release: 1.7.0

Receive DMARC aggregate reports on port 25 and show parsed summaries in the panel. Close Unreleased; pin compose and docs to 1.7.0.

Co-authored-by: Cursor <cursoragent@cursor.com>

internal/web/view/templates/dmarc.html

@@ -0,0 +1,63 @@
+{{define "wide"}}wide{{end}}
+
+{{define "content"}}
+<h1>DMARC reports</h1>
+
+<p class="muted">Aggregate reports SelfPost accepted for <code>rua=</code>.
+Forensic (<code>ruf=</code>) is out of scope. Open a report for the parsed
+XML — not a dashboard.</p>
+
+<div class="pair">
+  <div class="card">
+    <h2>Ingest {{if .IngestStats.IngestOK}}<span class="st st-ok">ok</span>{{else}}<span class="st st-warn">quiet</span>{{end}}</h2>
+    {{if .LastReceivedLabel}}
+    <p>Last report {{.LastReceivedLabel}} UTC. Port 25 accepts only configured report addresses.</p>
+    {{else}}
+    <p>No reports received yet. Point <code>rua=</code> at
+    <code>{{.HostedAddress}}</code> (or a per-domain hosted address) and publish
+    MX for {{.HostedAddress}} on this server.</p>
+    {{end}}
+  </div>
+  <div class="card">
+    <h2>This week</h2>
+    <p>{{.IngestStats.KeptThisWeek}} kept{{if .IngestStats.ParseFailures}}, {{.IngestStats.ParseFailures}} parse failures{{end}}.
+    Older summaries are pruned ({{.RetentionMax}} max, {{.RetentionDays}} days).</p>
+  </div>
+</div>
+
+<div class="card">
+  <h2>Recent reports</h2>
+  {{if .Reports}}
+  <table class="desk-only">
+    <thead><tr><th>Received</th><th>Domain</th><th>Reporter</th><th>Window</th><th>Pass</th><th>Fail</th><th></th></tr></thead>
+    <tbody>
+    {{range .Reports}}
+      <tr>
+        <td class="time muted">{{.ReceivedLabel}}</td>
+        <td>{{if .DomainID}}<a href="/dmarc/domains/{{.DomainID}}">{{.Domain}}</a>{{else}}{{.Domain}}{{end}}</td>
+        <td class="muted">{{.Reporter}}</td>
+        <td>{{.PeriodLabel}}</td>
+        <td>{{.PassCount}}</td>
+        <td>{{.FailCount}}</td>
+        <td class="actions"><a href="/dmarc/reports/{{.ID}}">View</a></td>
+      </tr>
+    {{end}}
+    </tbody>
+  </table>
+  <ul class="phone-list phone-only">
+    {{range .Reports}}
+    <li>
+      <a href="/dmarc/reports/{{.ID}}">
+        <span class="st {{if gt .FailCount 0}}st-warn{{else}}st-ok{{end}}">{{.PassCount}} pass</span>
+        <span class="when">{{.ReceivedLabel}}</span>
+        <span class="meta">{{.Domain}} · {{.Reporter}}</span>
+        <span class="subj">{{.FailCount}} fail</span>
+      </a>
+    </li>
+    {{end}}
+  </ul>
+  {{else}}
+  <p class="muted">No reports yet.</p>
+  {{end}}
+</div>
+{{end}}

