Automate DMARC report processing with Telegram alerts

Why DMARC reports matter

If you've set up DMARC for your domain (you should), email providers like Google, Microsoft, and Fastmail send you regular aggregate reports. These reports tell you which servers are sending email on behalf of your domain — and whether they're passing SPF and DKIM authentication.

The problem? These reports arrive as XML files compressed inside .gz or .zip attachments. Nobody opens them. They pile up in your inbox until something goes wrong — a spoofing attempt, a misconfigured mail server, a broken DKIM key — and by then it's too late.

This flow turns those ignored attachments into actionable Telegram alerts.

How it works

What you'll need

Step 1: Set up the DMARC email alias

Create an alias in EmailConnect for your DMARC reports — something like dmarc@in.yourdomain.com. Point it at an n8n webhook URL. Then update your domain's DMARC DNS record to send reports to this address:

v=DMARC1; p=quarantine; rua=mailto:dmarc@in.yourdomain.com; pct=100

Email providers that support DMARC (Google, Microsoft, Yahoo, Fastmail, etc.) will now send their aggregate reports to your EmailConnect alias.

Step 2: Enable zlib in n8n

The DMARC flow needs Node.js's built-in zlib module to decompress .gz and .zip attachments. Since n8n v2, Code nodes run in a sandboxed environment that blocks access to built-in modules by default. You need to explicitly allow it.

Main n8n container (docker-compose.yml)

Add the environment variable to your n8n service:

environment:
  - NODE_FUNCTION_ALLOW_BUILTIN=crypto,zlib

n8n runner container (n8n-task-runners.json)

The runner process has its own restricted environment. Add zlib to the env-overrides in your task runners config:

{
  "env-overrides": {
    "NODE_FUNCTION_ALLOW_BUILTIN": "crypto,zlib",
    "NODE_FUNCTION_ALLOW_EXTERNAL": "moment"
  }
}

Step 3: Build the n8n workflow

The flow is compact — just 6 nodes. The heavy lifting happens in a single Code node that handles decompression, XML parsing, and Telegram message formatting.

The complete n8n workflow — Webhook → Download → Parse → Store + Alert

Node-by-node walkthrough

What the Telegram alert looks like

At a glance you see: which domain, who reported, how many messages, and which sources are failing. The failure with 3 messages from an unknown IP? That's either a misconfigured server or someone trying to spoof your domain. Either way, you want to know about it.

How we use it at EmailConnect

We run this exact flow on dmarc@emailconnect.eu. Every DMARC report from Google, Microsoft, Yahoo, Fastmail, and others gets automatically processed. The data table gives us a historical view of our email authentication health, and the Telegram alerts flag anything unusual immediately.

Before this flow, DMARC reports were piling up unread. Now we catch misconfigurations and spoofing attempts within hours of the report being generated.

Tips and considerations

The attachment processing angle

This flow demonstrates something useful about EmailConnect beyond DMARC: it handles attachment-heavy emails well. The attachment download URLs are stable, authenticated, and work from any HTTP client. The same pattern works for processing invoices, extracting data from PDFs, or handling any email workflow where the attachment is the payload.

Questions about setting up DMARC monitoring? Reach out at hello@emailconnect.eu.