diff --git a/build/postfix-config.sh b/build/postfix-config.sh
index 2494bf4..cdf2716 100644
--- a/build/postfix-config.sh
+++ b/build/postfix-config.sh
@@ -291,11 +291,23 @@ if [ "${INBOUND_RELAY_ENABLE}" = "true" ] || [ "${DMARC_REPORTS_ENABLE}" = "true
# attribute" on every report. They go into the service line itself.
# ${recipient} is expanded by pipe(8), not by the shell: the command
# learns which report address the message came to from its argument.
- postconf -M 'dmarc-ingest/unix=dmarc-ingest unix - n n - - pipe flags=Rq user=panel argv=/usr/local/bin/dmarc-ingest ${recipient}'
+ # One at a time (the 1 before "pipe"): reports are in no hurry, every run
+ # writes to the database the panel writes to, and a hundred of them in
+ # parallel - Postfix's default - is what a flood of reports would start.
+ postconf -M 'dmarc-ingest/unix=dmarc-ingest unix - n n - 1 pipe flags=Rq user=panel argv=/usr/local/bin/dmarc-ingest ${recipient}'
# One recipient per run, so ${recipient} is one argument.
postconf -e "dmarc-ingest_destination_recipient_limit=1"
# pipe(8) starts the command with export_environment only, so what the
# command reads from the container's environment is named there.
+ # export_environment is a list split at whitespace in which Postfix
+ # expands "$": a path with either would reach the command as another
+ # path, and it would quietly open a database of its own.
+ case "${SELFPOST_DATA_DIR:-}${SELFPOST_DB_PATH:-}" in
+ *[[:space:]]* | *'$'*)
+ echo "postfix-config: SELFPOST_DATA_DIR and SELFPOST_DB_PATH must not contain whitespace or \$ when DMARC_REPORTS_ENABLE=true" >&2
+ exit 1
+ ;;
+ esac
DMARC_INGEST_ENV="DMARC_REPORTS_ENABLE=true"
[ -z "${SELFPOST_DATA_DIR:-}" ] || DMARC_INGEST_ENV="${DMARC_INGEST_ENV} SELFPOST_DATA_DIR=${SELFPOST_DATA_DIR}"
[ -z "${SELFPOST_DB_PATH:-}" ] || DMARC_INGEST_ENV="${DMARC_INGEST_ENV} SELFPOST_DB_PATH=${SELFPOST_DB_PATH}"
diff --git a/cmd/panel/dmarc_ingest.go b/cmd/panel/dmarc_ingest.go
index 17421b4..a324b9d 100644
--- a/cmd/panel/dmarc_ingest.go
+++ b/cmd/panel/dmarc_ingest.go
@@ -50,8 +50,24 @@ func runDMARCIngestMode() error {
// all of which that line already has. postlog is no use here: pipe(8) starts
// the command without the group that may write to Postfix's log socket.
func logRejected(reason error) {
- text := strings.TrimPrefix(reason.Error(), dmarc.ErrRejected.Error()+": ")
- fmt.Fprintln(os.Stderr, "dropped: "+text)
+ fmt.Fprintln(os.Stderr, "dropped: "+logSafe(strings.TrimPrefix(reason.Error(), dmarc.ErrRejected.Error()+": ")))
+}
+
+// logSafe makes a reason fit for a log line. Parts of it are the sender's own
+// bytes - a header line, a file name inside an archive, a piece of XML - so it
+// is cut short and anything that is not printable ASCII becomes "?", whatever
+// Postfix would have done with it.
+func logSafe(s string) string {
+ const max = 200
+ if len(s) > max {
+ s = s[:max]
+ }
+ return strings.Map(func(r rune) rune {
+ if r < 0x20 || r > 0x7e {
+ return '?'