internal/web/view/templates/dmarc_domain.html

@@ -0,0 +1,59 @@
+{{define "content"}}
+<h1>{{.Domain.Name}}</h1>
+{{template "back_link" (back "/dmarc" "All DMARC reports")}}
+{{template "back_link" (back (printf "/domains/%d" .Domain.ID) (printf "Back to %s" .Domain.Name))}}
+
+<div class="pair">
+  <div class="card">
+    <h2>Last {{.WindowDays}} days {{if and (gt .Pass7d 0) (eq .Fail7d 0)}}<span class="st st-ok">pass</span>{{else if gt .Fail7d 0}}<span class="st st-warn">review</span>{{end}}</h2>
+    <p>{{.PolicyHint}}</p>
+    <p class="muted"><a href="/domains/{{.Domain.ID}}#dmarc">Domain DNS and rua=</a></p>
+  </div>
+  <div class="card">
+    <h2>Totals</h2>
+    <p>{{.Pass7d}} pass · {{.Fail7d}} fail in aggregate summaries.</p>
+  </div>
+</div>
+
+<div class="card">
+  <h2>Reports</h2>
+  {{if .Reports}}
+  <table class="desk-only">
+    <thead><tr><th>Received</th><th>Reporter</th><th>Window</th><th>Pass</th><th>Fail</th><th></th></tr></thead>
+    <tbody>
+    {{range .Reports}}
+      <tr>
+        <td class="time muted">{{.ReceivedLabel}}</td>
+        <td class="muted">{{.Reporter}}</td>
+        <td>{{.PeriodLabel}}</td>
+        <td>{{.PassCount}}</td>
+        <td>{{.FailCount}}</td>
+        <td class="actions"><a href="/dmarc/reports/{{.ID}}">View</a></td>
+      </tr>
+    {{end}}
+    </tbody>
+  </table>
+  {{else}}
+  <p class="muted">No reports for this domain yet.</p>
+  {{end}}
+</div>
+
+{{if .Sources}}
+<div class="card">
+  <h2>Sources · last {{.WindowDays}} days</h2>
+  <table class="desk-only">
+    <thead><tr><th>Source</th><th>Pass</th><th>Fail</th><th>Disposition</th></tr></thead>
+    <tbody>
+    {{range .Sources}}
+      <tr>
+        <td class="muted">{{.SourceIP}}{{if .ThisRelay}} (this relay){{end}}</td>
+        <td>{{.PassCount}}</td>
+        <td>{{.FailCount}}</td>
+        <td><span class="st {{if gt .FailCount 0}}st-warn{{else}}st-ok{{end}}">{{.Disposition}}</span></td>
+      </tr>
+    {{end}}
+    </tbody>
+  </table>
+</div>
+{{end}}
+{{end}}

