Add-ons
DMARC Report Analyzer 1.1.0
зохиогч Shota
Analyze DMARC aggregate and forensic reports inside Thunderbird, fully offline, zero network requests. Source IP threat classification, DKIM/SPF deep analysis, domain health, policy advice, time series, and CSV/JSON export for mail administrators.
About this Add-on
DMARC Report Analyzer turns the DMARC aggregate and forensic reports that arrive in your mailbox into a readable dashboard, entirely inside Thunderbird. Nothing is uploaded: reports are decompressed and parsed locally, and the add-on makes no network requests of any kind.
What it shows
Source classification
Every sending IP range is classified into one of four categories, so you can tell a genuine spoofing attempt from your own misconfigured relay:
Additional tags mark third-party senders, forwarders, HELO-only SPF validation, and Envelope From / Header From mismatches that may indicate spoofing.
Authentication detail
Policy advice
Per-domain recommendations based on the policy each reporter observed:
Working with the data
Setup
Point the add-on at the folders where your aggregate and forensic reports arrive, or name them so they are detected automatically (for example DMARC/Aggregate and DMARC/Forensic). Forensic reports are optional.
Privacy
All processing happens on your machine. The add-on requests only what it needs to read the report messages:
Available in English, Japanese, German, French, Spanish, Italian, Korean, Simplified Chinese, Traditional Chinese, Brazilian Portuguese, Russian, and Arabic. Dark mode follows your system setting.
What it shows
- Eight headline metrics: total messages, delivered with authentication passing, delivered despite authentication failing, quarantined, rejected, DKIM+SPF pass, DKIM pass, and SPF pass
- A disposition breakdown, a disposition-over-time chart, and change indicators against the previous period
- Per-domain sections with a health badge (Healthy, Needs Attention, At Risk, Under Attack) and the reasons behind it
Source classification
Every sending IP range is classified into one of four categories, so you can tell a genuine spoofing attempt from your own misconfigured relay:
- Legitimate - everything authenticated and was delivered normally
- Misconfigured - the source holds valid signing keys, yet some mail still fails authentication
- Blocked - everything failed authentication and was rejected; your policy is doing its job
- Threat (Unblocked) - nothing from this source has ever passed DKIM+SPF, yet some mail was delivered anyway
Additional tags mark third-party senders, forwarders, HELO-only SPF validation, and Envelope From / Header From mismatches that may indicate spoofing.
Authentication detail
- DKIM signatures by signing domain and selector, with third-party signatures flagged
- SPF authentication by domain, including HELO-only validation
- Envelope alignment between Envelope From and Header From
- Subdomain activity and policy override reasons
- Forensic reports cross-referenced with the aggregate data
Policy advice
Per-domain recommendations based on the policy each reporter observed:
p=none or p=quarantine when you may be ready to enforce, sp= weaker than p=, relaxed alignment (adkim=r, aspf=r), a missing np= under p=reject, and pct= below 100.Working with the data
- Scan window of one week, one month, three months, six months, one year, or everything
- CSV and JSON export for spreadsheets, SIEM ingestion, or scripting
- Sortable tables, click-to-copy IP ranges, a domain quick-filter, and expand or collapse for large result sets
- Results are cached, and long scans show live progress
- Reports that cannot be read are listed with the reason, alongside metadata errors on the reporter's side
Setup
Point the add-on at the folders where your aggregate and forensic reports arrive, or name them so they are detected automatically (for example DMARC/Aggregate and DMARC/Forensic). Forensic reports are optional.
Privacy
All processing happens on your machine. The add-on requests only what it needs to read the report messages:
messagesRead, accountsRead, and storage. It makes no network requests and sends no telemetry. The source code is available under GPLv3.Available in English, Japanese, German, French, Spanish, Italian, Korean, Simplified Chinese, Traditional Chinese, Brazilian Portuguese, Russian, and Arabic. Dark mode follows your system setting.
