Automate DMARC Report Monitoring: Free Tools and Alert Rules

To automate DMARC report monitoring, point your DMARC rua address at a dedicated mailbox or a free report service, let a parser such as parsedmarc, Postmark's DMARC digest or Cloudflare DMARC Management turn the daily XML files into summaries, and set alerts for new sending sources and falling pass rates. Then use that data to move safely to p=reject.

First, check that your record is published and has a working report address with our free DMARC checker. If you don't have a record yet, our DMARC record generator builds one with the right rua tag.

Why you need automation, not a mailbox

When you publish a DMARC record with a rua tag, mailbox providers such as Google, Yahoo and Microsoft send you aggregate reports: one compressed XML file per reporting organisation, usually once a day, covering every message that claimed to be from your domain. The format is now defined in RFC 9990, which, together with the core DMARC standard RFC 9989, replaced RFC 7489 in 2026.

Even a small business can receive several reports a day, each with dozens of rows of IP addresses, counts and pass/fail results. Nobody opens zipped XML attachments every morning, which is why so many domains publish p=none with a report address and then never look at the data. The reports are only useful if something reads them for you.

If you want to understand every field in a report, our field-by-field guide to reading DMARC reports covers that. This post is about getting a machine to do the reading.

What an aggregate report tells you

Each report has three parts:

• Report metadata: who sent the report (for example google.com), the date range and a report ID.
• Published policy: the DMARC record the receiver saw for your domain.
• Records: one row per sending IP address and result, with the message count, the SPF and DKIM results, the domains they were checked against, and whether DMARC passed.

Aggregate reports contain no message content and no recipient addresses. They tell you who is sending as your domain and whether those messages authenticate. That is exactly what you need to find every legitimate sender before you enforce a policy, and to spot spoofing afterwards.

Step 1: set up a dedicated report address

Don't send reports to a personal inbox. Create a mailbox or alias used only for DMARC, such as dmarc-reports@example.com, and put it in your record:

_dmarc.example.com.  TXT  "v=DMARC1; p=none; rua=mailto:dmarc-reports@example.com"

You can list more than one destination, separated by commas, for example your own mailbox and a report service:

"v=DMARC1; p=none; rua=mailto:dmarc-reports@example.com,mailto:abc123@dmarc.example-service.com"

Sending reports to another domain

If the rua address is on a different domain (a report service, or your agency's domain), receivers check that the destination agrees to receive them. The destination domain must publish an authorisation record:

example.com._report._dmarc.agency-reports.com.  TXT  "v=DMARC1"

Hosted services publish this for you. If you run your own collector on a separate domain, you have to add it yourself, or reports will quietly stop arriving.

Step 2: choose a parser

These options cost nothing. Pick one based on how much control you want and where your DNS lives.

There are also commercial DMARC platforms, some with limited free plans. They add features like source identification by vendor name, but they are not required to get started.

Self-hosting parsedmarc

parsedmarc is a Python tool that reads reports from an IMAP mailbox, Microsoft Graph or the Gmail API, unpacks the gzip or zip attachments, and parses both the old RFC 7489 schema and the new RFC 9990 schema. It can save the results as JSON or CSV, or send them to Elasticsearch, OpenSearch, Splunk, PostgreSQL, Kafka, S3 or a webhook. It ships with prebuilt dashboards for Kibana, Grafana and Splunk.

Install it in a virtual environment:

python3 -m venv /opt/parsedmarc
/opt/parsedmarc/bin/pip install parsedmarc

A minimal config, adapted from the project documentation:

[general]
save_aggregate = True
save_failure = True

[imap]
host = imap.example.com
user = dmarc-reports@example.com
password = use-an-app-password

[mailbox]
watch = True
delete = False

[elasticsearch]
hosts = 127.0.0.1:9200
ssl = False

Run it with parsedmarc -c /etc/parsedmarc.ini, ideally as a systemd service so it restarts after a reboot. With watch = True, it processes new reports as they arrive and moves processed messages to an archive folder.

Practical tips:

• Use a mailbox that only receives reports. parsedmarc will try to parse everything in the inbox.
• Use an app password or OAuth, not your main account password.
• Keep the raw emails. Set delete = False so you can reprocess them if you change your setup.
• Watch the watcher. If parsedmarc stops, you get no data and no warning. A heartbeat monitor or a simple "no new reports in 48 hours" check catches this. See our guide to automating website monitoring for free for heartbeat setup.

