DMARC XML report analyzer

What a DMARC aggregate report actually is

Every domain publishing DMARC with an rua= address receives periodic XML reports from receiving mail providers, each one summarizing what happened to mail claiming to be from that domain over roughly a day - which source IPs sent it, whether SPF and DKIM passed, and what disposition (none/quarantine/reject) was applied. Raw, this is dense machine-readable XML nobody reads directly; this tool turns it into a plain summary.

What is shown

• Report metadata - the sending mailbox provider, the date range covered
• Total messages, SPF pass count, DKIM pass count, and fully-aligned count (both passing)
• Top sending source IPs by message volume
• Every individual row, exportable to CSV

Handling files from strangers, safely

A DMARC report analyzer exists specifically to accept files other people's mail servers generated, which makes it a genuine target for malicious input - handled accordingly: XML is parsed with DTD processing and external entity resolution disabled (no XXE, no entity-expansion bombs); a ZIP's entries are checked against size and count limits using their declared size before anything is decompressed, which is what actually stops a zip bomb rather than merely limiting how long extracting one takes; entry names containing path-traversal sequences are rejected. Nothing uploaded is ever written to disk - it is processed in memory for the duration of one request and discarded.

Limitations

This reads the standard aggregate-report (RUA) schema; a report in an unexpected shape is reported as unparsable rather than guessed at. Forensic (RUF) reports use a different format and are not covered.