Open Source Tools for Parsing and Visualizing DMARC XML Data

An open source dmarc parser is a specialized utility or script designed to ingest, process, and present DMARC XML aggregate reports in a human-readable or visually structured format. Because raw DMARC reports arrive as compressed XML attachments from email receivers like Google, Microsoft, and Yahoo, they are nearly impossible to read manually at scale. By deploying an open-source parsing solution, you can automatically ingest these files, track authentication trends, and catch domain impersonation attempts without relying on expensive commercial subscriptions.

Before you can analyze incoming DMARC reports, you need to ensure your domain publishes a valid DMARC policy that instructs mailbox providers where to send those XML files. You can easily build a compliant policy using the Dmarc Generator tool to quickly construct your raw TXT record without syntax errors.

Understanding DMARC XML Aggregate Reports

When you implement a DMARC record on your domain (such as _dmarc.example.com), you specify a rua= tag containing one or more reporting email addresses. Throughout each day, participating mail servers collect telemetry data regarding emails claiming to be from your domain and bundle them into compressed XML files.

These aggregate reports contain crucial technical metadata:

• Source IP Address: The connecting server that transmitted the email.
• Volume: The total number of messages attempted from that IP.
• SPF Alignment: Whether the return-path domain aligns with the header From domain and passes validation.
• DKIM Alignment: Whether the signing domain (d=) aligns with the header From domain and verifies successfully.
• Policy Evaluation: How the receiving mail server handled the message based on your specified p= (policy) and sp= (subdomain policy) tags.

Structure of a Raw DMARC Report

If you extract an XML report, you will find a structured hierarchy that isolates metadata, policy definitions, and record-level evaluations. A truncated snippet of a typical report looks like this:

<feedback>
  <report_metadata>
    <org_name>example.com</org_name>
    <email>dmarc-support@example.com</email>
    <report_id>1234567890</report_id>
    <date_range>
      <begin>1711929600</begin>
      <end>1720016000</end>
    </date_range>
  </report_metadata>
  <policy_published>
    <domain>example.com</domain>
    <p>none</p>
    <sp>none</sp>
    <pct>100</pct>
  </policy_published>
  <record>
    <row>
      <source_ip>192.0.2.1</source_ip>
      <count>150</count>
      <policy_evaluated>
        <spf>pass</spf>
        <dkim>pass</dkim>
      </policy_evaluated>
    </row>
  </record>
</feedback>

Popular Open Source DMARC Parsers

Several open-source projects exist to lift the burden of manual XML inspection. Choosing the right one depends on your infrastructure stack, self-hosting capabilities, and whether you prefer a web-based dashboard or a command-line tool.

Setting Up Parsedmarc

parsedmarc is arguably the most robust and widely adopted open-source DMARC report parser available. Written in Python, it can pull reports via IMAP, parse local XML files, and output structured JSON or populate a database for visualization.

Step 1: Install Python and Pip

Ensure you have Python 3.8 or newer installed on your system. You can verify this via your terminal:

python3 --version

Step 2: Install Parsedmarc via Pip

Run the following command to install the package globally or inside a virtual environment:

pip install parsedmarc

Step 3: Configure Your Settings

Create a configuration file named config.ini in your working directory to handle automated retrieval from an inbox:

[imap]
host = imap.example.com
user = dmarc@example.com
password = secure_password
ssl = True

[save]
output_directory = /var/log/dmarc_reports/

Step 4: Execute the Parser

To process a local directory of downloaded XML or GZIP report files, run:

parsedmarc --indir /var/log/dmarc_reports/

Visualizing DMARC Data with Grafana and Elasticsearch

For enterprise environments handling millions of messages daily, raw JSON output is insufficient. The gold standard open-source architecture pairs parsedmarc with Elasticsearch and Grafana.

1. Ingestion: parsedmarc connects to your IMAP collection mailbox, parses incoming XML attachments, and writes the structured records directly into an Elasticsearch index.
2. Storage: Elasticsearch indexes the source IPs, alignment statuses, and message counts for lightning-fast querying.
3. Visualization: Grafana connects to Elasticsearch as a data source, allowing you to build rich dashboards featuring pie charts of passing vs failing traffic, geographic maps of sending IPs, and timeline graphs of domain spoofing attacks.

Step-by-Step Implementation Guide

If you want to quickly test parsing a single XML file on your local workstation without setting up a full database, follow these steps:

1. Download or save a sample DMARC XML report file as report.xml.
2. Open your command line interface.
3. Run the interactive Python parser or use the CLI command to convert it to JSON:

parsedmarc report.xml --json > output.json

4. Inspect the resulting JSON file using jq or any text editor to verify the authentication results of sending servers within your network ranges (such as 2001:db8::/32).

Common Mistakes and How to Fix Them

When deploying open-source DMARC parsers, administrators frequently run into configuration pitfalls that block data visibility.

• Failure to Handle Compressed Reports: Mail servers almost always send DMARC reports wrapped in .zip or .gz archives. Ensure your chosen parser natively handles extraction before attempting to read the XML.
• IMAP Folder Mismatch: If your parser is configured to look in the INBOX but your email provider's filtering rules automatically move DMARC emails to a subfolder, the parser will return zero results. Always specify the exact folder path.
• Incorrect Time Zones: DMARC XML files record timestamps in Unix epoch time. Ensure your visualization layer applies your local time zone correctly so trends align with business hours.
• Overlooking SPF/DKIM Misalignments: Many beginners panic when they see failing records in their parser dashboard. Remember that third-party mailing vendors often fail SPF alignment due to envelope sender mismatches; rely on DKIM passing in these scenarios.

DMARC Parsing Checklist

• Published a valid DMARC record with a rua tag pointing to a dedicated reporting mailbox.
• Selected an open-source parsing tool that matches your infrastructure capabilities.
• Configured automated report ingestion via IMAP or local directory monitoring.
• Integrated a database or logging backend for long-term historical trend analysis.
• Built a visualization dashboard to monitor external sending sources and block spoofing attempts.