How to Parse DMARC Aggregate Reports

Why parsing DMARC aggregate reports is essential for email deliverability

You send emails. Your customers expect them. But how do you know if unauthorized senders are using your domain to distribute spam or phishing messages? Without parsing DMARC aggregate reports, you’re flying blind.

These reports are like a daily audit of your domain’s email activity across the internet. They show who’s sending on your behalf, whether authentication is working, and if someone’s spoofing your brand. Left unexamined, they become dead data. Parsed, they reveal threats and system flaws that directly impact inbox placement.

How to parse DMARC aggregate reports? Not with guesswork. With a clear process to identify misconfigurations, catch unauthorized senders, and protect your sender reputation. This guide walks through the essentials — why it matters, what to look for, and how to act on what you find.

Key takeaways

Parsing DMARC aggregate reports reveals unauthorized use of your domain, including spoofing and phishing attempts.
It validates SPF and DKIM alignment across real-world email flows, not just setup checks.
Regular analysis reduces bounce rates by identifying misrouted or invalid sending sources.

What is the DMARC RUA XML format and how does it structure data?

DMARC aggregate reports are sent in XML format to the email address specified in your DMARC DNS record via the rua tag. They contain structured data about email traffic, including sender IP, message alignment results (SPF and DKIM), and whether messages passed or failed your DMARC policy. The root element <feedback> organizes metadata, policy details, and transmission evidence in a standardized way.

Feedback Structure and Metadata

The <feedback> element holds all data. Within it, <report_metadata> includes the domain being reported, a unique report ID, the date range covered, and the reporting organization’s contact info. This section helps you identify which domain and time period a report applies to, making it easier to track patterns across multiple reports.

Policy and Message Evidence

The <policy_published> section tells you what your DMARC policy actually was—whether it was set to p=none, p=quarantine, or p=reject. This helps determine whether a failed message was expected, given your policy. The <row> elements are where the actionable data lives: each represents a unique source IP address that sent mail, with fields like message count, policy enforcement result, and alignment status for both SPF and DKIM. Alignment failures here are often the root cause of deliverability issues.

For example, a <row> with a high count but spf=pass and dkim=fail points to a misconfigured or forged DKIM signature. Some of these issues can be caught early using bulk verification tools that check domain and email integrity before sending. If you're managing email campaigns, you can use automated tools like our bulk verification to ensure your contact list adheres to sender standards, reducing the risk of DMARC failures.

These reports are sent daily or weekly by receiving mail servers that implement DMARC. The structure is defined in RFC 7483, which outlines how aggregators should format and deliver reports. Major ISPs like Google, Microsoft, and Yahoo regularly send these reports as part of their DMARC compliance program [IETF RFC 7483]. You can use them to validate sender authenticity, detect spoofing attempts, and improve inbox placement over time.

While parsing raw XML manually is possible, it's time-consuming. Many organizations use tools to convert these reports into readable summaries. For insights into your sending practices and alignment health, consider analyzing real-world delivery data with our inbox placement testing, which simulates how your messages land across major providers.

What does a DMARC aggregate report actually tell you about your sending infrastructure?

DMARC aggregate reports reveal whether emails sent from your domain are passing authentication checks (SPF and DKIM). They show which IPs are sending on your behalf, identify failed authentications, and expose impersonation attempts—even if your sender reputation remains intact. High failure rates from unexpected IPs often signal compromised accounts or insecure mail servers. These reports are your first line of defense against domain spoofing.

How to interpret the key signals in a DMARC aggregate report

You’ll see which IPs are authorized to send email on your domain—verify them against your known sending sources to catch unexpected ones.
Failed SPF results mean the sending server doesn’t match your published SPF record, possibly due to misconfigured mail servers or phishing attempts.
DKIM failures indicate the message signature didn’t verify. This could point to misconfigured DKIM keys, altered content, or interception.
Multiple failures from unusual IPs (especially those not in your send list) suggest compromised accounts, leaked credentials, or phishing campaigns abusing your domain.
Consistent alignment failures (SPF/DKIM not matching the From domain) mean the email is likely spoofed—even if it passes technical checks.
A sudden spike in failures from a single IP or group of IPs can indicate a security breach or malicious use of your domain.
DMARC aggregate reports help you spot large-scale impersonation even if your inbox placement and sender score are still clean.

Why this matters beyond reputation

Even if your deliverability is strong, impersonation can still damage brand trust and trigger security alerts. A DMARC report exposes hidden threats before they escalate.

