search

domainaware / parsedmarc

A Python package and CLI for parsing aggregate and forensic DMARC reports
https://domainaware.github.io/parsedmarc/
Apache License 2.0
962 stars 210 forks source link

Avoid archiving invalid emails (not DMARC reports) from the inbox #474

Open marcorocca opened 4 months ago

marcorocca commented 4 months ago

Good evening everyone,

I have set up a system in which the mailbox where I receive DMARC report emails is a mailbox in which I also receive other mail.

The system reads all the emails and those that appear to be a valid DMARC report are moved to the Archive > Aggregate folder while those that do not appear to be a valid report are moved to Archive > Invalid.

As unusual as this setup may be, is it possible to ensure that emails considered "invalid" are not archived, but left as they are in the inbox and instead only those that are actually reports are archived? In this way I can make "normal" emails and reports coexist.

At the moment, to prevent all emails arriving in the inbox from being archived, I have set the flag test = True but this requires me to perform a manual archiving operation from time to time and I would like to try to automate it.

Thanks for the invaluable tool!

AnaelMobilia commented 4 months ago

Hello @marcorocca

As parsedmarc process all mails in it's main folder, it will make parsedmarc processing forever "invalid" emails (as invalid dmarc report or not related emails).

IMHO, it will be better to make a "DMARC" folder and put an automated (on your email server or client) rule which will move emails with the keyword "dmarc" in the subject to the "DMARC" folder.

Another option could be moving manually dmarc related email to the "DMARC" folder if you receive only few reports.

Bests regards, Anael

marcorocca commented 4 months ago

Hello @AnaelMobilia,

thank you for the suggestions!

The problem I see is linked to the fact that a filter that moves emails from the inbox to the dmarc folder linked exclusively to the presence or absence of the word "dmarc" cannot be as strong as the validator internal to parsedmarc.

For this reason my intention was to leave the discriminant to the parser and ignore the invalid ones (because in my case they are very normal emails).

In any case, the solution indicated may be fine for the moment, but the introduction of a flag that inhibits the moving/deletion of invalid emails would be much more appropriate.

Regards, Marco