Check out my open-source tool to parse and visualize DMARC reports.

DMARC aggregate reports are useless as XML. You need to parse them to see where your money is going. I built a CLI tool for this.

It extracts key cost and security data:
* **Volume & Sources**: Total message count, sending IPs, and domains.
* **Disposition Breakdown**: Percentages passing (`pct`), failing SPF/DKIM, and going to quarantine/reject.
* **Forwarder Identification**: Highlights domains like `yahoo.com`, `outlook.com` that forward mail and break alignment.

Output is JSON for piping into other tools, or a summary table. Install via pip.

```bash
pip install dmarcparse
dmarcparse -f report.xml
```

Example output for a domain with forwarding issues:

```json
{
"report_metadata": { "org": "example.com", "date_range": {"begin": 1682899200, "end": 1682985600} },
"policy_published": { "domain": "yourdomain.com", "p": "quarantine", "sp": "reject", "pct": 100 },
"records": [
{
"source_ip": "203.0.113.10",
"count": 12500,
"disposition": "quarantine",
"dkim": "fail",
"spf": "pass",
"header_from": "yourdomain.com",
"dkim_domain": "yahoo.com",
"reason": "forwarded_by_yahoo"
}
]
}
```

The tool shows you exactly which traffic isn't authenticating. If you're paying for an ESP that sends through forwarders, you're paying for emails that land in spam.