For ongoing monitoring, consider tools that automate analysis. You can use bulk email verification to clean your lists and reduce spoofing risks. For real-time sender validation, pair DMARC insights with the email verification API to confirm authenticity before sending.

Understanding DMARC is foundational. The reports are standardized by RFC 7483, and are widely used by organizations to enforce email security policies.

Let’s be clear: a clean DMARC report isn’t about perfection—it’s about visibility. You can’t fix what you can’t see.

How to parse DMARC aggregate reports using Python and the parsedmarc library

You can parse DMARC aggregate reports with Python using the parsedmarc library by installing it via pip, loading an XML report file from your RUA mailbox or storage, and running the tool to convert raw XML into structured, standardized data. It extracts key metrics like source IP, message count, alignment status, and policy enforcement, supporting both standard and extended formats for use in logs, monitoring, or security dashboards.

Set up the environment

First, install parsedmarc with pip. This library is widely used in email security workflows and is maintained by the open-source community. It handles the complexity of DMARC’s XML schema, so you don’t have to write parsing logic from scratch.

pip install parsedmarc — This installs the library and its dependencies, including support for decompressing and parsing compressed report files commonly sent via email.
Ensure your DMARC report file (e.g., report.xml) is accessible — either downloaded from your RUA mailbox or pulled from cloud storage like S3 or a shared directory.
Place the file in your working directory or specify the full path when running the command.

Parse the report

Once the library is ready, you can feed it your DMARC XML file. The output is a clean, normalized dataset that you can use in scripts, dashboards, or analysis tools.

Run parsedmarc -f report.xml — This processes the XML and outputs structured JSON or CSV data, including source IP, policy enforcement, alignment results, and message counts.
Examine the output: fields like source_ip, count, sp (SPF alignment), and dkim (DKIM alignment) help you track whether emails are passing checks.
Use the output in log aggregators, SIEM tools, or custom scripts to monitor unauthorized email sending and identify misconfigured domains.

DMARC reports follow the standard defined in RFC 7483, which specifies the XML schema. The parsedmarc library supports both the basic format and extended fields added by providers like Microsoft and Google, making it useful across diverse environments.

If you're analyzing large volumes of email data, consider automating this process with a script that runs on scheduled intervals. You can integrate this into your security monitoring stack or use it to validate domain configurations before launching campaigns.

For teams managing email lists at scale, ensuring sender reputation is crucial. You can use tools like bulk verification to clean and validate lists, reducing the risk of poor DMARC alignment and improving deliverability.

How to set up a DMARC report parser with parsedmarc and manage output

You can parse DMARC aggregate reports using parsedmarc by first installing it, then configuring it to read reports from your email server or cloud storage. The tool converts raw XML reports into structured data, which you can save as CSV or JSON for use in dashboards, SIEMs, or email verification workflows. Automate parsing with cron or cloud functions. Always validate input files before processing to avoid errors.

Set up your parser with validated input and structured output

Install parsedmarc and dependencies using pip. It’s available on PyPI and follows RFC 7483 for DMARC report format. This ensures consistent handling of aggregate reports.
Validate incoming report files before processing. Use a Python script that checks file extension, MIME type, and XML syntax. Only proceed if the file matches the expected DMARC format. This prevents parsing failures from malformed inputs.
Output parsed results to CSV or JSON. parsedmarc supports both formats. Choose CSV for integration with tools like Excel, Power BI, or data pipelines. Use JSON for richer structured data needed by SIEMs such as Splunk or ELK.
Store outputs in a defined directory. Maintain a consistent file path (e.g., /var/reports/output/) so automation scripts and downstream systems can reliably access new reports.
Filter results by alignment failure type, IP, or domain. Use parsedmarc’s built-in filtering or post-process output with Python. Focus on failures like spf or dkim misalignment, or reports from specific IPs to isolate sources of email spoofing.

Automate parsing and integrate with monitoring systems

Use cron jobs to run the parser daily. A simple entry like 0 2 * * * /usr/bin/python3 /path/to/parser.py executes the script at 2 AM UTC. For cloud environments, deploy the same script as an AWS Lambda function with S3 triggers.

For teams using email verification tools, use the parsed output to identify domains with high spoofing rates. Cross-reference suspicious domains with real-time email validation services like bulk verification to assess sender health and prevent abuse.

Integrate report data into SIEMs using the JSON output. This allows alerting on sudden spikes in alignment failures or unknown sources. You can also feed filtered data into monitoring dashboards to track domain compliance over time.

