Skip to content

README.md

Latest commit

 

History

History
109 lines (69 loc) · 2.46 KB

README.md

File metadata and controls

109 lines (69 loc) · 2.46 KB
Raw

DMARC Visualizer

A Python-based tool to parse and visualize DMARC aggregate reports (XML format), helping domain owners monitor email authentication results over time.

📈 Features

  • Parses DMARC XML reports (from Google, Microsoft, etc.)
  • Visualizes:
    • DKIM/SPF pass/fail trends over time
    • Daily email volume by source (IP or hostname)
  • Groups trusted senders (e.g., Google, Microsoft) under a single label
  • Highlights anomalies and unknown sources
  • DNS reverse lookup for friendlier source labeling

🖥️ Requirements

  • Python 3.8+
  • The following Python packages:
    • pandas
    • matplotlib

To install the required packages (without admin access):

pip install --user pandas matplotlib

🧰 Setup

  1. Download or clone this repository.

  2. Put your DMARC XML reports in a folder (e.g., ~/Downloads/DMARC-Reports/).

  3. Run the script:

python dmarc_visualizer.py /path/to/DMARC-Reports

On Windows:

python dmarc_visualizer.py C:\Users\YourName\Downloads\DMARC-Reports

The script will:

  • Parse all .xml files in the folder
  • Reverse-lookup source IPs
  • Group known senders (e.g., Google.com)
  • Plot two charts:
    1. DKIM/SPF pass trend over time
    2. Email volume by source hostname per day

📊 Example Output

  • DKIM/SPF Trend Chart
    Shows how many emails passed authentication per day.

  • Source IP/Hostname Volume Chart
    A stacked bar chart showing how many emails each source sent per day.

🔐 Hostname Grouping

By default, the script groups well-known senders:

  • Any hostname ending in google.com → Google
  • Hostnames like *.outlook.com, *.hotmail.com, or containing microsoft → Microsoft

You can customize this logic in the reverse_dns() function.

💡 Tips

  • Use a cron job or Windows Task Scheduler to run the script weekly.
  • Export visualizations as PNGs or PDFs using plt.savefig() if needed.
  • Consider adding logging or email alerts for failed authentication patterns.

✅ Troubleshooting

  • Permission errors during pip install
    Use the --user flag as shown above.

  • Reverse DNS lookups are slow
    The script caches lookups using @lru_cache to avoid repeating them.

📄 License

MIT License – free for personal and commercial use.

✍️ Author

Developed by New Idea Machine.
For feedback or contributions, feel free to open an issue or submit a PR.