DMARC

This simple tool helps to decode and analyze DMARC reports on the command line. Its primary goal is not to replace other tools that create metrics for monitoring systems.

Usage

Dmarc accepts a list of files (.zip, .gz, .eml, .mbox) containing aggregated DMARC reports in XML format.

Structure of a DMARC report

This is the XML report converted into JSON:

{
    "XMLName": {
        "Space": "",
        "Local": "feedback"
    },
    "Metadata": {
        "OrgName": "MAILIN11.telekom.de",
        "Email": "MAILER-DAEMON@MAILIN11.telekom.de",
        "ExtraContactInfo": "",
        "ReportID": "99c3d5$fffc9ac=fbecf05f20c12bbf@MAILIN11.telekom.de",
        "DateRange": {
            "begin": "2023-06-04T00:00:03+02:00",
            "end": "2023-06-05T00:00:04+02:00"
        }
    },
    "PolicyPublished": {
        "Domain": "example.com",
        "ADKIM": "r",
        "ASPF": "r",
        "Policy": "none",
        "SPolicy": "",
        "Percentage": 100
    },
    "Records": [
        {
            "Row": {
                "SourceIP": "91.208.68.56",
                "Count": 11,
                "PolicyEvaluated": {
                    "Disposition": "none",
                    "DKIM": "pass",
                    "SPF": "fail"
                }
            },
            "Identifiers": {
                "HeaderFrom": "example.com"
            },
            "AuthResults": {
                "DKIM": {
                    "Domain": "example.com",
                    "Result": "pass",
                    "Selector": "smg20230530"
                },
                "SPF": {
                    "Domain": "lima.example.com",
                    "Result": "none",
                    "Scope": "helo"
                }
            }
        },
        {
            "Row": {
                "SourceIP": "91.208.68.57",
                "Count": 12,
                "PolicyEvaluated": {
                    "Disposition": "none",
                    "DKIM": "pass",
                    "SPF": "fail"
                }
            },
            "Identifiers": {
                "HeaderFrom": "example.com"
            },
            "AuthResults": {
                "DKIM": {
                    "Domain": "example.com",
                    "Result": "pass",
                    "Selector": "smg20230530"
                },
                "SPF": {
                    "Domain": "victor.example.com",
                    "Result": "none",
                    "Scope": "helo"
                }
            }
        }
    ]
}