+ }
+ return r
+ }, s)
}
// ingestRecipient is the report address the message was delivered to. Postfix's
diff --git a/cmd/panel/dmarc_ingest_test.go b/cmd/panel/dmarc_ingest_test.go
index 12e9ff5..79a1253 100644
--- a/cmd/panel/dmarc_ingest_test.go
+++ b/cmd/panel/dmarc_ingest_test.go
@@ -18,3 +18,17 @@ func TestIngestRecipient(t *testing.T) {
}
}
}
+
+func TestLogSafe(t *testing.T) {
+ got := logSafe("zip entry \"a\nstatus=bounced\tx\" \x1b[31m é")
+ if want := "zip entry \"a?status=bounced?x\" ?[31m ?"; got != want {
+ t.Errorf("logSafe = %q, want %q", got, want)
+ }
+ long := make([]byte, 1000)
+ for i := range long {
+ long[i] = 'a'
+ }
+ if got := logSafe(string(long)); len(got) != 200 {
+ t.Errorf("logSafe kept %d bytes of 1000, want 200", len(got))
+ }
+}
diff --git a/docs/guide.md b/docs/guide.md
index 923b1cd..46eb0be 100644
--- a/docs/guide.md
+++ b/docs/guide.md
@@ -891,7 +891,7 @@ sees the *Ingest* box — whether ingest works, the last report received, report
kept this week and parse failures. Open a domain's roll-up from the list or
from *DMARC reports* in the domain page's menu. A user with the *domain* role
sees the reports of the domains assigned to them, without the *Ingest* box.
-Summaries are pruned (500 kept, 90 days max).
+Summaries are pruned (500 kept for each domain, 90 days max).
A message that is not a report the relay keeps — unreadable as an aggregate
report, about a domain not sent from here, or delivered to another domain's
diff --git a/docs/roadmap.md b/docs/roadmap.md
index 5f12b0f..857f963 100644
--- a/docs/roadmap.md
+++ b/docs/roadmap.md
@@ -47,7 +47,8 @@ development convenience): **panel-redesign** shipped as `2.0.0` (2026-10-11); th
**inbound-antispam-panel** (`2.1.0`), built in the new component kit —
styling its two screens once instead of twice. panel-docs shipped in
[CHANGELOG.md](../CHANGELOG.md) `[1.8.0]`; dmarc-reports in `[1.7.0]`
-(security review of the ingest path pending); domain-stats-auto-ratelimit in
+(its ingest path first ran in `2.0.0` and was reviewed on 2026-10-11, see
+[security.md](security.md)); domain-stats-auto-ratelimit in
`[1.6.0]`; send-log-retention in `[1.5.0]`; inbound-relay in `[1.4.0]`;
queue-retries in `[1.3.1]`; the 2026-08-13 full-tree review follow-ups are in
`[1.3.0]`. Candidates need explicit agreement before they join the queue.
diff --git a/docs/security.md b/docs/security.md
index daa1ba8..8c2af8c 100644
--- a/docs/security.md
+++ b/docs/security.md
@@ -26,7 +26,14 @@ the user form did not end that user's sessions, internal errors reached forms a
(see [Authentication and sessions](#authentication-and-sessions) and [Errors
shown to users](#errors-shown-to-users)); two deliberate behaviours are
recorded under Accepted risks (upstream of a delegated inbound domain, profile
-saved without the password).
+saved without the password). The 2026-10-11 review (Fable) covered the DMARC
+report path from port 25 to the report pages, which ran for the first time in
+2.0.0 - the 2026-08-19 pass read code that Postfix could not yet start: no
+Critical or High finding; a report's size was bounded only as bytes (now 5 000
+records, 255 bytes a field), the retention cap was one for the whole server
+(now per domain), the delivery command could run a hundred at once (now one),
+and the reason logged for a dropped message carried the sender's bytes as they
+came (now cut and reduced to printable ASCII).
(2) **Accepted risks** —
deliberate departures beyond the mandatory, recorded so the decision is not
lost.
@@ -274,8 +281,15 @@ deferred item from the roadmap.
reporters are arbitrary third parties and the mailbox address is published in
DNS. The ingest already constrains the meaningful part — a report cannot be
filed under a domain this instance does not host, and the claimed domain is
- cross-checked against the `+tag` of the delivery address — and the data is
- advisory statistics only; nothing enforces off it. The trigger to revisit is
+ cross-checked against the `+tag` of the delivery address (effective since
+ 2.0.0: before it the recipient never reached the command) — and the data is
+ advisory statistics only; nothing enforces off it. What a stranger can do is
+ limited to a domain that chose a SelfPost-hosted address, through that
+ address: file reports under it, replace one whose reporter and id they know,
+ and fill that domain's 500 — not another domain's. A message that is not a
+ report the relay keeps is dropped, not bounced (the envelope sender is the
+ author's to write); a genuine report the parser cannot read is lost the same
+ way, with a count and a line in the mail log. The trigger to revisit is
any feature that lets report contents drive an automatic action (policy
changes, rate limiting, alerting an operator into a config change).
