ExchangeDefender

DMARC Documentation

Operator guidance for mailbox setup, report intake, and DMARC alert interpretation.

Mailbox Requirements

Use secure IMAP with host, username, and password only. Doctor assumes secure port handling and polls each configured domain mailbox independently.

Supported Report Formats

The ingestion pipeline accepts DMARC aggregate reports delivered as XML, ZIP, or GZ attachments and keeps only normalized parsed data after processing.

Alert Semantics

Notifications reuse the shared Doctor notification workflows and can alert on mailbox failures, domain mismatch reports, new unknown sources, failing volume spikes, and uncovered legitimate senders.

Trust Guidance

Analytics only include domains with working DMARC mailbox intake. If a mailbox becomes inactive, the dashboard stays visible historically but warns that fresh analytics may be incomplete.