Configuration

The server loads YAML configuration from sc.yaml in its working directory. Set SC_CONFIG to use another path.

SC_CONFIG=/etc/sc/sc.yaml plackup -r server.psgi

Trusted boundary

trusted_boundary tells sc which receiving mail server marks the edge of your mail system. If configured, sc reports the public remote IP that handed mail to that boundary. This helps avoid reporting internal or downstream hops.

trusted_boundary:
  name: mx1.example.com
  domain: example.com
  cidrs:
    - 203.0.113.0/24
    - 2001:db8:1234::/48

If no trusted boundary is found, Received-header reports are skipped to reduce false positives. If trusted_boundary is not configured at all, sc preserves its older behavior of reporting every public IP it can parse from Received headers.

Cache backends

Abuse-contact lookups can be slow, so sc caches normalized CIDR results. The default memory backend is fine for local development and single-worker deployments.

cache:
  backend: memory
  namespace: sc:abuse-cache
  expiration_time: 3600

Use Redis or Memcached when multiple workers should share cached lookups.

cache:
  backend: redis
  namespace: sc:abuse-cache
  expiration_time: 3600
  redis:
    server: 127.0.0.1:6379

Link handling

ignored_link_hosts suppresses complaints for no-fault link hosts such as public font or JavaScript CDNs.

ignored_link_hosts:
  - fonts.googleapis.com
  - cdn.jsdelivr.net

url_shorteners_to_follow controls which short-link hosts are expanded before link reports are generated. Omit it to use built-in defaults, set it to [] to disable network shortener expansion, or add hosts to merge with the defaults.

url_shorteners_to_follow:
  - bit.ly
  - tinyurl.com

XARF and SMTP sending

The API can include XARF reports in responses. The server can also compose and send abuse report email when abuse_report is configured and the request explicitly includes {"abuse_report":{"send":true}}.

abuse_report:
  from: abuse-reports@example.com
  reply_to: abuse-reports@example.com
  subject_prefix: Spam abuse report

  xarf:
    reporter:
      org: Example Org
      contact: abuse-reports@example.com
      domain: example.com
    link_type: fraud

  smtp:
    host: smtp.example.com
    port: 587
    tls: starttls

Server-side sending is synchronous during the request. Individual recipient failures are reported per recipient in the response.