- **The application auth-IP allow-list is enforced fail-open.** The check runs
diff --git a/internal/dmarc/bounds_test.go b/internal/dmarc/bounds_test.go
new file mode 100644
index 0000000..814b3c3
--- /dev/null
+++ b/internal/dmarc/bounds_test.go
@@ -0,0 +1,109 @@
+package dmarc
+
+import (
+ "errors"
+ "strings"
+ "testing"
+ "time"
+
+ "github.com/mixeme/selfpost/internal/store"
+)
+
+func reportXML(orgName, domain, records string) string {
+ return `` + orgName +
+ `a@example.net1` +
+ `17235936001723680000` +
+ `` + domain + `none
` + records + ``
+}
+
+const oneRecord = `203.0.113.103` +
+ `nonepasspass
` +
+ `example.com`
+
+// The XML is a stranger's: what it may make the relay store is bounded.
+func TestParseAggregateBoundsWhatAReportHolds(t *testing.T) {
+ long := strings.Repeat("é", 4000)
+ got, err := ParseAggregate([]byte(reportXML(long, "example.com", oneRecord)))
+ if err != nil {
+ t.Fatal(err)
+ }
+ if len(got.Reporter) > maxFieldLen || !strings.HasPrefix(long, got.Reporter) || got.Reporter == "" {
+ t.Fatalf("reporter name is %d bytes, want the start of the name in at most %d", len(got.Reporter), maxFieldLen)
+ }
+ if strings.ContainsRune(got.Reporter, '�') {
+ t.Fatal("the name was cut in the middle of a character")
+ }
+
+ huge := `203.0.113.109223372036854775807` +
+ `pass
`
+ got, err = ParseAggregate([]byte(reportXML("r", "example.com", huge+huge)))
+ if err != nil {
+ t.Fatal(err)
+ }
+ if got.PassCount != 2*maxRecordCount {
+ t.Fatalf("pass count = %d, want two records clamped to %d each", got.PassCount, maxRecordCount)
+ }
+
+ if _, err := ParseAggregate([]byte(reportXML("r", "example.com", strings.Repeat(oneRecord, maxReportRecords)))); err != nil {
+ t.Fatalf("a report of %d records was refused: %v", maxReportRecords, err)
+ }
+ if _, err := ParseAggregate([]byte(reportXML("r", "example.com", strings.Repeat(oneRecord, maxReportRecords+1)))); err == nil {
+ t.Fatalf("a report of %d records was accepted", maxReportRecords+1)
+ }
+}
+
+// A report over the bound is one the relay does not keep: dropped, not retried.
+func TestIngestMessageRejectsAReportWithTooManyRecords(t *testing.T) {
+ st, err := store.Open(t.TempDir() + "/test.db")
+ if err != nil {
+ t.Fatal(err)
+ }
+ defer st.Close()
+ if _, err := st.AddDomain("example.com", "selfpost"); err != nil {
+ t.Fatal(err)
+ }
+ xml := reportXML("r", "example.com", strings.Repeat(oneRecord, maxReportRecords+1))
+ err = IngestMessage(st, strings.NewReader(gzipMessage(t, xml)), "dmarc-reports+example.com@mail.example.com", time.Now().UTC())
+ if !errors.Is(err, ErrRejected) {
+ t.Fatalf("err = %v, want ErrRejected", err)
+ }
+}
+
+// Reports filed under one domain do not push another domain's reports out.