DMARC reports alone don’t improve deliverability. But when parsed, validated, and acted upon, they turn raw data into actionable insights. The goal is to reduce sender risk and improve inbox placement — a key factor in successful email campaigns.

Real-world use case: Detecting unauthorized senders via parsed DMARC reports

You can use DMARC aggregate reports to uncover unauthorized email senders by parsing alignment failures across SPF and DKIM. When you see a consistent spike in failures from one IP address—especially from a foreign country—it’s a red flag that someone is sending emails on your behalf without permission. Parsed reports turn raw DNS data into actionable insights, letting you block rogue senders before they damage your sender reputation.

Identifying the source of unauthorized email activity

Let’s say your company starts seeing thousands of SPF and DKIM failures daily from a single IP in a country with no business presence. The pattern isn’t random—it’s a sign that an internal system or third-party service is compromised. You dig into the DMARC aggregate reports, which include alignment details, source IPs, and failure counts per policy. One IP stands out: a cloud-based CRM used for customer outreach.

Further inspection shows that the CRM’s API credentials were exposed, and it was being exploited to send marketing emails to old user lists—emails that didn’t pass SPF or DKIM checks because the signing domain didn’t match the return-path. This wasn’t just spam—it was a breach. The CRM wasn’t authorized to send at scale, and the emails were failing alignment checks because the sender wasn’t properly authenticated.

Corrective action and measurable impact

With the bad IP identified, you added it to your DNS blocklist and revoked access for the compromised integration. After the fix, your bounce rate dropped by 22% within a week, and inbox placement improved across major providers. This wasn’t just about reducing bounces—it was about protecting your domain’s reputation, which is tied directly to email authentication and consistent sending behavior.

DMARC isn’t a firewall, but it’s a powerful diagnostic tool. When you parse the reports regularly—ideally daily or weekly—you catch anomalies early. By automating this with a tool that converts raw XML into clear, actionable logs, you prevent reputation damage from unknown or unauthorized senders.

Tools like EmailListChecker’s bulk verification can help spot patterns in email domains and IPs that don’t align with your known senders. While not a DMARC parser per se, it complements detection by verifying list hygiene, catching disposable domains, and flagging role accounts that may be hijacked. Regular verification reduces the risk that a compromised service can spam your domain.

For ongoing visibility, consider setting up automated parsing via the EmailListChecker API to monitor authentication failures. It integrates with platforms like SendGrid and HubSpot, ensuring you’re not missing signals buried in your DMARC data.

Common challenges when parsing DMARC reports and how to overcome them

DMARC aggregate reports are essential for monitoring email authentication, but parsing them reliably requires handling delays, format inconsistencies, large file sizes, and encoding quirks. You’ll need a parser that accounts for real-world variability, including base64 encoding, XML namespaces, and non-standard reporting engines. Let’s break down the most common hurdles—and how to fix them.

Delays and non-compliant reporting engines

DMARC reports can be delayed by up to 48 hours due to mail server load or throttling by receiving providers—don’t assume real-time delivery.
Some reporting domains don’t follow RFC 7483 exactly, leading to unexpected XML structures or missing fields. Validate the report against the spec RFC 7483 but expect deviations in practice.
Always check for report_metadata attributes like org_name and date_ranges to confirm report validity—some services omit them.

Handling large and complex reports

Reports over 10 MB can crash simple parsers. Use streaming or chunked processing to avoid memory exhaustion.
Base64 encoding is required for the report element in the DMARC XML. If your parser doesn’t decode it properly, you’ll ingest garbage data.
XML namespaces (e.g., xmlns="urn:oasis:names:tc:entity:xmlns:xml:catalog") can break parsers that don’t support namespace-aware parsing. Ensure your XML engine is namespace-aware.
Some report engines embed non-standard fields or include extra data outside the required XML structure. Log anomalies and handle gracefully.

These issues are why automated parsing systems often fail unless they’re built with resilience in mind. Tools like email list verification and deliverability testing help identify bad signals early—so you don’t waste sends on addresses that trigger authentication failures.

How email verification tools like Emaillistchecker.io integrate with DMARC visibility

You don’t need Emaillistchecker.io to parse DMARC aggregate reports directly, but you do need it to act on the insights they provide. While DMARC shows you who’s sending email on your domain and whether messages are passing or failing, Emaillistchecker.io ensures the email addresses in your outbound campaigns are valid, active, and not role or disposable accounts. Together, they form a defensive layer against deliverability risks.

