Deployment guide

DMARC Report Viewer

Overview

DMARC Report Viewer is a lightweight, standalone viewer for DMARC aggregate reports and SMTP TLS reports. It is a single Rust binary that combines a report parser, an IMAP client and an embedded HTTP server. It connects to a mailbox, fetches the report emails that mail receivers send back to you, parses the XML and JSON, and renders an analytics web dashboard. The dashboard shows per-domain and per-organization summaries, SPF and DKIM pass and fail counts, and ranked source IP addresses.

The viewer keeps no external database. It holds report data in memory and refreshes it from the mailbox on a schedule, which keeps it simple to run and reason about.

This SecureAnyCloud image runs the viewer on the loopback interface behind nginx, which serves the dashboard over HTTPS with HTTP Basic Authentication. A local Dovecot IMAP server on the same VM provides an on-box inbox for your DMARC reports. You can also point the viewer at your own mailbox instead. Every VM creates its own dashboard password, inbox password and TLS certificate on first boot, and the image ships with an empty inbox and no seeded data.

What you get:

DMARC Report Viewer 2.6.0, the official prebuilt release binary (MIT licensed), installed at /opt/dmarc-report-viewer/dmarc-report-viewer and run by the dmarc-report-viewer.service systemd unit as an unprivileged service account.
A local Dovecot IMAP server bound to 127.0.0.1:143 that acts as the on-box DMARC inbox.
nginx as an HTTPS reverse proxy on port 443 (per-VM self-signed certificate), forwarding to the viewer on 127.0.0.1:8080. Port 80 redirects to 443.
A one-shot first-boot service that generates a unique dashboard password, a unique inbox password and a unique TLS certificate for each VM. It writes the login to /root/dmarc-report-viewer-credentials.txt (mode 0600).
A start-time guard that refuses to start the viewer if a default or example credential is ever in effect, and a built-in self-test that proves the full parse pipeline on the running VM.

1. Launch the VM

From the Azure Marketplace

Open the SecureAnyCloud DMARC Report Viewer on Ubuntu 24.04 LTS offer in Azure Marketplace and select Create.
Choose a resource group, a region and a VM size. Standard_B2s is the recommended minimum and is comfortable for this workload.
Under Inbound port rules, allow SSH (22) and HTTPS (443). Do not expose any other port. The viewer and the IMAP server are bound to loopback and are never reachable from the network.
Create or select an SSH key pair, then review and create.

From the Azure CLI

# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:dmarc-report-viewer:default:latest
az vm create \
  --resource-group my-dmarc-rg \
  --name dmarc-report-viewer \
  --image sac1647283583153:dmarc-report-viewer:default:latest \
  --size Standard_B2s \
  --admin-username azureuser \
  --generate-ssh-keys \
  --public-ip-sku Standard
az vm open-port --resource-group my-dmarc-rg --name dmarc-report-viewer --port 443 --priority 900

2. Retrieve the per-VM dashboard login

Each VM generates its own dashboard credentials on first boot and writes them to a root-only file. Connect over SSH and read the file.

sudo cat /root/dmarc-report-viewer-credentials.txt

The file shows the dashboard URL, the username (admin), the generated dashboard password and the local inbox details. Two VMs deployed from the same image never share these values.

Confirm that the stack is healthy. All three services should report active, and the app and IMAP server should listen on loopback only.

systemctl is-active dmarc-report-viewer dovecot nginx ss -ltn | grep -E ':8080|:143|:443|:80 ' | sort

3. Sign in

Open https://<your-vm-ip>/ in a browser. The certificate is a per-VM self-signed certificate, so your browser warns once. Accept the warning, or install your own certificate (see section 7). Sign in with the username admin and the password from the credentials file.

On a fresh VM the dashboard loads with an empty inbox and zero reports. This is expected, because no report data ships in the image. The next section gets your reports flowing.

4. Get your DMARC reports into the viewer

You have two options. You can use either one or both.

Option A: deliver reports to the on-box inbox. The image runs a local Dovecot IMAP server. Configure your domain's DMARC record (rua=) or a forwarding rule so that the aggregate report emails go to the on-box mailbox. The viewer picks them up automatically on its next check.

Option B: point the viewer at your own mailbox. If you already receive DMARC reports in an existing mailbox, point the viewer straight at it. Edit the environment file and restart the service (see section 6). This is the most common production setup.