Step 3: decide what to alert on

Dashboards are nice, but you want to be told when something changes. Whatever tool you use, these are the alerts worth having.

With parsedmarc and Kibana or Grafana, build these as saved searches with alert rules. With Postmark or Cloudflare, review the weekly digest or dashboard on a fixed day each week, since the free tiers don't provide threshold alerts.

Step 4: use the data to reach p=reject

The whole point of monitoring is to enforce a policy without blocking your own email. A safe progression, driven by your reports, looks like this. Our DMARC explained guide covers the policy tags in more depth.

Stay at p=none until every legitimate source passes

Collect at least two to four weeks of reports, longer if you send monthly newsletters or quarterly invoices. Make a list of every source with real volume: your mailbox provider (Microsoft 365, Google Workspace), your newsletter tool, your CRM, your website's contact form, your accounting software. For each one, confirm DMARC passes with alignment, meaning the domain in the From header matches the SPF or DKIM domain.

The usual fix is to set up DKIM signing with your own domain in each vendor's settings. Relying on SPF alone is fragile, because SPF breaks on forwarding and many vendors use their own bounce domain.

Move to quarantine, optionally in test mode

When your known sources pass consistently, move to quarantine. RFC 9989 removed the old pct tag and replaced it with test mode, t=y, under which a receiver treats p=quarantine as none and p=reject as quarantine. A cautious sequence:

v=DMARC1; p=quarantine; t=y; rua=mailto:dmarc-reports@example.com
v=DMARC1; p=quarantine; rua=mailto:dmarc-reports@example.com
v=DMARC1; p=reject; rua=mailto:dmarc-reports@example.com

Give each step a couple of weeks and watch for legitimate sources appearing in the failing column.

Reject, and keep watching

At p=reject, receivers that follow DMARC refuse unauthenticated mail claiming to be from your domain. Monitoring doesn't end here. New senders get added (a marketing tool, a booking system), vendors change infrastructure, and DKIM keys get rotated. Without reports, the first sign of trouble is customers saying they never got your invoices.

Don't forget domains you don't send from. A parked domain should publish v=DMARC1; p=reject; and an SPF record of v=spf1 -all. Our guide to stopping scammers spoofing your email domain covers that.

Common reasons automation breaks

• The rua address points to a mailbox that was deleted when someone left the business.
• The report mailbox fills up. Reports are small but constant; set up auto-archiving or let your parser move them.
• An external destination lost its authorisation record after a DNS change.
• The record has a typo. rua=dmarc@example.com without mailto: is invalid. Re-run the DMARC checker after every edit.
• The parser crashed after an update and nobody noticed. Monitor it like any other job.

FAQ

Are DMARC reports free to receive?

Yes. Mailbox providers send aggregate reports at no cost to any address in your rua tag. You only pay if you choose a commercial platform to process them. Postmark's weekly digest, Cloudflare DMARC Management and parsedmarc are all free ways to read them.

How long before I start getting DMARC reports?

Usually within one to two days of publishing a record with a valid rua tag, as long as your domain sends mail to major providers. If nothing arrives after a few days, check the record syntax, the mailbox, and, for an address on another domain, the _report._dmarc authorisation record.

Is parsedmarc suitable for a small business?

It works well, but it needs a server, some Linux knowledge and ongoing maintenance, especially if you use Elasticsearch or OpenSearch. A single small business domain is usually better served by a free hosted digest. parsedmarc makes more sense for agencies or IT teams handling several domains.

What should I do when an unknown source appears in my reports?

First check whether anyone in the business has started using a new email tool, such as a CRM, booking system or invoicing service. If so, set up SPF and DKIM for it. If nobody recognises it and its messages fail authentication, it is probably spoofing, which your DMARC policy will block once you reach quarantine or reject.

Do I still need DMARC reports after reaching p=reject?

Yes. Reports show you when a legitimate sender starts failing, for example after a DKIM key change or a vendor switch, and they show how much spoofed mail is being blocked. Without them, broken authentication only comes to light when customers say they never got your emails.

Does MakeItFlow parse DMARC reports?

No. Our free tools and audits check your published DMARC, SPF and DKIM records and flag problems with them, but we don't collect or parse aggregate reports. Use one of the free options in this guide for report monitoring.

Related reading

• Automate SSL Certificate Renewal: Certbot, acme.sh and AutoSSL: How to automate SSL/TLS certificate renewal with Certbot, acme.sh or cPanel AutoSSL, test it, reload your server, and monitor expiry from outside.