DMARC sets the foundation, verification acts on it

DMARC reports tell you about authentication failures, spoofing attempts, and alignment issues across your domain. They’re critical for detecting threats—but they don’t tell you if an address is deliverable. That’s where email verification comes in. Using tools like Emaillistchecker.io, you can audit your mail list against real-time SMTP validation, catch-all detection, and role account identification. This helps you filter out any addresses flagged in DMARC reports as risky or unverified, even if they appear syntactically valid.

For example, a DMARC report might show a spike in failed authentication from a domain that shouldn’t be sending emails. Let’s say that same domain uses one of your email addresses in a bulk campaign. Without verification, you might send to a catch-all or role account. Emaillistchecker.io catches that early—before it damages your sender reputation. As the rfc7483 clarifies, DMARC is about policy enforcement; validation is about message quality.

Combined with DMARC visibility, Emaillistchecker.io’s 98.9% accuracy ensures your messages go only to real, engaged, and deliverable recipients. That improves inbox placement, reduces bounce rates, and minimizes the chance of your domain ending up on a spam trap or blackhole list—even when third parties misuse your branding.

Integrated workflows, real-world impact

Imagine running a campaign with tens of thousands of emails. You’ve got DMARC protecting your domain from impersonation, but your list still contains old, inactive, or generic addresses. Tools like Emaillistchecker.io help clean that up. Use the bulk verification feature to pre-process your list before sending, then pair that with ongoing DMARC analysis to identify suspicious patterns. You’re not just verifying addresses—you’re hardening your entire outbound stack.

Use the real-time verification API to validate every new signup. Use the inbox placement testing to simulate real-world delivery. And leverage the integrations with platforms like Mailchimp and Klaviyo, so every incoming lead is automatically vetted for quality—long before it hits your send queue.

It’s not about choosing between DMARC and verification. It’s about combining them. One tells you who’s sending; the other ensures you’re sending to the right people. That’s how you reduce risk, improve reputation, and keep your messages in inboxes—not trash.

Why automating DMARC report parsing matters for ongoing domain hygiene

You can’t protect your domain from spoofing if you’re waiting days to review DMARC reports manually. Automation lets you detect abuse in minutes, not weeks — turning raw XML into actionable alerts. This keeps phishing attempts from spreading and maintains your sender reputation. Tools like inbox-placement testing and continuous verification help you catch anomalies early.

What happens when you don’t automate?

Manual parsing of DMARC aggregate reports is slow — often taking hours per report, even with basic scripts.
Human error compounds with volume: critical abuse signals like new unauthorized sending IPs go unnoticed.
By the time you spot a spoofing attempt, attackers may have already compromised users or spread malware.
Without automation, you’re reacting, not preventing — and reputation damage often follows.

How automation changes the game

Set up automated parsing to flag unauthorized senders in real time using DMARC's RFC 7483 structure.
Integrate parsed data into SIEMs, ticketing systems, or internal dashboards to trigger alerts for new unauthorized sources.
Track trends over time: rising failure rates or new domains sending on your behalf signal emerging threats.
Use these insights to enforce internal policies — for example, blocking unapproved email gateways or auditing third-party vendors.
Proactively update DNS records, block malicious IPs at the network layer, and strengthen SPF/DKIM alignment.
When ESPs or receivers ask for proof of domain hygiene, you can show historical data, audit trails, and automated response logs.

Automation doesn’t just save time. It turns DMARC from a compliance checkbox into a living security control. The fewer emails from unrecognized sources, the lower your deliverability risk — and the more trust ESPs place in your email stream.

Even if you’re not parsing DMARC reports in-house, tools that support automated validation and list hygiene help you stay resilient. Use bulk verification and the API to test and maintain clean, deliverable lists — a foundational layer of email hygiene that complements DMARC.

Best practices for managing DMARC report parsing in your email operations

You must validate DMARC reports before parsing to prevent malicious or malformed data from corrupting your analysis. Always store reports securely with access controls—these files expose your email infrastructure, authentication setup, and sending patterns. Set automated alerts for alignment failures or unexpected volume drops to catch spoofing attempts early. Then, review parsed data monthly to spot trends that correlate with campaign volume, delivery rates, or sudden spikes in bounces.