internal/web/view/templates/dmarc_report.html

@@ -0,0 +1,52 @@
+{{define "content"}}
+<h1 class="subject">{{.Report.Reporter}} · {{.WindowLabel}}</h1>
+<p class="route">
+  <span class="addr">{{.Report.Domain}}</span>
+  <span class="st st-ok">{{.Report.PassCount}} pass</span>
+  {{if gt .Report.FailCount 0}}<span class="st st-warn">{{.Report.FailCount}} fail</span>{{end}}
+</p>
+{{template "back_link" (back (printf "/dmarc/domains/%d" .Domain.ID) (printf "Back to %s" .Domain.Name))}}
+
+<div class="pair">
+  <div class="card">
+    <h2>Report</h2>
+    <div class="facts">
+      <div class="fact"><span class="fact-label">Reporter</span><span class="fact-value">{{.Report.Reporter}}</span></div>
+      <div class="fact"><span class="fact-label">Report id</span><span class="fact-value mono">{{.Report.ReportID}}</span></div>
+        <div class="fact"><span class="fact-label">Window</span><span class="fact-value">{{.PeriodBeginLabel}} – {{.PeriodEndLabel}} UTC</span></div>
+        <div class="fact"><span class="fact-label">Received</span><span class="fact-value">{{.ReceivedLabel}} UTC</span></div>
+      {{if .Report.ContactEmail}}<div class="fact"><span class="fact-label">Contact</span><span class="fact-value">{{.Report.ContactEmail}}</span></div>{{end}}
+    </div>
+  </div>
+  <div class="card{{if gt .Report.FailCount 0}} attn{{end}}">
+    <h2>Published policy</h2>
+    <div class="facts">
+      <div class="fact"><span class="fact-label">Domain</span><span class="fact-value">{{.Report.Domain}}</span></div>
+      <div class="fact"><span class="fact-label">p / sp / pct</span><span class="fact-value mono">{{.Report.PolicyP}} / {{.Report.PolicySP}} / {{.Report.PolicyPct}}</span></div>
+      <div class="fact"><span class="fact-label">adkim / aspf</span><span class="fact-value mono">{{.Report.PolicyADKIM}} / {{.Report.PolicyASPF}}</span></div>
+      {{if .Report.Recipient}}<div class="fact"><span class="fact-label">rua</span><span class="fact-value">{{.Report.Recipient}}</span></div>{{end}}
+    </div>
+    <p class="muted"><code>p={{.Report.PolicyP}}</code> is what receivers enforced in this window.</p>
+  </div>
+</div>
+
+<div class="card">
+  <h2>Records</h2>
+  <table class="desk-only">
+    <thead><tr><th>Source</th><th>Count</th><th>Disposition</th><th>SPF</th><th>DKIM</th><th>Header from</th></tr></thead>
+    <tbody>
+    {{range .Report.Records}}
+      <tr>
+        <td class="muted">{{.SourceIP}}</td>
+        <td>{{.Count}}</td>
+        <td><span class="st {{if or (eq .SPFResult "pass") (eq .DKIMResult "pass")}}st-ok{{else}}st-warn{{end}}">{{.Disposition}}</span></td>
+        <td><span class="st {{if eq .SPFResult "pass"}}st-ok{{else}}st-error{{end}}">{{.SPFResult}}</span></td>
+        <td><span class="st {{if eq .DKIMResult "pass"}}st-ok{{else}}st-error{{end}}">{{.DKIMResult}}</span></td>
+        <td>{{.HeaderFrom}}</td>
+      </tr>
+    {{end}}
+    </tbody>
+  </table>
+  <p class="muted">Parsed from the aggregate XML. Forensic (<code>ruf=</code>) samples are not stored.</p>
+</div>
+{{end}}

internal/web/view/templates/domain_detail.html

@@ -170,8 +170,11 @@
     </div>
 
     {{if .SameDomainRUA}}
-    <p class="error">The report address is on this sending domain. SelfPost does
-    not receive inbound mail — use a mailbox on another domain.</p>
+    <p class="error">The report address is on this sending domain.{{if not .DMARCIngestEnabled}}
+    SelfPost does not receive inbound mail — use a mailbox on another domain.{{end}}</p>
+    {{end}}
+    {{if and .DMARCIngestEnabled .ResolvedDMARCEmail}}
+    <p class="muted"><a href="/dmarc/domains/{{.Domain.ID}}">View DMARC reports</a> for this domain.</p>
     {{end}}
 
     {{if .NeedsReportAuth}}
@@ -385,6 +388,7 @@
           <label for="dmarc_rua_mode">Aggregate reports (rua=)</label>
           <select id="dmarc_rua_mode" name="dmarc_rua_mode" data-custom-mode="custom">
             <option value="inherit"{{if eq .DMARCRuaMode "inherit"}} selected{{end}}>Same as Settings{{if .ProfileDMARCEmail}} ({{.ProfileDMARCEmail}}){{end}}</option>
+            {{if .DMARCIngestEnabled}}<option value="hosted"{{if eq .DMARCRuaMode "hosted"}} selected{{end}}>SelfPost hosted ({{.HostedDMARCEmail}})</option>{{end}}
             <option value="none"{{if eq .DMARCRuaMode "none"}} selected{{end}}>No aggregate reports</option>
             <option value="custom"{{if eq .DMARCRuaMode "custom"}} selected{{end}}>Custom address</option>
           </select>