+func TestIngestKeepsEachDomainsReportsApart(t *testing.T) {
+ st, err := store.Open(t.TempDir() + "/test.db")
+ if err != nil {
+ t.Fatal(err)
+ }
+ defer st.Close()
+ now := time.Now().UTC()
+ if _, err := st.InsertDMARCReport(store.DMARCReport{
+ Domain: "quiet.example", Reporter: "genuine", ReportID: "1", PeriodBegin: now, PeriodEnd: now, ReceivedAt: now.Add(-time.Hour),
+ }); err != nil {
+ t.Fatal(err)
+ }
+ for i := 0; i < store.DMARCReportsMaxKeep+20; i++ {
+ if _, err := st.InsertDMARCReport(store.DMARCReport{
+ Domain: "flooded.example", Reporter: "stranger", ReportID: strings.Repeat("x", 1+i), PeriodBegin: now, PeriodEnd: now, ReceivedAt: now,
+ }); err != nil {
+ t.Fatal(err)
+ }
+ }
+ if err := st.PruneDMARCReports("flooded.example"); err != nil {
+ t.Fatal(err)
+ }
+ quiet, err := st.ListDMARCReports(store.DMARCReportScope{Domains: []string{"quiet.example"}}, 10)
+ if err != nil {
+ t.Fatal(err)
+ }
+ if len(quiet) != 1 {
+ t.Fatalf("the other domain has %d reports after the flood, want its 1", len(quiet))
+ }
+ flooded, err := st.ListDMARCReports(store.DMARCReportScope{Domains: []string{"flooded.example"}}, 10000)
+ if err != nil {
+ t.Fatal(err)
+ }
+ if len(flooded) > store.DMARCReportsMaxKeep {
+ t.Fatalf("the flooded domain keeps %d reports, want at most %d", len(flooded), store.DMARCReportsMaxKeep)
+ }
+}
diff --git a/internal/dmarc/ingest.go b/internal/dmarc/ingest.go
index 39ac310..e855834 100644
--- a/internal/dmarc/ingest.go
+++ b/internal/dmarc/ingest.go
@@ -84,7 +84,7 @@ func IngestMessage(st *store.Store, r io.Reader, recipient string, receivedAt ti
if _, err := st.InsertDMARCReport(rep); err != nil {
return err
}
- return st.PruneDMARCReports()
+ return st.PruneDMARCReports(rep.Domain)
}
// checkReportDomain refuses a report whose policy domain is not one of this
diff --git a/internal/dmarc/parse.go b/internal/dmarc/parse.go
index 080a6e2..5db3e85 100644
--- a/internal/dmarc/parse.go
+++ b/internal/dmarc/parse.go
@@ -9,6 +9,7 @@ import (
"io"
"strings"
"time"
+ "unicode/utf8"
)
// ParsedReport is the structured form of a DMARC aggregate XML payload.
@@ -74,6 +75,31 @@ type feedbackXML struct {
} `xml:"record"`
}
+// What a report may hold. The XML comes from anyone who knows a report address,
+// and eight megabytes of it (maxAggregateXML) fit some 160 000 empty records or
+// one name of eight megabytes - every one of them a row or a table cell later.
+// A real report has tens of records, a few thousand from the largest
+// receivers, and no field longer than a line.
+const (
+ maxReportRecords = 5000
+ maxFieldLen = 255
+ maxRecordCount = 1_000_000_000
+)
+
+// field trims a text value of the report and cuts it to maxFieldLen bytes, on
+// a character boundary.
+func field(s string) string {
+ s = strings.TrimSpace(s)
+ if len(s) <= maxFieldLen {
+ return s
+ }
+ s = s[:maxFieldLen]
+ for len(s) > 0 && !utf8.ValidString(s) {
+ s = s[:len(s)-1]
+ }
+ return s
+}
+
// ParseAggregate decodes gzip- or zip-compressed, or raw, DMARC aggregate XML.
func ParseAggregate(raw []byte) (ParsedReport, error) {
data, err := decompress(raw)
@@ -87,34 +113,43 @@ func ParseAggregate(raw []byte) (ParsedReport, error) {
if doc.Metadata.ReportID == "" || doc.Policy.Domain == "" {
return ParsedReport{}, fmt.Errorf("dmarc xml: missing report_id or domain")
}
+ if len(doc.Records) > maxReportRecords {
+ return ParsedReport{}, fmt.Errorf("dmarc xml: %d records, more than the %d a report may hold", len(doc.Records), maxReportRecords)
+ }
+ // Cut, not refused: a domain name is at most 253 bytes, so a longer one
+ // names nothing this relay sends for and is turned away as such.
