DMARC Visualizer

A Python-based tool to parse and visualize DMARC aggregate reports (XML format), helping domain owners monitor email authentication results over time.

📈 Features

• Parses DMARC XML reports (from Google, Microsoft, etc.)
• Visualizes:
  • DKIM/SPF pass/fail trends over time
  • Daily email volume by source (IP or hostname)
• Groups trusted senders (e.g., Google, Microsoft) under a single label
• Highlights anomalies and unknown sources
• DNS reverse lookup for friendlier source labeling

---

🖥️ Requirements

• Python 3.8+
• The following Python packages:
  • pandas
  • matplotlib

To install the required packages (without admin access):

pip install --user pandas matplotlib

---

🧰 Setup

1. Download or clone this repository.

2. Put your DMARC XML reports in a folder (e.g., ~/Downloads/DMARC-Reports/).

3. Run the script:

python dmarc_visualizer.py /path/to/DMARC-Reports

On Windows:

python dmarc_visualizer.py C:\Users\YourName\Downloads\DMARC-Reports

The script will:

• Parse all .xml files in the folder
• Reverse-lookup source IPs
• Group known senders (e.g., Google.com)
• Plot two charts:
  1. DKIM/SPF pass trend over time
  2. Email volume by source hostname per day

---

📊 Example Output

• DKIM/SPF Trend Chart
  Shows how many emails passed authentication per day.

• Source IP/Hostname Volume Chart
  A stacked bar chart showing how many emails each source sent per day.

---

🔐 Hostname Grouping

By default, the script groups well-known senders:

• Any hostname ending in google.com → Google
• Hostnames like *.outlook.com, *.hotmail.com, or containing microsoft → Microsoft

You can customize this logic in the reverse_dns() function.

---

💡 Tips

• Use a cron job or Windows Task Scheduler to run the script weekly.
• Export visualizations as PNGs or PDFs using plt.savefig() if needed.
• Consider adding logging or email alerts for failed authentication patterns.

---

✅ Troubleshooting

• Permission errors during pip install
  Use the --user flag as shown above.

• Reverse DNS lookups are slow
  The script caches lookups using @lru_cache to avoid repeating them.

---

📄 License

MIT License – free for personal and commercial use.

---

✍️ Author

Developed by New Idea Machine.
For feedback or contributions, feel free to open an issue or submit a PR.