internal/web/view/templates/layout.html

@@ -73,6 +73,9 @@
     {{if and .IsGlobal .InboundEnabled}}
     {{if eq .Active "inbound"}}<span aria-current="page">{{template "icon-inbound"}}Inbound</span>{{else}}<a href="/inbound">{{template "icon-inbound"}}Inbound</a>{{end}}
     {{end}}
+    {{if .DMARCEnabled}}
+    {{if eq .Active "dmarc"}}<span aria-current="page">{{template "icon-dmarc"}}DMARC</span>{{else}}<a href="/dmarc">{{template "icon-dmarc"}}DMARC</a>{{end}}
+    {{end}}
     {{if eq .Active "deliveries"}}<span aria-current="page">{{template "icon-deliveries"}}Deliveries</span>{{else}}<a href="/deliveries">{{template "icon-deliveries"}}Deliveries</a>{{end}}
     {{if .IsGlobal}}
     {{if eq .Active "mail_queue"}}<span aria-current="page">{{template "icon-mail-queue"}}Mail queue</span>{{else}}<a href="/mail-queue">{{template "icon-mail-queue"}}Mail queue</a>{{end}}
@@ -116,6 +119,7 @@
 {{define "icon-status"}}<svg class="icon" viewBox="0 0 16 16" fill="none" stroke="currentColor" stroke-width="1.5" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><path d="M1.25 8.5h2.9L6.2 3.4l3.1 9.4 1.9-4.3h3.55"/></svg>{{end}}
 {{define "icon-domains"}}<svg class="icon" viewBox="0 0 16 16" fill="none" stroke="currentColor" stroke-width="1.5" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><circle cx="8" cy="8" r="6.25"/><path d="M1.9 8h12.2"/><path d="M8 1.75c1.85 1.8 2.8 4 2.8 6.25S9.85 12.45 8 14.25C6.15 12.45 5.2 10.25 5.2 8S6.15 3.55 8 1.75Z"/></svg>{{end}}
 {{define "icon-inbound"}}<svg class="icon" viewBox="0 0 16 16" fill="none" stroke="currentColor" stroke-width="1.5" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><path d="M2.5 9.5h11"/><path d="M8 2.75v6.2"/><path d="M5.4 6.4 8 9.05 10.6 6.4"/><path d="M3.2 12.6h9.6"/></svg>{{end}}
+{{define "icon-dmarc"}}<svg class="icon" viewBox="0 0 16 16" fill="none" stroke="currentColor" stroke-width="1.5" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><path d="M2.5 4.5h11v7H2.5z"/><path d="M5 7.5h6M5 9.5h4"/></svg>{{end}}
 {{define "icon-deliveries"}}<svg class="icon" viewBox="0 0 16 16" fill="none" stroke="currentColor" stroke-width="1.5" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><path d="M14.25 1.75 1.6 6.6l5 2.05 2.05 5z"/><path d="M14.25 1.75 6.6 8.65"/></svg>{{end}}
 {{define "icon-mail-queue"}}<svg class="icon" viewBox="0 0 16 16" fill="none" stroke="currentColor" stroke-width="1.5" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><path d="M1.75 9.5h3.3l1 1.75h3.9l1-1.75h3.3v3.05a1.2 1.2 0 0 1-1.2 1.2H2.95a1.2 1.2 0 0 1-1.2-1.2z"/><path d="M1.75 9.5 3.4 3.2a1.25 1.25 0 0 1 1.2-.95h6.8a1.25 1.25 0 0 1 1.2.95l1.65 6.3"/></svg>{{end}}
 {{define "icon-system-log"}}<svg class="icon" viewBox="0 0 16 16" fill="none" stroke="currentColor" stroke-width="1.5" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><path d="M3.75 1.75h5.1l3.4 3.4v8.05a1.05 1.05 0 0 1-1.05 1.05H3.75a1.05 1.05 0 0 1-1.05-1.05V2.8a1.05 1.05 0 0 1 1.05-1.05Z"/><path d="M8.85 1.75v3.4h3.4"/><path d="M5.35 8.6h5.3M5.35 11.1h3.5"/></svg>{{end}}

internal/web/view/templates/settings.html

@@ -41,14 +41,15 @@
   <div class="card">
     <h2>DMARC aggregate reports</h2>
     <p class="muted">Optional default <code>rua=</code> address for every sending
-    domain (can be overridden per domain). Use a mailbox on a domain that
-    receives inbound mail. SelfPost does not receive inbound mail — point
-    <code>rua=</code> at a mailbox elsewhere.</p>
+    domain (can be overridden per domain).{{if .DMARCIngestEnabled}} When set to
+    an address on <code>{{.HostedReportAddress}}</code>, SelfPost receives and
+    parses aggregate reports on port&nbsp;25.{{else}} Use a mailbox on a domain
+    that receives inbound mail elsewhere.{{end}}</p>
 
