DMARC Aggregate Sender Change Review
Compare two batches of DMARC aggregate XML locally and review observed sender and alignment changes.
$5
Works with the AI tools you already use
Claude Code
Cursor
Codex CLI
GitHub Copilot
Gemini CLI+20 moreClaude CodeCursorCodex CLIGitHub CopilotGemini CLI
OpenClaw
Manus
Grok+17 agentsDMARC Aggregate Sender Change Review
Example session with this skill installed
Using the included synthetic before and after RFC 9990 XML reports for example.com, run the local DMARC sender-change review. Show the observed source and alignment changes and the manual checks I should do next. Do not query DNS or change mail policy.
- Read your context and instructions
- Compiled the dmarc aggregate sender
- Generated the document
Synthetic DMARC sender-change review
Scope: one supplied before report and one supplied after report for example.com.
Status: REVIEW. This example uses invented IP addresses and contains no customer data.
| Source IP | Before report | After report | Finding |
|---|---|---|---|
| 192.0.2.10 | 100 messages; DKIM/SPF reported pass; disposition pass | 80 messages; DKIM/SPF reported fail; disposition quarantine | RESULT_SET_CHANGED |
| 198.51.100.3 | Not observed | 5 messages; DKIM/SPF reported fail; disposition quarantine | NEW_SOURCE and NEW_SOURCE_WITH_BOTH_ALIGNMENT_FAILURES |
Review queue: confirm that the report time windows and receivers are comparable; inspect 192.0.2.10 for the changed reported result; identify 198.51.100.3 before treating it as an authorized or unauthorized sender. Compare live DNS, mail logs and sender configuration separately before any policy change.
Limits: message-volume differences alone are not a health verdict. Absence from these reports does not prove a sender stopped. The local packet does not verify report authenticity, live DNS, actual message delivery, or sender legitimacy. Its receipt verifies packet bytes, not the truth of the input reports. No mailbox, DNS or policy change was performed.
dmarc-aggregate-sender-change-review.pdf
PDF · document
Example file from a real run - the skill writes it into your workspace.
Connects securely to your tools. The creator never sees your data.
What you get
About this skill
Compare user-supplied before and after RFC 9990 DMARC aggregate XML without connecting to a mailbox or DNS. The included Python CLI and optional local stdio MCP tool produce a deterministic source-IP change table, human-review checklist, and hash-bound receipt. The companion SKILL.md guides an assistant through the review. The ZIP includes readable source, invented runnable examples, and a sample packet. Requires Python 3.11–3.14 and uncompressed RFC 9990 XML; optional MCP mode installs the pinned official SDK. Findings describe only the supplied reports. They do not certify sender legitimacy, live DNS policy, report coverage, message delivery, or compliance, and the tool makes no automatic changes.
How to install
Works the same in every agent - Claude, Cursor, Codex, Copilot and 20+ more.
- 1
Download the ZIP
Free skills download straight away. Paid skills unlock right after purchase.
- 2
Unzip into your skills folder
Every agent reads skills from one folder on your machine. Drop the unzipped folder in there.
- 3
Ask your agent to use it
Restart the agent if it was already running. It picks the skill up automatically - no config needed.
Skills folder by agent
Click the path to copy it. Create the folder if it does not exist yet.
Reviews
No reviews yet
Be one of the first to try it. Every listed skill passes our trust checks below.
Security scanned
Passed our 8-point scan before listing
Fresh listing
Recently published to Agensi
30-day refund
Not a fit? Get your money back
Trust & safety
Security scanned
Verified clean 13 days ago
- Passed all security checks, Safe to install