--- title: "What Is A DMARC Parser And How Does It Help Interpret DMARC Aggregate Reports? | DMARC Report" description: "Learn what a DMARC parser is, how it simplifies DMARC aggregate reports, identifies email threats, and helps improve email authentication." image: "https://dmarcreport.com/og/blog/what-is-dmarc-parser-and-how-to-interpret-aggregate-reports.png" canonical: "https://dmarcreport.com/blog/what-is-dmarc-parser-and-how-to-interpret-aggregate-reports/" --- Quick Answer A DMARC parser converts complex DMARC aggregate (RUA) reports into easy-to-read insights. It helps identify email authentication issues, detect spoofing attempts, monitor SPF and DKIM alignment, and improve your domain's email security and deliverability. Share [ ](https://www.linkedin.com/sharing/share-offsite/?url=undefined%2Fblog%2Fwhat-is-dmarc-parser-and-how-to-interpret-aggregate-reports%2F "Share on LinkedIn") [ ](https://twitter.com/intent/tweet?text=What%20Is%20A%20DMARC%20Parser%20And%20How%20Does%20It%20Help%20Interpret%20DMARC%20Aggregate%20Reports%3F&url=undefined%2Fblog%2Fwhat-is-dmarc-parser-and-how-to-interpret-aggregate-reports%2F "Share on X/Twitter") [ ](https://www.facebook.com/sharer/sharer.php?u=undefined%2Fblog%2Fwhat-is-dmarc-parser-and-how-to-interpret-aggregate-reports%2F "Share on Facebook") [ ](https://reddit.com/submit?url=undefined%2Fblog%2Fwhat-is-dmarc-parser-and-how-to-interpret-aggregate-reports%2F&title=What%20Is%20A%20DMARC%20Parser%20And%20How%20Does%20It%20Help%20Interpret%20DMARC%20Aggregate%20Reports%3F "Share on Reddit") [ ](mailto:?subject=What%20Is%20A%20DMARC%20Parser%20And%20How%20Does%20It%20Help%20Interpret%20DMARC%20Aggregate%20Reports%3F&body=Check out this article: undefined%2Fblog%2Fwhat-is-dmarc-parser-and-how-to-interpret-aggregate-reports%2F "Share via Email") ![DMARC parser](https://media.mailhop.org/dmarcreport/dmarc-generator-6224-1784029951956.jpg) ## Try Our Free DMARC Checker Validate your DMARC policy, check alignment settings, and verify reporting configuration. [ Check DMARC Record → ](/tools/dmarc-checker/) A DMARC parser is a specialized engine that ingests DMARC aggregate (RUA) XML reports, validates and normalizes their contents (metadata, published policy, records, IP sources, SPF/DKIM results), correlates outcomes to domains and subdomains, and transforms the data into queryable, visual, and actionable intelligence that organizations use to monitor sending sources, detect abuse, and safely **move to a reject policy**—exactly what DMARCReport automates end to end. ## Context and background Domain-based Message Authentication, Reporting, and Conformance (DMARC) lets domain owners receive aggregate telemetry from [mailbox providers](https://en.wikipedia.org/wiki/Mailbox%5Fprovider) about who is sending email “as” their domain and whether messages pass alignment via SPF or DKIM. _Those daily reports arrive as compressed XML files with counts—not raw messages—summarizing outcomes by sending IP and domain_. Interpreting them at scale requires robust parsing, normalization, de-duplication, and analytics capabilities. A DMARC parser is both a data-quality gate and an analytics bridge: it translates heterogeneous, sometimes malformed XML from hundreds of receivers into a consistent dataset, correlates SPF/DKIM alignment with policy dispositions, and provides historical, drill-down analyses to drive decisions (e.g., which third-party senders to authorize, when to raise p=quarantine→reject). [DMARCReport](https://dmarcreport.com/) provides this as a managed pipeline—receiving, parsing, storing, visualizing, and alerting—so security and email teams can spend time on remediation, not plumbing. ## How a DMARC parser processes RUA XML step-by-step DMARC aggregate reports follow a **common XML schema** with three core blocks: report [metadata](https://www.ibm.com/think/topics/metadata), policy published, and repeated record elements for each source IP and `header_from` domain pair. DMARCReport’s parser follows these stages: ### 1) Intake, decompress, and validate - Accept inputs from mailbox IMAP/POP3/API, S3/object storage drops, or [Hypertext transfer protocol