📬 Automated Gmail DMARC Aggregate Report Parser

An automated, zero-cost pipeline built with Google Apps Script and Gmail that automatically parses incoming DMARC Aggregate Reports (.xml, .xml.gz, .zip), resolves sending provider organizations via reverse IP lookups, and sends a digest email summarizing SPF and DKIM authentication pass/fail rates.

---

🌟 Key Features

• Automatic Attachment Extraction: Handles .xml, .gz, and .zip report formats directly inside Gmail.
• IP Provider Lookup: Performs dynamic API queries (ipinfo.io) to identify sending organizations (e.g., Google Cloud, AWS, Mailchimp) for failed authentication attempts.
• Zero Infrastructure Cost: Runs entirely within Google Apps Script and Gmail without needing external servers or paid services.
• Scheduled Digest: Automatically delivers a clean, formatted HTML email digest on a schedule you control.
• Automatic Thread Management: Strips Gmail labels after processing so old reports are never recounted.

---

🚀 Quick Setup Guide

1. Create Gmail Label & Filter

1. In Gmail, navigate to Settings > Filters and Blocked Addresses > Create a new filter.
2. Under Has attachment, check the box.
3. In Includes the words, enter:

   filename:xml OR filename:gz OR filename:zip
   

4. This will typically match on subject lines like "Report domain:" which most mailbox providers use for DMARC aggregate reports — narrow the filter further with a From or Subject condition if you get false positives.
5. Click Create filter, then check Apply the label and choose (or create) a label named DMARC-Report. This label is what the script looks for, so the name must match exactly.

2. Create the Apps Script Project

1. Go to script.google.com and create a New project.
2. Delete the default boilerplate code and paste in the contents of Code.gs from this repo.
3. Rename the project (top left) to something like DMARC Report Parser.
4. Click Save.

3. Authorize the Script

1. In the Apps Script editor, select the processDmarcReports function from the function dropdown and click Run.
2. Google will prompt you to authorize the script — it needs access to Gmail (to read/label messages and send the summary email) and external requests (to look up sending IPs via ipinfo.io).
3. Approve the permissions. The first run will process whatever is currently under the DMARC-Report label.

4. Set a Time-Based Trigger

1. In the Apps Script editor, click the clock icon (Triggers) in the left sidebar.
2. Click Add Trigger.
3. Configure it as:
   • Function to run: processDmarcReports
   • Event source: Time-driven
   • Type of time based trigger: Day timer (or Hour timer if you want it more frequent)
   • Time of day: whatever works for you
4. Save. The script will now run automatically and email you a digest whenever it finds new reports.

---

📨 What You'll Get

Each run produces an HTML email summarizing:

• Total DMARC-reported email volume processed
• Pass / fail counts and pass rate for SPF + DKIM alignment
• A breakdown of failing source IPs with their resolved provider/organization, so you can quickly spot unauthorized or misconfigured senders

---

🔧 Notes & Customization

• LABEL_NAME in Code.gs controls which Gmail label the script watches — change it if you used a different label name.
• The script pulls up to 25 threads per run (label.getThreads(0, 25)); increase this if you expect a high volume of reports.
• Recipient defaults to the account running the script (Session.getActiveUser().getEmail()). Change this if you want the digest sent elsewhere.
• IP-to-organization lookups use the free tier of ipinfo.io, which has rate limits — for heavy volume, consider adding an API token.

---

⚠️ Disclaimer

This script processes report data already delivered to your inbox and does not transmit any data outside of Google's infrastructure and the public ipinfo.io lookup API. Review and test in your own environment before relying on it for security monitoring.