DMARC Report Analyzer

Turn the DMARC aggregate reports that land in your inbox (XML, .gz and .zip attachments from Google, Microsoft, Yahoo and others) into a plain answer: who sends email as your domain, what passes, what would be blocked if you moved to p=quarantine or p=reject, and exactly which sender to fix.

python3 -m dmarcx ~/Downloads/dmarc-reports/ --csv reports       # a folder of .xml/.gz/.zip/.eml files
python3 -m dmarcx DMARC.mbox --domain example.com                  # a mail folder exported as mbox
python3 -m dmarcx reports/*.zip --json > dmarc.json

• Policy and pass rate: your published policy (p, sp, np, t / pct), messages per receiver and per day, and the share passing DMARC.
• Sources: every sender grouped by service (Google Workspace, Microsoft 365, Amazon SES, SendGrid, Mailgun, Mailchimp, Mandrill, SparkPost, Postmark, Zendesk, Salesforce, HubSpot, recognised by their signing and return-path domains) or by the domain they authenticate as, with DKIM- and SPF-aligned counts, IPs, selectors and what receivers did.
• Verdicts: ok, fix alignment (a service you use sends as you without your DKIM), unknown sender (authenticates only as itself: a tool you forgot, or spoofing), unauthorised or forwarded (passes nothing; forwarding and mailing lists flagged when the receiver says so).
• Findings: p=none still delivers spoofed mail, senders to fix before moving to quarantine/reject, SPF-only senders that break when forwarded, t=y test mode, pct (removed in DMARCbis), errors receivers reported, and when you're ready for a stricter policy.
• CSV (--csv DIR): sources.csv, records.csv (every row of every report) and daily.csv.

RFC 9990 (DMARCbis, May 2026, urn:ietf:params:xml:ns:dmarc-2.0: np, testing, discovery_method, generator) and the older RFC 7489 format; .xml, .xml.gz/.gz, .zip, .eml and .mbox; folders are read recursively. The same report delivered twice is counted once. Reports with DTDs or entities are refused, and decompressed reports are capped at 50 MB.

skills/dmarc-reports/SKILL.md tells Claude Code (or any agent that reads skills) how to run it and explain the results. Copy it into .claude/skills/; the kit is also a Claude Code plugin (.claude-plugin/plugin.json).

Run ./demo.sh for the example (3 reports, 2,473 messages, SendGrid not set up, a spoofer, a mailing list) and ./run_tests.sh for the tests. Python 3.9+, no dependencies, works offline (--rdns does DNS lookups).

It reads the reports receivers send; receivers that don't report (or report late) are missing. It shows what to fix, not how each service's DNS setup works: follow that provider's DKIM setup guide. It doesn't check your DNS records; use the free Email Auth Checker for SPF, DKIM and DMARC records.

Pairs with the free Email Auth Checker. License: LICENSE.txt.