DMARCator

DMARCator is a Ruby library for parsing and querying DMARC records.

DMARCator is a fork of the dmarc gem, originally created by Davis Gallinghouse at Trail of Bits. It keeps the original MIT license and credits its authors, but ships under a new name with additional hardening and a stricter parser. See Acknowledgments below.

DMARC policies are published as DNS TXT records at _dmarc.<domain>. This library parses those records into a structured DMARCator::Record, queries them directly through Ruby's Resolv DNS client, and parses the XML aggregate reports those policies generate.

Add this line to your application's Gemfile:

gem "dmarcator"

And then execute:

bundle install

Or install it yourself:

gem install dmarcator

The gem is loaded via:

require "dmarcator"

Parse a DMARC record:

require "dmarcator"

record = DMARCator::Record.parse(
  "v=DMARC1; p=reject; rua=mailto:d@rua.agari.com; ruf=mailto:d@ruf.agari.com; fo=1"
)

record.v
# => :DMARC1

record.p
# => :reject

record.adkim
# => :r

record.aspf
# => :r

record.fo
# => ["1"]

record.pct
# => 100

record.rf
# => :afrf

record.ri
# => 86400

record.rua
# => [#<DMARCator::Uri ... @uri=#<URI::MailTo mailto:d@rua.agari.com>, @size=nil, @unit=nil>]

record.ruf
# => [#<DMARCator::Uri ... @uri=#<URI::MailTo mailto:d@ruf.agari.com>, @size=nil, @unit=nil>]

record.sp
# => :reject

Query the DMARC record for a domain:

record = DMARCator::Record.query("twitter.com")
# => #<DMARCator::Record ... @p=:reject, @rua=[...], ...>

By default, unknown tags and tags with invalid values are ignored. Pass strict: true to reject them instead:

DMARCator::Record.parse("v=DMARC1; p=none; pct=abc", strict: true)
# => DMARCator::InvalidRecord: invalid DMARC tag value: "pct=abc"

Parse a DMARC aggregate/forensic report:

report = DMARCator::Report.new(xml_string)

report.version
# => 0.1e0

report.metadata.org_name
# => "google.com"

report.policy.domain
# => "opserv.io"

report.records.first.source_ip
# => "209.85.220.69"

DMARC records and XML reports are treated as untrusted input:

• XML reports are parsed with network access disabled (NONET), so external entities are never resolved or fetched.
• Reports larger than 25 MiB are rejected before parsing.
• A warning is emitted at load time if the bundled resolv gem is affected by CVE-2026-80212/CVE-2026-80213.
• Domain names are validated before resolution (labels ≤ 63 octets, total ≤ 248 octets, no leading/trailing hyphens).

• Ruby >= 3.3.13
• parslet >= 1.0.0, < 3.0.0
• nokogiri >= 1.10
• bigdecimal >= 1.0

To run the RSpec tests:

rake spec

To test the parser against the bundled Alexa Top 500 fixture:

rake spec:gauntlet

This project is released under the MIT License. See the LICENSE.txt file for details.

DMARCator is a fork of dmarc, a DMARC record parser created by Davis Gallinghouse at Trail of Bits and released under the MIT License.

This fork renames the DMARC module to DMARCator (loaded via require "dmarcator") while keeping the original API shape, and adds:

• strict mailto:-only handling for rua/ruf report URIs,
• validation for required and ranged tags (p, pct, ri) and duplicate tags,
• a DNS query path that selects the v=DMARC1 TXT record per RFC 7489,
• hardened packaging and test fixtures.

The DMARC XML report parser is ported from dmarc_parser, created by D Salko and released under the MIT License.