DMARC Report Reader API

Turn DMARC aggregate reports (XML, .zip, .gz from Google, Microsoft, Yahoo) into JSON: senders by IP, SPF / DKIM alignment, pass rates and advice.

Parameters

Example

curl -X POST "https://apibox.io.vn/v1/dmarc-report" \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/xml" \
  --data-binary '<feedback>…<policy_published><domain>example.vn</domain><p>none</p>…</policy_published><record>…</record></feedback>'

const res = await fetch('https://apibox.io.vn/v1/dmarc-report', {
  method: 'POST',
  headers: {
    Authorization: 'Bearer YOUR_API_KEY',
    'Content-Type': 'application/xml',
  },
  body: "<feedback>…<policy_published><domain>example.vn</domain><p>none</p>…</policy_published><record>…</record></feedback>",
});
const data = await res.json();
console.log(data);

import requests

res = requests.post(
    "https://apibox.io.vn/v1/dmarc-report",
    headers={"Authorization": "Bearer YOUR_API_KEY", "Content-Type": "application/xml"},
    data="<feedback>…<policy_published><domain>example.vn</domain><p>none</p>…</policy_published><record>…</record></feedback>".encode(),
    timeout=30,
)
print(res.json())

<?php
$ch = curl_init('https://apibox.io.vn/v1/dmarc-report');
curl_setopt_array($ch, [
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_CUSTOMREQUEST => 'POST',
    CURLOPT_HTTPHEADER => ['Authorization: Bearer YOUR_API_KEY', 'Content-Type: application/xml'],
    CURLOPT_POSTFIELDS => '<feedback>…<policy_published><domain>example.vn</domain><p>none</p>…</policy_published><record>…</record></feedback>',
]);
$response = curl_exec($ch);
print_r(json_decode($response, true));

Response

{
  "reports_count": 1,
  "summary": {
    "messages": 123,
    "dmarc_pass": 120,
    "dmarc_fail": 3,
    "pass_rate": 97.56,
    "dkim_aligned_pass_rate": 97.56,
    "spf_aligned_pass_rate": 97.56,
    "dispositions": {
      "none": 123
    },
    "source_ips": 2,
    "policies": [
      "none"
    ],
    "domains": {
      "example.vn": {
        "messages": 123,
        "pass": 120,
        "fail": 3
      }
    },
    "date_range": {
      "begin": "2024-11-06T00:00:00.000Z",
      "end": "2024-11-06T23:59:59.000Z"
    },
    "reporters": [
      "google.com"
    ]
  },
  "advice": [
    "Policy is p=none: before enforcing, authorise (SPF) or sign (DKIM, aligned with the From domain) every legitimate source listed in failing_sources.",
    "1 source IP(s) sent mail that failed DMARC; check which are your own services (add them to SPF / set up DKIM) and which are spoofing."
  ],
  "sources": [
    {
      "source_ip": "209.85.220.41",
      "count": 120,
      "pass": 120,
      "fail": 0,
      "dkim_aligned_pass": 120,
      "spf_aligned_pass": 120,
      "header_from": [
        "example.vn"
      ],
      "dkim_domains": [
        "example.vn (google): pass"
      ],
      "spf_domains": [
        "example.vn: pass"
      ],
      "dispositions": {
        "none": 120
      },
      "pass_rate": 100
    },
    {
      "source_ip": "198.51.100.7",
      "count": 3,
      "pass": 0,
      "fail": 3,
      "dkim_aligned_pass": 0,
      "spf_aligned_pass": 0,
      "header_from": [
        "example.vn"
      ],
      "dkim_domains": [],
      "spf_domains": [
        "spammer.test: softfail"
      ],
      "dispositions": {
        "none": 3
      },
      "pass_rate": 0
    }
  ],
  "failing_sources": [
    {
      "source_ip": "198.51.100.7",
      "messages": 3,
      "header_from": [
        "example.vn"
      ]
    }
  ],
  "reports": [
    {
      "file": null,
      "format": "rfc7489",
      "reporter": {
        "org_name": "google.com",
        "email": "noreply-dmarc-support@google.com",
        "report_id": "1234567890"
      },
      "policy_published": {
        "domain": "example.vn",
        "p": "none",
        "sp": "none",
        "adkim": "r",
        "aspf": "r",
        "pct": 100
      },
      "records": [
        "…"
      ]
    }
  ]
}

Use cases

• Read the daily DMARC reports of a domain without a paid dashboard
• Find which services still send mail that fails SPF or DKIM before enforcing DMARC
• Spot spoofing sources sending as your domain
• Merge a month of reports from several providers into one summary

FAQ

Related APIs