DMARC Email Worker

该介绍目前仅提供英文版本。

A sophisticated Cloudflare Worker script designed to process incoming DMARC reports, store them securely, and generate comprehensive analytics. This solution leverages the power of Cloudflare’s edge computing platform to provide real-time email security monitoring.

Key Features

• Automated DMARC Processing:

  • Real-time DMARC report parsing
  • XML report decompression and analysis
  • Automatic data extraction and validation

• Cloudflare Platform Integration:

  • Cloudflare Workers for edge processing
  • Email Workers for message handling
  • R2 storage for report archival
  • Worker Analytics for data insights

• Security Analytics:

  • Domain authentication monitoring
  • SPF and DKIM evaluation tracking
  • Policy enforcement reporting
  • Source IP analysis

• Enterprise Ready:

  • Scalable processing architecture
  • Built-in error handling
  • Comprehensive logging
  • Production-grade performance

Quick Start

Prerequisites

• Cloudflare account with Workers enabled
• Email Routing configured
• R2 bucket for storage
• Worker Analytics dataset

Installation Steps

1. Clone the Repository:

git clone https://github.com/cloudflare/dmarc-email-worker.git
cd dmarc-email-worker

2. Install Dependencies:

npm install

3. Configure Wrangler:

npx wrangler login

4. Update Configuration:

   • Edit wrangler.toml with your R2 bucket names
   • Configure Worker Analytics dataset

5. Deploy Worker:

npx wrangler publish

6. Setup Email Routing:
   • Configure Email Routing rule to forward DMARC reports
   • Point your domain’s DMARC RUA record to the worker

Configuration

DMARC Record Setup

Add the worker address to your domain’s DMARC record:

_dmarc.yourdomain.com TXT "v=DMARC1; p=quarantine; rua=mailto:[email protected]"

Worker Environment

Configure the following in wrangler.toml:

[env.production]
name = "dmarc-email-worker"

[[env.production.r2_buckets]]
binding = "DMARC_BUCKET"
bucket_name = "your-dmarc-reports"

[env.production.analytics_engine_datasets]
binding = "DMARC_ANALYTICS"
dataset = "dmarc_reports"

Data Analytics

Query DMARC Reports

Access your DMARC data using the Cloudflare Analytics Engine API:

curl -X POST 'https://api.cloudflare.com/client/v4/accounts/<account_id>/analytics_engine/sql' \
-H 'Authorization: Bearer <token>' \
-d 'SELECT * FROM dmarc_reports WHERE timestamp > NOW() - INTERVAL 24 HOUR'

Available Metrics

• Report Metadata: Report ID, organization, date ranges
• Policy Information: Domain policies, alignment settings
• Authentication Results: DKIM/SPF evaluation results
• Source Analysis: IP addresses, message counts
• Disposition Tracking: Policy enforcement actions

Advanced Features

Report Processing

• Automatic Decompression: Handles gzipped XML reports
• Data Validation: Ensures report integrity
• Duplicate Detection: Prevents duplicate processing
• Error Recovery: Robust error handling and retry logic

Storage Management

• R2 Integration: Efficient report storage and retrieval
• Data Retention: Configurable retention policies
• Backup Support: Automatic report backup and archival

Monitoring Capabilities

• Real-time Processing: Immediate report analysis
• Performance Metrics: Processing time and success rates
• Alert Integration: Error notifications and monitoring
• Audit Trails: Comprehensive processing logs

Use Cases

• Email Security Monitoring: Track domain authentication compliance
• Phishing Detection: Identify unauthorized email sources
• Brand Protection: Monitor domain reputation and abuse
• Compliance Reporting: Generate security compliance reports
• Incident Response: Rapid security incident investigation

Architecture Benefits

• Edge Processing: Global deployment with low latency
• Serverless Scale: Automatic scaling based on demand
• Cost Effective: Pay-per-use pricing model
• High Availability: Built on Cloudflare’s reliable infrastructure

Requirements

• Cloudflare account with Workers plan
• Email Routing capability
• R2 storage bucket
• Worker Analytics access
• Domain with DMARC policy configured

Documentation

For detailed implementation guides and API documentation, visit:

• GitHub Repository
• Cloudflare Blog Post
• Workers Documentation

License

This project is licensed under the MIT License.