DMARC_V...REPORTS(1p)

📦
version 1.20260306 · 6 versions
, in ubuntu stonking

💖 NAME 💖

okay bestie, meet dmarc_view_reports — she's a Perl script (from the User Contributed Perl Documentation crew, DMARC_V...REPORTS(1p) iykyk) and her whole job is viewing the contents of the DMARC data store. that's it. that's the gig. 👑

✨ SYNOPSIS ✨

dmarc_view_reports [ --option=value ]

she dumps the contents of the DMARC data store straight to your terminal, and the most recent records are shown first. newest first, always, main character energy. 🫶

🔍 Search Options

  • rid — report ID (the internal database ID, not a vibe)
  • author — report author (Yahoo! Inc, google.com, etc..)
  • from_dom — message sender domain
  • begin — epoch start time, shows messages after this
  • end — epoch end time, shows messages before this
  • disposition — DMARC disposition (none, quarantine, reject)
  • dkim — DKIM alignment result (pass/fail)
  • spf — SPF alignment result (pass/fail)
  • limit — caps how many reports come back (defaults to 100)
  • sort — sort by: rid, author, from_domain, begin, end (append :asc or :desc)

the default sort is "rid:desc" — that's newest reports first, no cap. you can also use --sort=newest or --sort=oldest if typing the whole thing feels like too much. ✨

now the fun part: prefix a value with "!" to negate the match (aka exclude matching records). this works for "author", "from_dom", "disposition", "dkim", and "spf". like, "--author=!google.com" will exclude reports authored by google.com. literally so powerful. 💅

🛠 Other Options

dmarc_view_reports [ --geoip --dns --help --verbose ]
  • geoip — do GeoIP lookups (⚠️ requires the free Maxmind GeoCityLitev6 database, so no db = no geoip bestie)
  • dns — do reverse DNS lookups and display hostnames
  • help — print this syntax guide
  • verbose — print additional debug info

🎀 EXAMPLES 🎀

wanna view a specific report by its ID? say less:

dmarc_view_reports --rid=560

wanna search for all reports from google.com that failed DMARC alignment? periodt:

dmarc_view_reports --author=google.com --dkim=fail --spf=fail
note that we don't use --disposition here! that would only tell us the result of applying DMARC policy, not necessarily if the messages failed DMARC alignment. important distinction, don't get it twisted. 🧠✨

to exclude reports from google.com:

dmarc_view_reports --author=!google.com

to exclude rows with a specific disposition:

dmarc_view_reports --disposition=!none

to show only the newest 50 reports:

dmarc_view_reports --limit=50

to view oldest reports first (the retro era 🦋):

dmarc_view_reports --sort=oldest

to display GeoIP lookup data for the source ip:

dmarc_view_reports --geoip

by default, city, country_code & continent_code are shown. you can optionally pass a comma delimited string to --geoip= with any of the following fields:

country_code country_code3 country_name region region_name city postal_code latitude longitude time_zone area_code continent_code metro_code

dmarc_view_reports --geoip=country_name,continent_code
dmarc_view_reports --geoip=continent_code,country_name # keep order
dmarc_view_reports --geoip=city,city,city              # repeat

yes, you can keep order and yes, you can repeat a field. she's flexible like that. 💖

📊 SAMPLE OUTPUT 📊

here's what the slay actually looks like on screen:

 ID             Recipient           From/Sender     Report-Start
  | -- Qty                        Source IP   Disposition    DKIM     SPF

 570        theartfarm.com          simerson.net  2013-05-20 09:40:50
  | --   1                   75.126.200.152    quarantine    fail    fail

 568              yeah.net              tnpi.net  2013-05-21 09:00:00
  | --   1                   111.176.77.138        reject    fail    fail

 567               126.com              tnpi.net  2013-05-21 09:00:00
  | --   1                    49.73.135.125        reject    fail    fail

 565            google.com             mesick.us  2013-05-20 17:00:00
  | --  88                   208.75.177.101          none    pass    pass

 564            google.com        theartfarm.com  2013-05-20 17:00:00
  | --   3                   208.75.177.101          none    pass    pass

 563            google.com          lynboyer.com  2013-05-20 17:00:00
  | --   1          2a00:1450:4010:c03::235          none    pass    fail  forwarded
  | --  12                   208.75.177.101          none    pass    pass
  | --   1                   209.85.217.174          none    pass    fail  forwarded

 561            google.com          simerson.net  2013-05-20 17:00:00
  | --   1                   208.75.177.101          none    pass    pass

 560            google.com              tnpi.net  2013-05-20 17:00:00
  | --   1                   208.75.177.101          none    pass    pass
  | --   1                    27.20.110.240        reject    fail    fail

 559           hotmail.com          lynboyer.com  2013-05-20 20:00:00
  | --   6                   208.75.177.101          none    pass    pass

👑 AUTHORS 👑

the icons who built this:

  • Matt Simerson <msimerson@cpan.org>
  • Davide Migliavacca <shari@cpan.org>
  • Marc Bradshaw <marc@marcbradshaw.net>

and that's the whole page bestie!! 💅 this was DMARC_V...REPORTS(1p) from the User Contributed Perl Documentation, riding with perl v5.40.1 and dated 2026-07-07. go forth and view those reports, you absolute legend. 🌈✨🦋

📦 where this page comes from