darcat

General description

darcat is a simple command-line utility for summarizing the contents of DMARC Aggregate Reports in a human-readable table. It can be thought of as an cat-like tool for DMARC Aggregate Reports, hence the name "darcat."

Usage:

A command-line tool to view DMARC Aggregate Reports in human-readable form

Usage: darcat [OPTIONS] [filename]...

Arguments:
  [filename]...  files to parse

Options:
  -t, --type <VALUE>  Force filetype of input files, overriding file extensions
					  [possible values: gz, zip, xml, mbox]
  -h, --help          Print help
  -V, --version       Print version

If no filenames are provided on the command line, input will be read from
stdin.  When stdin is used, the filetype (--type) parameter must be specified.

Zero or more filenames may be provided on the command line. If more than one filename is provided, records from all files will be combined into a single table. If no filenames are provided, the tool will read the report to parse from stdin.

By default, the filetype containing the DMARC report is inferred from the filename extension, but can be overridden with the --type command line parameter (useful when piping a report to stdin).

The following filetypes are currently supported:

• mbox: A mailbox in MBOX format, containing DMARC aggregate report emails. Any emails in the mbox that do not contain attachments are assumed to not be DMARC report emails and will be ignored.
• xml: The underlying DMARC aggregate report in XML form.
• gz: A gzip'd XML containing the report; some mailhosts provide their DMARC reports as email attachments in this form.
• zip: A ZIP archive. This option supports both a single zip'd DMARC report (i.e., a common way mail hosts provide reports as email attachments), or can contain any number of reports in other formats (useful if you've manually archived a bunch of DMARC reports in a single ZIP file for convenience).

Example output:

$ darcat example.mbox 
   Destination           Src IP | SPF    DKIM |   Result
         Yahoo    209.85.222.45 | pass   pass |    none
                      (1 mails) | pass   pass |    
somedomain.com   194.87.210.221 | fail   fail |  quarantine
                      (1 mails) | fail   fail |    
    google.com    209.85.220.41 | pass   pass |    none
                      (3 mails) | pass   pass |

Installation

It's recommended to install darcat by using cargo to grab the latest release on crates.io:

cargo install --locked darcat

Contributing

Bugfixes and/or enhancements are welcome. Feel free to submit pull requests or file issue tickets on github. I primarily wrote this tool as an exercise to gain familiarity with the Rust programming language, so there may be areas of the code that aren't optimal or aren't written in the most idiomatic way; general feedback/suggestions are also welcome.

License

Copyright © 2025 Matt Roper

This project is distributed under the terms of the Apache License (Version 2.0). See LICENSE for details.