parsedmarc
Python tool that parses DMARC aggregate and forensic reports and ships them to Elasticsearch, Splunk, or Postgres.
Technical Architecture & Overview
parsedmarc collects DMARC aggregate (rua) and forensic (ruf) reports from a mailbox or a mail spool, parses the XML, and stores results in Elasticsearch, OpenSearch, Splunk, PostgreSQL, or SQLite. Bundled dashboards visualize alignment failures by source IP and country, which is how most teams find spoofing of their domains. TLS-RPT reports are supported as well. The project is actively maintained.
Targeted Technical Use Cases
Self-hosted DMARC reporting as an alternative to commercial DMARC platforms.
Evaluation & Trade-offs
Core Strengths
- +Full control over report data in your own storage.
- +Ready-made dashboards for the common questions.
- +Handles both aggregate and forensic report formats.
Trade-Offs & Limitations
- -You operate the storage and email ingestion components.
- -Does not manage SPF/DKIM records for you.
Defensive Security Application
Monitoring domain spoofing through DMARC alignment data and driving enforcement policy changes.
Frequently Asked Questions
What is parsedmarc?→
parsedmarc collects DMARC aggregate (rua) and forensic (ruf) reports from a mailbox or a mail spool, parses the XML, and stores results in Elasticsearch, OpenSearch, Splunk, PostgreSQL, or SQLite. Bundled dashboards visualize alignment failures by source IP and country, which is how most teams find spoofing of their domains. TLS-RPT reports are supported as well. The project is actively maintained.
What is parsedmarc used for?→
Self-hosted DMARC reporting as an alternative to commercial DMARC platforms.
What are the strengths of parsedmarc?→
- +Full control over report data in your own storage.
- +Ready-made dashboards for the common questions.
- +Handles both aggregate and forensic report formats.
What are the limitations of parsedmarc?→
- +You operate the storage and email ingestion components.
- +Does not manage SPF/DKIM records for you.
How is parsedmarc used defensively?→
Monitoring domain spoofing through DMARC alignment data and driving enforcement policy changes.