml, then start it. The page asks for a setup code from the log and creates the first account.
