ParseDMARC is an open-source, self-hosted DMARC report analyzer. To generate visualized data, ParseDMARC relies on Elasticsearch and Kibana, both of which are RAM hungry in the default configuration. Elasticsearch is written in JAVA and JVM’s RAM usage can be configured in /usr/local/etc/elasticsearch/jvm.options

Installing ParseDMARC and GeoIP

Please following commands:

# pkg install python38-pip geoipupdate

Maxmind, the creator of the widely used GeoIP database requires you to create an account and get an API key to update the local installed database. Please go to https://www.maxmind.com/en/home in order to create your account.

As ParseDMARC is a python module, please install it with:

# pip install parsedmarc

Installing Elasticsearch and Kibana

Simply use following install commands:

# pkg install elasticsearch kibana7

After installation adopt your RAM usage in the /usr/local/etc/elasticsearch/jvm.options file, right at the top.

Now let’s make the two start at boot time:

# sysrc elasticsearch_enable="YES"
# sysrc kibana_enable="YES"

and start them right away:

# service elasticsearch start
# service kibana start

Installing NginX

# pkg install nginx

After installation you need to proxy pass to the kibana interface. Change /usr/local/etc/nginx/nginx.conf:

...
location / {
    proxy_pass http://127.0.0.1:5601;
    proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
}
...

Find the line “location /” and replace the content with the above lines.

Now start nginx at boot and immediately:

# sysrc nginx_enable="YES"
# service nginx start

Configuring ParseDMARC

Create following config /usr/local/etc/parsedmarc.ini

[general]
# Save aggregate and forensic reports to Elasticsearch
save_aggregate = True
save_forensic = True

[imap]
# Log into the DMARC report email address and download data.
host = mail.yourdomain.com
port = 993
ssl = True
user = dmarc@yourdomain.com
password = your_password_here
watch = False

[elasticsearch]
# Send data to Elastichsearch, which listens on port 9200.
hosts = 127.0.0.1:9200
ssl = False

[smtp]
# For sending email
host = mail.yourdomain.com
port = 587
ssl = True
user = dmarc@yourdomain.com
password = your_password_here
from = dmarc@yourdomain.com

# send results to this address
to = admin@yourdomain.com

and run the script:

parsedmarc -c /usr/local/etc/parsedmarc.ini

WARNING: the specified inbox will be emptied when the script is running! Be aware.

Configuring geoipupdate

As stated at the beginning of this tutorial, pleaase create a Maxmind account to get an account ID and API key. Now edit /usr/local/etc/GeoIP.conf and your personal datat in there and run:

# geoipupdate -v

Keeping data up to date

Last but not least, you need to create cron jobs for updating DMARC data and the GeoIP database. Please refer to the CRON documentation on FreeBSD for that purpose.