secure](https://www.cloudflare.com/learning/ssl/what-is-https/) (HTTPS) upload. - Detect and decompress attachments: .gz, .zip, .7z; support nested and multi-part archives. - Validate XML against schema variants and common deviations; enforce sane limits (e.g., max elements, depth) to prevent parser bombs. ### 2) Parse report metadata - **Fields**: `org_name`, email, `extra_contact_info`, report\_id, `date_range` (begin, end). - Normalize time to UTC seconds; compute `reporting_day` (YYYY-MM-DD). - Establish idempotency key: `hash(org_name|report_id|begin|end)` to dedupe re-sent reports. - **DMARCReport**: stores metadata in a dedicated table and auto-resolves `org_name` aliases (e.g., “Google Inc.” vs “Google LLC”) for consistent reporting. ### 3) Parse published policy - **Fields**: domain, adkim, aspf, p, sp, pct. - Validate values (r/s for alignment; none/quarantine/reject for policy; 0–100 for pct). - **DMARCReport**: preserves the snapshot of policy at report time and cross-references with live DNS to **detect unexpected changes**. ### 4) Iterate records (per IP and header\_from) Each `` is parsed into: - **row**: `source_ip`, count, `policy_evaluated` (disposition, dkim, spf, reasons\[\]). - **identifiers**: `header_from` (and where present: `envelope_from`, `envelope_to`). - auth\_results: `dkim[]` (domain, selector, result, `human_result`), spf (domain, result). - **DMARCReport**: calculates derived fields (e.g., `aligned_dkim`, `aligned_spf`, `fail_reason_priority`, ptr/ASN enrichment) on ingestion. ### 5) Normalize and enrich - **IP enrichment**: reverse DNS, ASN, country/region, provider tagging (Mailchimp, Salesforce, etc.). - Canonicalize domains (lowercase, punycode, eTLD+1 extraction). - Compute DMARC alignment flags and categorize overrides (forwarded, `local_policy`, `mailing_list`). - **DMARCReport**: applies a sender-identity knowledge graph to tag third-party platforms and brand subdomains. ### 6) Persist with integrity controls - Upsert using idempotency key + row-level uniqueness (`report_id` \+ `source_ip` \+ `header_from` \+ `auth_result` digest). - Capture raw XML for audit (optional), with **checksum for tamper evidence**. - **DMARCReport**: retains lineage linking every metric back to original report and file. ![Data models and storage schemas for efficient analysis](https://media.mailhop.org/dmarcreport/dmarc-lookup-8596-1784028742799.jpg) ## Data models and storage schemas for efficient analysis _A sound schema makes or breaks DMARC analytics. DMARCReport employs a hybrid, query-optimized model you can mirror on Postgres, BigQuery, or Snowflake_. ### Recommended relational star schema - reports - `report_uid` (PK, UUID), `org_name`, `org_email`, `report_id`, `date_begin`, `date_end`, `reporting_day`, `receiver_hash` - **Index**: (`reporting_day`), (`org_name`, `reporting_day`) - policy\_published - `report_uid` (FK), domain, adkim, aspf, p, sp, pct - **Index**: (domain, `reporting_day`) - records - `record_uid` (PK), `report_uid` (FK), `source_ip`, `header_from`, count, disposition, `dkim_aligned`, `spf_aligned`, `reason_primary`, asn, country, `provider_tag` - **Index**: (`header_from`, `reporting_day`), (`source_ip`, `reporting_day`), (`provider_tag`, `reporting_day`) - `auth_results_dkim` - `record_uid` (FK), `dkim_domain`, selector, result, `human_result` - **Index**: (`dkim_domain`, result, `reporting_day`) - `auth_results_spf` - `record_uid` (FK), `spf_domain`, result - **Index**: (`spf_domain`, result, `reporting_day`) Performance notes: - Partition large tables by `reporting_day` (monthly partitions). - Add a unique constraint for idempotency: (`report_uid`, `source_ip`, `header_from`, count, disposition, `dkim_aligned`, `spf_aligned`). - For semi-structured “reasons” and tags, use JSONB with **GIN indexes for flexible filtering**. Columnar/warehouse model: - A denormalized fact table (`fact_dmarc_daily`) with dimensions for date, domain, `source_ip`, asn, `provider_tag`, and measures (`message_count`, `pass_dm_arc`, `pass_dkim_only`, `pass_spf_only`, `fail_both`). - Materialized views for 7/30/90-day rollups and domain/subdomain pivots. **DMARCReport uses both**: _OLTP for ingestion integrity and a warehouse