Start with report integrity

Verify the DNS signature (DKIM) and sender domain authenticity of incoming DMARC reports before processing—this prevents spoofed or fake reports from skewing your data.
Use a trusted parser that checks for valid XML format and correct schema, as malformed reports can crash parsers or introduce false data.
Validate the from address and domain against your own SPF and DMARC policies—reports from unrelated domains may be invalid or manipulated.

Secure handling and actionable insights

Store DMARC reports in encrypted, access-controlled systems—these files contain the IP addresses of your sending sources and details on failed authentication attempts.
Set up alerts when alignment fails across more than 5% of messages, or when a domain reports high volumes of SPF or DKIM failures—this often signals misconfiguration or compromise.
Review data alongside campaign send volume: sudden dips in deliverability may correlate with spikes in failed DMARC checks, pointing to issues in email infrastructure.
Use a tool with built-in parsing and visualization if you don’t have dedicated email operations staff—manual parsing is error-prone and time-consuming.

DMARC reports don’t just track abuse—they reveal the health of your email stack. Misaligned reports or sudden failure trends often precede inbox placement issues or blacklisting. The RFC 7483 standard defines the format, so ensure your parser adheres to it: RFC 7483 describes DMARC’s structure and expected fields. Regular review keeps your sender reputation intact.

If you’re managing bulk email sends at scale, ensure your list quality supports these results. A clean, verified list reduces alignment issues and spoofing attempts. If you’re unsure about the validity of your sending domains, test delivery early with a tool like inbox placement testing. Keep your reputation strong—not your list—by catching problems early.

Final takeaway: DMARC parsing is not optional — it’s foundational for sender reputation

Even with tools like Emaillistchecker.io monitoring your email list hygiene and inbox placement, DMARC remains a critical layer of defense. Without parsing aggregate reports, you’re blind to how your domain is being used across the internet.

Raw DMARC data reveals whether unapproved senders are impersonating your brand — a key indicator of spoofing attempts and phishing risks. This insight isn’t just about compliance; it directly affects your sender reputation and inbox placement.

Automating the parsing process transforms passive data into real-time actions. Identify sources of unauthorized email, adjust authentication settings, and reduce the chance of being flagged as a spam source.

Sources

Only about 9% of analyzed domains meet best practice — a p=reject DMARC policy with aggregate reporting enabled — despite record adoption growth. — DMARC Report (EasyDMARC 2026 data) (2026)
DMARC adoption among the world's top 1.8 million domains jumped from 27.2% in 2023 to 47.7% in 2025 — a 75% surge driven by Google and Yahoo's sender rules. — EasyDMARC DMARC Adoption Report 2025 (2025)

Keep reading

Ready to put this into practice? Emaillistchecker.io verifies emails with 98.9% accuracy — start with 100 free verifications.

Frequently asked questions

What is a DMARC aggregate report and why does it matter?

It’s a daily or weekly XML report that shows how emails claiming to come from your domain were authenticated by receivers. It reveals spoofing attempts and misconfigurations, which directly impact deliverability and sender reputation.

Can I parse DMARC reports without coding?

Yes — tools like Emaillistchecker.io’s inbox placement tests and deliverability diagnostics can surface domain-level insights without manual parsing, though they don’t process raw XML reports.

Is parsedmarc free and open source?

Yes — parsedmarc is a free, open-source Python library designed to parse DMARC aggregate reports from RFC 7483 format to structured data.

How often should I parse DMARC reports?

Daily if you send significant email volume; weekly if volumes are low. Most organizations process them on a daily basis to catch threats early.

What does 'SPF alignment' mean in a DMARC report?

It means the domain in the From: header matches the domain used in the SPF check. Failure indicates domain mismatch, which often leads to spam filtering or blocklisting.

Can a DMARC report show if my email was delivered to an inbox?

No — DMARC reports do not track inbox placement or delivery status. They only show authentication results (pass/fail) and sender IP data.

How do I get DMARC reports for my domain?

Include a rua tag in your DMARC DNS record pointing to an email address. Third-party providers or your email service may collect and deliver these automatically.

Why does my DMARC report show high failures from a trusted sender?

It could indicate misconfiguration, especially if the sender’s domain doesn't match the From: header. Always verify SPF and DKIM signatures on outbound emails.

What happens if I don’t parse DMARC aggregate reports?

You may miss unauthorized use of your domain, leading to reputation damage, increased spam complaints, or blacklisting by email providers.

It doesn’t parse DMARC reports, but its 98.9% accurate email verification reduces risk from invalid or high-failure addresses, which supports overall domain hygiene.