out := ParsedReport{
- Reporter: strings.TrimSpace(doc.Metadata.OrgName),
- ReportID: strings.TrimSpace(doc.Metadata.ReportID),
- ContactEmail: strings.TrimSpace(doc.Metadata.Email),
+ Reporter: field(doc.Metadata.OrgName),
+ ReportID: field(doc.Metadata.ReportID),
+ ContactEmail: field(doc.Metadata.Email),
PeriodBegin: time.Unix(doc.Metadata.DateRange.Begin, 0).UTC(),
PeriodEnd: time.Unix(doc.Metadata.DateRange.End, 0).UTC(),
- Domain: strings.ToLower(strings.TrimSpace(doc.Policy.Domain)),
- PolicyP: strings.TrimSpace(doc.Policy.P),
- PolicySP: strings.TrimSpace(doc.Policy.SP),
+ Domain: strings.ToLower(field(doc.Policy.Domain)),
+ PolicyP: field(doc.Policy.P),
+ PolicySP: field(doc.Policy.SP),
PolicyPct: doc.Policy.Pct,
- PolicyADKIM: strings.TrimSpace(doc.Policy.ADKIM),
- PolicyASPF: strings.TrimSpace(doc.Policy.ASPF),
+ PolicyADKIM: field(doc.Policy.ADKIM),
+ PolicyASPF: field(doc.Policy.ASPF),
}
if out.PolicyPct == 0 {
out.PolicyPct = 100
}
for _, rec := range doc.Records {
row := ParsedRecord{
- SourceIP: strings.TrimSpace(rec.Row.SourceIP),
+ SourceIP: field(rec.Row.SourceIP),
Count: rec.Row.Count,
- Disposition: strings.TrimSpace(rec.Row.Policy.Disposition),
- SPFResult: strings.TrimSpace(rec.Row.Policy.SPF),
- DKIMResult: strings.TrimSpace(rec.Row.Policy.DKIM),
- HeaderFrom: strings.TrimSpace(rec.Identifiers.HeaderFrom),
+ Disposition: field(rec.Row.Policy.Disposition),
+ SPFResult: field(rec.Row.Policy.SPF),
+ DKIMResult: field(rec.Row.Policy.DKIM),
+ HeaderFrom: field(rec.Identifiers.HeaderFrom),
}
if row.Count <= 0 {
row.Count = 1
}
+ // Bounded so that the sums of a report cannot wrap around.
+ if row.Count > maxRecordCount {
+ row.Count = maxRecordCount
+ }
if dmarcRecordPasses(row) {
out.PassCount += row.Count
} else {
@@ -172,12 +207,12 @@ func unzip(raw []byte) ([]byte, error) {
}
rc, err := f.Open()
if err != nil {
- return nil, fmt.Errorf("dmarc zip open %s: %w", f.Name, err)
+ return nil, fmt.Errorf("dmarc zip open %q: %w", field(f.Name), err)
}
data, err := io.ReadAll(io.LimitReader(rc, maxAggregateXML))
rc.Close()
if err != nil {
- return nil, fmt.Errorf("dmarc zip read %s: %w", f.Name, err)
+ return nil, fmt.Errorf("dmarc zip read %q: %w", field(f.Name), err)
}
return data, nil
}
diff --git a/internal/store/dmarc.go b/internal/store/dmarc.go
index c86fdc4..e57f120 100644
--- a/internal/store/dmarc.go
+++ b/internal/store/dmarc.go
@@ -131,14 +131,18 @@ func (s *Store) InsertDMARCReport(rep DMARCReport) (int64, error) {
return id, nil
}
-// PruneDMARCReports enforces count and age caps.
-func (s *Store) PruneDMARCReports() error {
+// PruneDMARCReports enforces the age cap for every domain and the count cap
+// for domain. The count is kept per domain on purpose: reports are accepted
+// from anyone who knows a domain's report address, and with one cap for the
+// whole instance a stranger filing reports under one domain would push every
+// other domain's reports out.
+func (s *Store) PruneDMARCReports(domain string) error {
cutoff := time.Now().UTC().AddDate(0, 0, -DMARCReportsMaxAgeDays).Format(time.RFC3339)
if _, err := s.db.Exec(`DELETE FROM dmarc_reports WHERE received_at < ?`, cutoff); err != nil {
return fmt.Errorf("prune dmarc by age: %w", err)
}
var count int
- if err := s.db.QueryRow(`SELECT COUNT(*) FROM dmarc_reports`).Scan(&count); err != nil {
+ if err := s.db.QueryRow(`SELECT COUNT(*) FROM dmarc_reports WHERE domain = ?`, domain).Scan(&count); err != nil {
return fmt.Errorf("count dmarc reports: %w", err)
}
if count <= DMARCReportsMaxKeep {
@@ -147,8 +151,8 @@ func (s *Store) PruneDMARCReports() error {
excess := count - DMARCReportsMaxKeep
_, err := s.db.Exec(`
DELETE FROM dmarc_reports WHERE id IN (
- SELECT id FROM dmarc_reports ORDER BY received_at ASC LIMIT ?
- )`, excess)
+ SELECT id FROM dmarc_reports WHERE domain = ? ORDER BY received_at ASC LIMIT ?