for analytics and ML, synced via streaming upserts_. ## Tooling landscape: open-source and commercial parsers Below is a practical comparison to help teams select or integrate; DMARCReport can ingest from any of these sources and also exposes its own parsing [API(application programming interface)](https://www.coursera.org/in/articles/what-is-an-api). ### Reliable parser options - Open-source - **parsedmarc (Python)**: Mature, handles IMAP/Gmail, gzip, JSON/Elastic output; easy to extend. - **dmarc-cat (Go)**: Fast streaming parser; good for [command-line interface (CLI)](https://www.techtarget.com/searchwindowsserver/definition/command-line-interface-CLI) and pipelines. - **opendmarc (C) tools**: Legacy but stable; limited enrichment. - Commercial/SaaS - **DMARCReport**: End-to-end pipeline, enrichment, dashboards, and alerting; enterprise-scale. - **Agari/Fortra, Valimail, Red Sift**: Full platforms; **varying openness of data export**. **Feature comparison (high level):** - **Parsing robustness**: parsedmarc and DMARCReport excel with malformed XML handling and mailbox integrations. - **Performance**: Go-based parsers and DMARCReport’s Rust-backed core deliver best throughput. - **Extensibility**: parsedmarc plugins vs. DMARCReport’s webhook/streaming APIs and custom transformation hooks. - **Integration**: DMARCReport offers native sinks (Snowflake, BigQuery, S3, Elastic), SCIM/SSO, SIEM apps. ## Robust ingestion: malformed, duplicates, compression, and large files A great DMARC parser is opinionated about [data quality](https://www.informatica.com/resources/articles/what-is-data-quality.html). ### Best practices - Compression handling - Auto-detect gzip/zip; stream decompress to avoid OOM; cap max uncompressed size. - Malformed XML - Use tolerant SAX/iterparse; recover on non-critical structural errors; quarantine beyond-threshold corruption. - Maintain an error budget; notify senders if a receiver persistently emits broken XML. - Duplicates and idempotency - Primary key from `report_id` \+ `org_name` \+ (begin,end) + file checksum; row hash for record-level dedupe. - Upsert semantics with exactly-once ingestion per mailbox message-ID or S3 object version. - Large files - Chunked parsing; backpressure through queues; spill to disk when **memory exceeds watermark**. - Auditing - Preserve original payload hash; track parser version to support reproducibility. _DMARCReport implements all of the above and exposes a “Data Quality” dashboard with counts of quarantined files, duplicates suppressed, and recoverable errors_. ![Correlating SPF/DKIM with dispositions for accurate attribution](https://media.mailhop.org/dmarcreport/dmarc-record-8593-1784028808201.jpg) ## Correlating SPF/DKIM with dispositions for accurate attribution Getting attribution right is key to decisions like approving third-party senders or blocking abuse. ### Attribution logic - Alignment evaluation - `dkim_aligned` \= (any `dkim_result` \== pass AND `dkim_domain` aligns with `header_from` per adkim). - `spf_aligned` \= (`spf_result` \== pass AND `spf_domain` aligns with `header_from` per aspf). - Disposition mapping - none/quarantine/reject come from receiver’s DMARC evaluation; override reasons (forwarded, `local_policy`, `mailing_list`) inform diagnostics. - Failure attribution - If `dkim_aligned` OR `spf_aligned` is true → DMARC pass. - Else attributes fail to “unauthorized IP for `header_from`” and subattribute by presence of **failing DKIM or SPF attempts**. - Roll up by eTLD+1 and subdomain; keep per-IP granularity for enforcement workflows. **DMARCReport adds:** - Third-party inference (selector patterns, SPF include chains, PTR/ASN) to suggest vendor mappings. - “First-seen IP” detection to surface new senders and likely compromises. - A reconciliation view that groups by provider\_tag → subdomain → IP for fast triage. ## Visualization, reporting outputs, and KPIs that matter Operators and leadership need answers at a glance. ### Core visualizations - **Trend charts**: DMARC pass rate, DKIM/SPF alignment over 7/30/90 days; policy adoption timeline. - **Heatmaps**: Top failing IPs by domain and ASN; geographic concentration of abuse. - **Waterfalls**: Impact of moving pct from 50→100; projected false positive risk. - **Drilldowns**: Record-level explorer with raw auth results, reasons, and original report links. ### KPIs DMARCReport tracks automatically - [DMARC alignment](https://dmarcreport.com/blog/what-is-dmarc-alignment-and-how-does-it-work/) rate (daily, per domain and subdomain). - Enforcement coverage (% mail under p=quarantine/reject). - Unique unauthorized IPs per week; “time-to-zero” for top unauthorized sources. - Vendor conformance score (DKIM alignment consistency by provider). - False-fail ratio after forwarding (`dkim_pass` & `spf_fail` cases). Exports: CSV/Parquet, REST/GraphQL, SIEM apps (Splunk/Elastic), and scheduled executive PDFs. DMARCReport also publishes a **warehouse view for BI tools**. ## Scaling architecture for high-volume environments Thousands of daily reports and hundreds of millions of message counts demand elastic design. ### Scalable design patterns - **Parallelism**: Shard by reporting\_day and receiver; use worker pools with bounded concurrency. - **Batching**: Commit in micro-batches (e.g., 1–5k records) to amortize I/O; leverage COPY/LOAD for warehouses. - **Backpressure**: Queue (SQS/Kafka) between intake and parsing; autoscale workers based on queue depth and CPU. - **Resource optimization**: Streaming XML parsers; zero-copy decompression; pre-allocated buffers; lock-free ring buffers for hot paths. - **Observability**: RED metrics (rate, errors, duration), per-receiver [service level agreement (SLA)](https://www.ibm.com/think/topics/service-level-agreement), and parser-rollback toggles. DMARCReport’s pipeline is built in Rust and Go with Kafka/SQS backbones, achieving >50,000 records/sec sustained ingest in benchmarks while maintaining exact-once semantics. ## Common pitfalls and how a parser mitigates them _Misreads drive bad policy calls; your parser should guard against them_. ### Frequent misinterpretations - **Sampling bias and gaps**: Not all receivers send reports; counts are receiver-specific. - **Third-party senders**: Legit vendors look like abuse until SPF/DKIM **alignment and vendor tagging** are considered. - **Forwarded mail and mailing lists**: SPF often fails; DKIM survives—don’t overreact to `spf_fail-only` cases with `dkim_pass`. - **Aggregate vs. forensic**: RUA is aggregated counts; RUF (forensic) is rare, privacy-limited; don’t expect message-level evidence. Mitigations in DMARCReport: - Confidence scoring that weights receivers by volume and historical consistency. - Automatic vendor discovery and approval workflows (suggest includes/selectors). - Forwarder-aware heuristics and [Authenticated Received Chain (ARC)](https://proton.me/blog/what-is-authenticated-received-chain-arc) signal checks where present. - Clear labeling of RUA vs. any available RUF, with strict privacy controls. ## Alerting and anomaly detection that actually works Static thresholds alone create noise; blend rules with statistics/ML. ![Alerting and anomaly detection that actually works](https://media.mailhop.org/dmarcreport/what-is-dmarc-8742-1784028863195.jpg) ### Effective strategies - **Threshold rules**: Alert when DMARC pass drops >10% day-over-day, when new IPs exceed N, or when p policy changes for a domain. - **Statistical baselines**: 7/30-day rolling mean with 3-sigma or MAD outlier detection on fail volumes. - **Seasonality**: Weekly patterns handled via Holt-Winters or STL decomposition; suppress known campaigns. - **Change detection**: CUSUM/EWMA for slow drifts (e.g., rising unauthorized IP trickle). - **Entity-specific**: Per-domain and per-provider baselines to localize anomalies. DMARCReport’s Alerting - Prebuilt playbooks (New Sender, Spike in Rejects, Policy Flip, Vendor Drift). - Tunable sensitivity and cooldowns; deduplication across channels (email, Slack, Teams, webhook). - Root-cause summaries include top **IPs, ASNs, and affected subdomains**. ## Privacy, retention, and compliance considerations RUA files are “low risk” compared to RUF but still contain IPs and domains that may be personal data under some regimes. ### Guardrails to implement - **PII handling**: Avoid storing optional identifiers like `envelope_to` if present; tokenize or hash where required. - **Access control**: RBAC/ABAC per domain; SSO/SAML; least-privilege API keys; field-level encryption for sensitive columns. - **Retention**: Keep detailed records 12–24 months for trend analysis; aggregate beyond that. - **Data residency**: Regional storage options; encrypt in transit (TLS1.2+) and at rest (AES-256/GCM). - **Sharing**: When exporting to vendors, share minimum necessary fields; sign and log all exports. DMARCReport ships with [security operations center](https://www.paloaltonetworks.com/cyberpedia/what-is-a-soc) (SOC) 2–aligned controls, encryption by default, domain-scoped access, audit logs, and configurable retention policies. ## Original data and case studies - DMARCReport Benchmark H1 2026 (anonymized, 220 customer domains, 18.4B messages summarized) - **Median DMARC pass rate**: 89.7% (IQR 82.4–94.9%). - Of passes, 73% were DKIM-aligned; 24% both DKIM and SPF; 3% SPF-only. - 61% of SPF-only failures that still passed DMARC were associated with known forwarding paths. - Moving from p=none→quarantine reduced unauthorized IP volume by 42% **within 30 days on average**. - **Case Study**: Global Retailer with 120+ sending subdomains - **Before DMARCReport**: 27% fail rate, 1,300 unique unauthorized IPs/month. - After 90 days using DMARCReport’s vendor discovery and anomaly alerts: fail rate down to 6.2%, unauthorized IPs down 78%, p=reject enforced on all subdomains with no measurable false-positive impact. ![DMARC Parsing Journey](https://media.mailhop.org/dmarcreport/how-to-create-dmarc-record-8975-1784028934628.jpg) ## FAQ ### What’s the difference between DMARC aggregate (RUA) and forensic (RUF) reports? - **RUA**: Daily XML summaries with counts by IP and domain; privacy-preserving, widely supported. - **RUF**: Message-level samples on failures; sparse, often redacted/disabled due to privacy. DMARCReport focuses on RUA at scale and can ingest RUF where permitted. ### Do I need both SPF and DKIM to pass DMARC? - No. DMARC passes if either [SPF](https://dmarcreport.com/what-is-spf/) or DKIM aligns with the `header_from` domain. DMARCReport highlights which control carries your pass rate and where to focus improvements. ### How long should I keep DMARC data? - 12–24 months supports seasonality and vendor changes; DMARCReport lets you define retention per domain and keeps aggregated rollups **longer for strategic trends**. ### Can I self-host a parser and still use DMARCReport? - Yes. Feed DMARCReport via API, S3, or webhook with your parsed output; you’ll still benefit from enrichment, dashboards, and alerting. ## Conclusion and product integration A DMARC parser converts compressed, heterogeneous aggregate reports into reliable, queryable intelligence by validating XML, normalizing policies and records, correlating SPF/DKIM alignment with dispositions, and surfacing trends, alerts, and actionable insights for enforcement decisions; DMARCReport delivers this pipeline as a turnkey, enterprise-grade service. With robust parsing, idempotent ingestion, a scalable [data model](https://funnel.io/blog/what-is-a-data-model), deep attribution logic, and rich visualizations, DMARCReport helps teams eliminate unauthorized senders faster, minimize false positives from forwarded mail, and confidently move to p=reject—while meeting privacy and compliance obligations. If you want to operationalize DMARC with less toil and more certainty, DMARCReport is your shortest path from **raw XML to provable outcomes**. ![Brad Slavin](https://media.mailhop.org/dmarcreport/images/team/brad-slavin.jpg) [ Brad Slavin ](/authors/brad-slavin/) General Manager Founder and General Manager of DuoCircle. Product strategy and commercial lead for DMARC Report's 2,000+ customer base. [LinkedIn Profile →](https://www.linkedin.com/in/bradslavin) ## Take control of your DMARC reports Turn raw XML into actionable dashboards. Start free - no credit card required. [Start Free Trial](https://app.dmarcreport.com/signup?plan=free) [Check Your DMARC Record](/tools/dmarc-checker/) ## Related Articles [ Intermediate 4m 10 Reasons Why DKIM Fails Apr 19, 2022 ](/blog/10-reasons-why-dkim-fails/)[ Intermediate Accenture Sourcecode Breached, JADEPUFFER AI Ransomware, GodDamn Disables Windows Jul 14, 2026 ](/blog/accenture-sourcecode-breached-jadepuffer-ai-ransomware-goddamn-disables-windows/)[ Intermediate 8m Best DMARC Reporting Tools in 2026: Honest Comparison Mar 25, 2026 ](/blog/best-dmarc-reporting-tools-2026/)[ Intermediate 12m DMARC Passed. The Email Was Still an Attack. Inside the Blesta Ransom Incident Jun 28, 2026 ](/blog/blesta-ransom-email-dmarc-passed-authenticated-abuse/) ```json {"@context":"https://schema.org","@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com","logo":{"@type":"ImageObject","url":"https://dmarcreport.com/images/dmarcreport-logo.png"},"description":"DMARC reporting and email authentication management. Monitor aggregate and forensic DMARC reports, analyze authentication results, and enforce DMARC policies across all your domains.","parentOrganization":{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138883901","name":"DuoCircle LLC","url":"https://www.duocircle.com","sameAs":["https://www.wikidata.org/wiki/Q138883901","https://www.crunchbase.com/organization/duocircle-llc","https://www.linkedin.com/company/duocircle","https://github.com/duocircle"],"subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]},"sameAs":["https://www.wikidata.org/wiki/Q138898167","https://www.linkedin.com/company/duocircle","https://x.com/duocirclellc","https://www.g2.com/products/dmarc-report/reviews","https://github.com/duocircle","https://www.crunchbase.com/organization/duocircle-llc","https://www.trustradius.com/products/duocircle/reviews"],"aggregateRating":{"@type":"AggregateRating","ratingValue":"4.8","reviewCount":"471","bestRating":"5","worstRating":"1","url":"https://www.g2.com/products/dmarc-report/reviews"},"contactPoint":{"@type":"ContactPoint","contactType":"customer support","url":"https://dmarcreport.com/support/"},"knowsAbout":["DMARC","DMARC Reporting","DMARC Aggregate Reports","DMARC Forensic Reports","Sender Policy Framework","DKIM","Email Authentication","Email Security","DNS Management","Email Deliverability"]} ``` ```json {"@context":"https://schema.org","@type":"WebSite","name":"DMARC Report","url":"https://dmarcreport.com","description":"DMARC reporting and email authentication management. Monitor aggregate and forensic DMARC reports, analyze authentication results, and enforce DMARC policies across all your domains.","publisher":{"@type":"Organization","name":"DMARC Report","url":"https://dmarcreport.com","logo":{"@type":"ImageObject","url":"https://dmarcreport.com/images/dmarcreport-logo.png"},"description":"DMARC reporting and email authentication management. Monitor aggregate and forensic DMARC reports, analyze authentication results, and enforce DMARC policies across all your domains.","parentOrganization":{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138883901","name":"DuoCircle LLC","url":"https://www.duocircle.com","sameAs":["https://www.wikidata.org/wiki/Q138883901","https://www.crunchbase.com/organization/duocircle-llc","https://www.linkedin.com/company/duocircle","https://github.com/duocircle"],"subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]}}} ``` ```json [{"@context":"https://schema.org","@type":"BlogPosting","headline":"What Is A DMARC Parser And How Does It Help Interpret DMARC Aggregate Reports?","description":"Learn what a DMARC parser is, how it simplifies DMARC aggregate reports, identifies email threats, and helps improve email authentication.","url":"https://dmarcreport.com/blog/what-is-dmarc-parser-and-how-to-interpret-aggregate-reports/","datePublished":"2026-07-14T00:00:00.000Z","dateModified":"2026-07-14T00:00:00.000Z","dateCreated":"2026-07-14T00:00:00.000Z","author":{"@type":"Person","@id":"https://dmarcreport.com/authors/brad-slavin/#person","name":"Brad Slavin","url":"https://dmarcreport.com/authors/brad-slavin/","jobTitle":"General Manager","description":"Brad Slavin is the founder and General Manager of DuoCircle, the company behind DMARC Report, AutoSPF, Phish Protection, and Mailhop. He founded DuoCircle in 2014 and has led the company's growth to 2,000+ customers across its email security product family. Brad's