Skip to main content

ARF Report Analyzer

Mailbox providers (Gmail, Yahoo, Microsoft, Comcast, etc.) send ARF reports (RFC 5965) when their users mark a message as spam or phishing, or when DKIM/SPF authentication fails. Each report is a multipart message with the original message embedded and a structured key=value section listing the receiver's evidence. Paste the raw report and we parse it.

Paste the full multipart message including headers and the boundary-separated parts. Up to 5 MB.

Common report types

  • abuse. A recipient marked the message as spam/phishing. The most common reason mailbox providers send ARF reports.
  • auth-failure. The receiver's DMARC/SPF/DKIM check failed. Often paired with ruf= in your DMARC record.
  • virus / fraud / other. Less common, used by anti-malware vendors and a few proprietary feeds.