+ )`, domain, excess)
if err != nil {
return fmt.Errorf("prune dmarc by count: %w", err)
}
diff --git a/internal/store/dmarc_test.go b/internal/store/dmarc_test.go
index c33ef3e..ce2654a 100644
--- a/internal/store/dmarc_test.go
+++ b/internal/store/dmarc_test.go
@@ -58,7 +58,7 @@ func TestPruneDMARCReports(t *testing.T) {
t.Fatal(err)
}
}
- if err := st.PruneDMARCReports(); err != nil {
+ if err := st.PruneDMARCReports("example.com"); err != nil {
t.Fatal(err)
}
list, _ := st.ListDMARCReports(DMARCReportScope{AllDomains: true}, 100)
diff --git a/internal/web/handlers/handlers_dmarc_pages_test.go b/internal/web/handlers/handlers_dmarc_pages_test.go
index 4d3809a..b64a34a 100644
--- a/internal/web/handlers/handlers_dmarc_pages_test.go
+++ b/internal/web/handlers/handlers_dmarc_pages_test.go
@@ -49,7 +49,7 @@ func TestDMARCHubShowsIngestAndRecentReports(t *testing.T) {
body := getBody(t, s.h.HandleDMARCList, "/outbound/dmarc")
has(t, "hub", body,
`DMARC reports
`, `Ingest
`, `ok`,
- `1 kept · 0 parse failures`, `Hosted addresses`, `dmarc-reports+<domain>@mail.example.org`, `500 reports or 90 days`,
+ `1 kept · 0 parse failures`, `Hosted addresses`, `dmarc-reports+<domain>@mail.example.org`, `500 reports a domain or 90 days`,
`Recent reports
`, `example.org`, `Outlook.com`,
"1\u00a0903 | ", `7`, `href="/outbound/dmarc/reports/`+idStr(s.reportID)+`">View`)
lacks(t, "hub", body, `None yet`)
diff --git a/internal/web/view/dmarc.go b/internal/web/view/dmarc.go
index 032a73d..2aa75cf 100644
--- a/internal/web/view/dmarc.go
+++ b/internal/web/view/dmarc.go
@@ -113,7 +113,7 @@ func NewDMARCHub(m Meta, in IngestInput) *DMARCHub {
last,
{Label: "This week", Value: Plain(FormatCount(int64(in.KeptThisWeek)) + " kept · " + plural(int64(in.ParseFailures), "parse failure", "parse failures"))},
{Label: "Hosted addresses", Value: Plain(in.Hosted), Mono: true, Small: true},
- {Label: "Retention", Value: Plain(FormatCount(int64(in.RetentionMax)) + " reports or " + plural(int64(in.RetentionDays), "day", "days"))},
+ {Label: "Retention", Value: Plain(FormatCount(int64(in.RetentionMax)) + " reports a domain or " + plural(int64(in.RetentionDays), "day", "days"))},
},
Recent: Box{No: "02", Title: "Recent reports"},
Empty: EmptyState{Icon: "ti-report-analytics", Text: Plain("No reports yet.")},
diff --git a/internal/web/view/dmarc_test.go b/internal/web/view/dmarc_test.go
index a8f6a3e..1975897 100644
--- a/internal/web/view/dmarc_test.go
+++ b/internal/web/view/dmarc_test.go
@@ -12,7 +12,7 @@ func TestDMARCHubShowsIngestAndTheLatestReports(t *testing.T) {
pageHas(t, "DMARC reports", out,
`DMARC reports
`, `rua=`,
`Ingest
`, `ok`,
- `2026-09-21 06:12 UTC`, `14 kept · 0 parse failures`, `Hosted addresses`, `dmarc-reports+<domain>@mail.example.org`, `500 reports or 90 days`,
+ `2026-09-21 06:12 UTC`, `14 kept · 0 parse failures`, `Hosted addresses`, `dmarc-reports+<domain>@mail.example.org`, `500 reports a domain or 90 days`,
`Received, UTC | `, `09-21 06:12`, `example.org`,
"1 903 | ", `7`, `0 | View`,
)
diff --git a/test/e2e/port25_config_check.go b/test/e2e/port25_config_check.go
index a4e063c..25905fd 100644
--- a/test/e2e/port25_config_check.go
+++ b/test/e2e/port25_config_check.go
@@ -34,7 +34,7 @@ type port25Case struct {
// flags=, user= and argv= are arguments of pipe(8); set as -o parameters they
// are dropped, and a bare "pipe" dies on every report with "fatal: missing
// user= command-line attribute" - the state of 1.7.0 through 1.9.5.
-const ingestService = "dmarc-ingest unix - n n - - pipe flags=Rq user=panel argv=/usr/local/bin/dmarc-ingest ${recipient}"
+const ingestService = "dmarc-ingest unix - n n - 1 pipe flags=Rq user=panel argv=/usr/local/bin/dmarc-ingest ${recipient}"
var port25Cases = []port25Case{
{
|