Skip to main content

ARF report analyzer

Mailbox providers (Gmail, Yahoo, Microsoft, Comcast, etc.) send ARF reports (RFC 5965) when their users mark a message as spam or phishing, or when DKIM/SPF authentication fails. Each report is a multipart message with the original message embedded and a structured key=value section listing the receiver's evidence. Paste the raw report and we parse it.

Paste the full multipart message including headers and the boundary-separated parts. Up to 5 MB.

Example result for example.com

Sample data. Run the check above to see yours.

Abuse report (ARF) parsed

Info

A feedback report from a mailbox provider about one message sent as example.com.

Feedback type abuse
Source IP 198.51.100.23
Reported domain example.com

Common report types

  • abuse. A recipient marked the message as spam/phishing. The most common reason mailbox providers send ARF reports.
  • auth-failure. The receiver's DMARC/SPF/DKIM check failed. Often paired with ruf= in your DMARC record.
  • virus / fraud / other. Less common, used by anti-malware vendors and a few proprietary feeds.

Want ongoing monitoring?

This tool is a one-shot check. PhishFence watches your domain with automated hourly monitoring (daily on Free) for DMARC changes, new lookalike registrations, and spoofing attempts.

Start free monitoring