See the pipeline working now

The image ships with a built-in self-test. It injects a set of genuine sample DMARC reports into the on-box inbox, confirms that the viewer fetches, parses and displays them in the dashboard, and then removes them again. You can watch the whole pipeline end to end before you wire up your own mail flow.

sudo /usr/local/sbin/drv-selftest.sh roundtrip

The self-test authenticates to the dashboard API, injects three real sample reports, asserts that the parsed report count is non-zero, and restores the empty inbox. The parsed summary looks like this.

To keep the sample reports on screen while you explore the dashboard, run sudo /usr/local/sbin/drv-selftest.sh inject and look around. Then run sudo /usr/local/sbin/drv-selftest.sh cleanup to empty the inbox again.

5. Read the dashboard

DMARC Reports lists every parsed report with its reporting organization, the domain it covers, and any SPF, DKIM or DMARC problems.

Open a report to see its full detail: the published policy, the date range, and every record with its source IP and evaluation result. You can also export the raw XML or JSON.

Mail Sources ranks the source IP addresses seen across your reports, with the count, the domain, and a flag for any source with authentication issues. This is the quickest way to spot an unauthorized or misconfigured sender.

The Dashboard rolls all of this up into summary charts of organizations, domains, and SPF and DKIM pass and fail rates, with a time span and a per-domain filter.

6. Point the viewer at your own mailbox

The viewer's configuration lives in /etc/dmarc-report-viewer/drv.env. To read your reports from a remote mailbox instead of the on-box inbox, set the IMAP host, user and password to your provider's values and switch to TLS (port 993). For example:

# /etc/dmarc-report-viewer/drv.env IMAP_HOST=imap.your-mail-provider.com IMAP_PORT=993 IMAP_USER=dmarc@your-domain.com IMAP_PASSWORD=<set-at-first-boot> IMAP_FOLDER=INBOX IMAP_CHECK_INTERVAL=1800 HTTP_SERVER_BINDING=127.0.0.1 HTTP_SERVER_PORT=8080 HTTP_SERVER_USER=admin HTTP_SERVER_PASSWORD=<set-at-first-boot>

If you set a remote host, remove the --imap-disable-tls flag from the service. TLS is the default and you should always use it for a remote mailbox. Then restart the service.

sudo systemctl restart dmarc-report-viewer.service

7. Security model

Per-VM secrets. First boot generates the dashboard password and the on-box inbox password with openssl rand. It writes them only to /etc/dmarc-report-viewer/drv.env (mode 0640) and the root-only credentials file (mode 0600). Nothing is baked into the image, and no two VMs share a credential.
Start-time guard. The service refuses to start if the dashboard or inbox secret is empty, too short, or a known example value. A misconfigured redeploy can therefore never bring the dashboard up with a weak credential.
Loopback isolation. The viewer (8080) and the IMAP server (143) bind to 127.0.0.1 only. The sole network-facing service is nginx on 443.

sudo /usr/local/sbin/drv-guard.sh ls -l /root/dmarc-report-viewer-credentials.txt

Production TLS with a real certificate

The image ships a per-VM self-signed certificate, so the dashboard is encrypted out of the box. For a browser-trusted certificate, use one of these options:

Replace /etc/dmarc-report-viewer/tls/server.crt and server.key with your own, then reload nginx.
Front the VM with a certificate-terminating load balancer or a reverse proxy such as Caddy.
Assign the VM a public DNS name and expose port 443. The viewer also supports automatic Let's Encrypt certificates directly.

8. Maintenance

The image is patched at build time and keeps unattended security updates enabled. You can check the OS baseline and the running services at any time.

systemctl is-enabled dmarc-report-viewer dovecot nginx dmarc-report-viewer-firstboot apt-get -s -o APT::Get::Always-Include-Phased-Updates=true dist-upgrade | grep -c '^Inst ' || true

The viewer holds no database, so the only thing to back up is your configuration in /etc/dmarc-report-viewer/drv.env. Report data always comes fresh from the mailbox.

To upgrade the viewer, replace the binary at /opt/dmarc-report-viewer/dmarc-report-viewer with a newer release and restart the service.

Support

SecureAnyCloud builds and maintains this image. If you need help, contact SecureAnyCloud support and include your VM details and the output of systemctl status dmarc-report-viewer.service.

Deploy on Azure

Launch DMARC Report Viewer on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com

Deploy on Azure