DMARC Report Analyzer

DMARC Report Analyzer is a tool written in Python that allows you to analyze all DMARC reports in a folder or inbox and generate a spreadsheet with the results.
I've forked a version and added^[1] various features, including more progress bars, an offline cache for the Spamhaus list of IPs, and an output CSV which includes more information that can be helpful when troubleshooting email authentication issues.

To install and use DMARC Report Analyzer, there is a helpful script in the Installation section to clone the repository to your local machine, create the local environment, install the requirements, and then run main.py. First, however, I recommend creating a scripts (or similar) folder somewhere to keep everything organized and then opening your Terminal from that folder.

The script expects you to have Python version 3 installed on your system and is currently written for Linux, but there is an option for Windows (which I haven't really tested).

If working on a Linux system, you will need to use a Python Virtual Environment to download and update the correct packages. This is easily managed with a shell script that performs the run/setup process.

#!/usr/bin/env bash
cd ~/scripts/DMARC-Report-Analyzer
# Optional
python3 -m venv env
source env/bin/activate
# Mandatory
pip install -r requirements.txt
python3 main.py

The final result is a spreadsheet with a summary of all of the reports it collected. You can use whois and grep to lookup the IP addresses to to find out where emails are coming from with the command whois [IP address] | grep "NetRange:\|CIDR:\|Organization:", and your output should look something like this:

DMARC Report Analyzer.png

DMARC Report Analyzer

DMARC Report Analyzer

Metadata

Sources

Tags