     <label for="dmarc_report_email">Default report address</label>
     <input id="dmarc_report_email" name="dmarc_report_email" type="email"
            autocomplete="email" autocapitalize="none" spellcheck="false"
-           value="{{.FormDMARCEmail}}" placeholder="reports@your-mail-domain.com">
+           value="{{.FormDMARCEmail}}" placeholder="{{if .DMARCIngestEnabled}}{{.HostedReportAddress}}{{else}}reports@your-mail-domain.com{{end}}">
 
     {{if .FormDMARCEmail}}
     <p class="muted">When <code>rua=</code> points at another domain, that hub

internal/web/view/templates_test.go

@@ -222,7 +222,7 @@ func TestOnlyThePagesMadeOfDataDeclareThemselvesWide(t *testing.T) {
 	wide := map[string]bool{
 		"settings": true, "deliveries": true, "delivery": true, "mail_queue": true,
 		"status": true, "system_log": true, "domain_detail": true,
-		"inbound": true, "inbound_domain": true,
+		"inbound": true, "inbound_domain": true, "dmarc": true,
 	}
 	for name, page := range engine.Pages() {
 		var buf bytes.Buffer
@@ -324,6 +324,8 @@ func TestDrillDownPagesPlaceBackLinkAboveContent(t *testing.T) {
 		"domain_delete.html":  true,
 		"inbound_domain.html": true,
 		"inbound_delete.html": true,
+		"dmarc_domain.html":   true,
+		"dmarc_report.html":   true,
 		"delivery.html":       true,
 	}
 	forEachTemplate(t, func(name, body string) {

internal/web/view/view.go

@@ -22,6 +22,7 @@ type Engine struct {
 	fragments      map[string]*template.Template
 	version        string
 	inboundEnabled bool
+	dmarcEnabled   bool
 }
 
 // pageFiles maps a logical page name to its template files. Every page
@@ -45,6 +46,9 @@ var pageFiles = map[string][]string{
 	"inbound":        {"templates/inbound.html"},
 	"inbound_domain": {"templates/inbound_domain.html"},
 	"inbound_delete": {"templates/inbound_delete.html"},
+	"dmarc":          {"templates/dmarc.html"},
+	"dmarc_domain":   {"templates/dmarc_domain.html"},
+	"dmarc_report":   {"templates/dmarc_report.html"},
 	"deliveries":     {"templates/deliveries.html", "templates/deliveries_rows.html"},
 	"delivery":       {"templates/delivery.html"},
 	"mail_queue":     {"templates/mail_queue.html", "templates/mail_queue_body.html"},
@@ -92,6 +96,11 @@ func (e *Engine) SetInboundEnabled(v bool) {
 	e.inboundEnabled = v
 }
 
+// SetDMARCEnabled controls whether the DMARC nav item is shown.
+func (e *Engine) SetDMARCEnabled(v bool) {
+	e.dmarcEnabled = v
+}
+
 // templateFuncs supplies helpers shared across page templates.
 func templateFuncs() template.FuncMap {
 	return template.FuncMap{
@@ -135,6 +144,7 @@ func (e *Engine) Render(w http.ResponseWriter, status int, page string, data any
 		m["Copyright"] = legal.CopyrightLine
 		m["SourceURL"] = legal.SourceURL
 		m["InboundEnabled"] = e.inboundEnabled
+		m["DMARCEnabled"] = e.dmarcEnabled
 	}
 	var buf bytes.Buffer
 	if err := tmpl.ExecuteTemplate(&buf, "layout.html", data); err != nil {