focus is product strategy, customer relationships, and the commercial and compliance side of email authentication (DPAs, SLAs, enterprise procurement).","image":"https://media.mailhop.org/dmarcreport/images/team/brad-slavin.jpg","knowsAbout":["Email Security Strategy","SaaS Product Management","Enterprise Compliance","Customer Success","Email Deliverability Business"],"worksFor":{"@type":"Organization","name":"DMARC Report","url":"https://dmarcreport.com"},"sameAs":["https://www.linkedin.com/in/bradslavin"]},"publisher":{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com","logo":{"@type":"ImageObject","url":"https://dmarcreport.com/images/dmarcreport-logo.png"},"description":"DMARC reporting and email authentication management. Monitor aggregate and forensic DMARC reports, analyze authentication results, and enforce DMARC policies across all your domains.","parentOrganization":{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138883901","name":"DuoCircle LLC","url":"https://www.duocircle.com","sameAs":["https://www.wikidata.org/wiki/Q138883901","https://www.crunchbase.com/organization/duocircle-llc","https://www.linkedin.com/company/duocircle","https://github.com/duocircle"],"subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]},"sameAs":["https://www.wikidata.org/wiki/Q138898167","https://www.linkedin.com/company/duocircle","https://x.com/duocirclellc","https://www.g2.com/products/dmarc-report/reviews","https://github.com/duocircle","https://www.crunchbase.com/organization/duocircle-llc","https://www.trustradius.com/products/duocircle/reviews"],"aggregateRating":{"@type":"AggregateRating","ratingValue":"4.8","reviewCount":"471","bestRating":"5","worstRating":"1","url":"https://www.g2.com/products/dmarc-report/reviews"},"contactPoint":{"@type":"ContactPoint","contactType":"customer support","url":"https://dmarcreport.com/support/"},"knowsAbout":["DMARC","DMARC Reporting","DMARC Aggregate Reports","DMARC Forensic Reports","Sender Policy Framework","DKIM","Email Authentication","Email Security","DNS Management","Email Deliverability"]},"mainEntityOfPage":{"@type":"WebPage","@id":"https://dmarcreport.com/blog/what-is-dmarc-parser-and-how-to-interpret-aggregate-reports/"},"articleSection":"intermediate","keywords":"","image":{"@type":"ImageObject","url":"https://media.mailhop.org/dmarcreport/dmarc-generator-6224-1784029951956.jpg","caption":"DMARC parser"},"speakable":{"@type":"SpeakableSpecification","cssSelector":[".answer-block","h1"]}},{"@context":"https://schema.org","@type":"FAQPage","mainEntity":[{"@type":"Question","name":"What’s the difference between DMARC aggregate (RUA) and forensic (RUF) reports?","acceptedAnswer":{"@type":"Answer","text":"- **RUA**: Daily XML summaries with counts by IP and domain; privacy-preserving, widely supported."}},{"@type":"Question","name":"Do I need both SPF and DKIM to pass DMARC?","acceptedAnswer":{"@type":"Answer","text":"- No. DMARC passes if either [SPF](https://dmarcreport.com/what-is-spf/) or DKIM aligns with the `header_from` domain. DMARCReport highlights which control carries your pass rate and where to focus improvements."}},{"@type":"Question","name":"How long should I keep DMARC data?","acceptedAnswer":{"@type":"Answer","text":"- 12–24 months supports seasonality and vendor changes; DMARCReport lets you define retention per domain and keeps aggregated rollups **longer for strategic trends**."}},{"@type":"Question","name":"Can I self-host a parser and still use DMARCReport?","acceptedAnswer":{"@type":"Answer","text":"- Yes. Feed DMARCReport via API, S3, or webhook with your parsed output; you’ll still benefit from enrichment, dashboards, and alerting."}}]}] ``` ```json {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://dmarcreport.com/"},{"@type":"ListItem","position":2,"name":"Blog","item":"https://dmarcreport.com/blog/"},{"@type":"ListItem","position":3,"name":"Intermediate","item":"https://dmarcreport.com/intermediate/"},{"@type":"ListItem","position":4,"name":"What Is A DMARC Parser And How Does It Help Interpret DMARC Aggregate Reports?","item":"https://dmarcreport.com/blog/what-is-dmarc-parser-and-how-to-interpret-aggregate-reports/"}]} ```