Add-ons
DMARC Report Analyzer 1.0.7
by Shota
Analyze DMARC aggregate and forensic reports locally within Thunderbird. Visualize authentication results per domain, classify source IPs, detect threats, track DKIM/SPF/envelope alignment, and export data. Fully offline with zero network requests.
About this Add-on
Your DMARC reports are telling you something. This add-on helps you listen.
DMARC Report Analyzer analyzes aggregate (RFC 7489) and forensic (RFC 6591) reports entirely within Thunderbird. No data leaves your machine. No DNS credentials required. No SaaS subscriptions.
Dashboard
Threat Detection
Deep Analysis
Operational
Privacy and Internationalization
DMARC Report Analyzer analyzes aggregate (RFC 7489) and forensic (RFC 6591) reports entirely within Thunderbird. No data leaves your machine. No DNS credentials required. No SaaS subscriptions.
Dashboard
- Full-tab dashboard with 8-stat summary per domain
- Pie charts: domain distribution, disposition breakdown (4 categories), reporter distribution
- Time series: disposition trends with 4 lines (Delivered Auth OK/Fail, Quarantined, Rejected) and automatic daily/weekly/monthly aggregation
- Collapsible domain sections with Expand All / Collapse All
- Period comparison with rate-based change indicators and polarity-aware coloring
- Scan period memory across sessions
Threat Detection
- IP range classification based on DMARC authentication (DKIM or SPF pass): Legitimate / Blocked / Threat (Unblocked)
- Adaptive IP aggregation (automatic /16 merging)
- Domain health badges with specific reasons: Healthy / Under Attack / Needs Attention / At Risk
- Alignment mismatch info displayed alongside health badges
- Delivered (Auth Fail) — the most critical metric: emails where neither DKIM nor SPF passed, yet were delivered
Deep Analysis
- DKIM signature analysis with third-party detection
- SPF domain analysis with mfrom/helo scope tracking
- Envelope alignment: Header From vs Envelope From mismatch detection
- Subdomain authentication tracking
- Policy override details with IP range attribution
- Policy recommendations for p=none to p=reject migration, with alignment mismatch notes
Operational
- Forensic report cross-reference grouped per domain
- CSV export with IP ranges, DKIM signatures, SPF domains, envelope mismatches, subdomains, and forensic reports
- Automatic folder detection by naming convention
- ISP compatibility: gzip-first detection, Microsoft XML fixes, zero-record handling
- Result caching across tab reopens
Privacy and Internationalization
- Zero network requests — all processing is 100% local
- Full dark mode following system preference
- 12 languages: English, Japanese, German, French, Spanish, Italian, Korean, Chinese (Simplified/Traditional), Portuguese (BR), Russian, Arabic
