DMARC Report Analyzer 🔐 — Parse XML Reports & Score Email Security Posture

Parse DMARC aggregate and forensic XML reports into structured JSON. Score domain email security posture (SPF, DKIM, DMARC alignment), detect unauthorized senders, and export actionable dashboards. No external API needed.

---

What does it do?

DMARC Report Analyzer ingests DMARC aggregate reports (generated by mailbox providers like Google, Microsoft, Yahoo) and forensic failure reports, and converts them into clean, structured JSON. It also provides a domain security scoring engine that evaluates SPF alignment, DKIM alignment, DMARC compliance, and policy strictness to produce a 0-100 security score with actionable recommendations.

Who is it for?

Persona	Use Case
Security Engineer	Monitor email authentication health across multiple domains, detect unauthorized senders
DevOps/SRE	Automate DMARC report parsing in CI/CD pipelines, integrate with security dashboards
Compliance Officer	Generate evidence of DMARC enforcement for regulatory audits (GDPR, PCI DSS, HIPAA)
Email Deliverability Consultant	Analyze client DMARC reports, identify SPF/DKIM alignment issues, recommend fixes
Penetration Tester	Assess domain email security posture, identify spoofing vulnerabilities

---

✨ Features

• Parse single DMARC aggregate report — Extract metadata, published policy, and all record rows with authentication results
• Parse DMARC forensic reports — Extract failure details: auth failure type, DKIM/SPF specifics, identity alignment
• Auto-detect report type — Automatically distinguishes aggregate vs. forensic XML without user input
• Batch parsing — Process up to 50 reports in a single run from URLs or inline XML, with concurrent fetching
• Domain security score — 0-100 scoring based on SPF alignment (25%), DKIM alignment (25%), DMARC compliance (30%), and policy strictness (20%)
• Security rating system — Critical (0-29), Weak (30-49), Moderate (50-69), Strong (70-100)
• Unauthorized sender detection — Lists all unique sending IPs that failed authentication
• Actionable recommendations — Generates tailored advice to improve email security posture
• Gzip decompression — Automatically handles gzip-encoded XML reports fetched from URLs
• Namespace-agnostic parsing — Handles both namespaced and bare XML tags from different reporters
• Structured JSON output — Clean, schema-validated results ready for pipeline consumption

---

🚀 Quick Start

Parse a single report from a URL

{
  "mode": "parse",
  "xmlUrl": "https://example.com/dmarc-report.xml"
}

Parse inline XML

{
  "mode": "parse",
  "xmlInput": "<?xml version=\"1.0\" encoding=\"UTF-8\"?><feedback>...</feedback>"
}

Batch parse multiple reports

{
  "mode": "batch",
  "batchUrls": [
    "https://reports.google.com/dmarc/example.com/1.xml",
    "https://reports.google.com/dmarc/example.com/2.xml"
  ]
}

Analyze domain security

{
  "mode": "analyze",
  "domain": "example.com",
  "batchUrls": [
    "https://reports.google.com/dmarc/example.com/recent.xml"
  ]
}

---

📋 Input Parameters

Parameter	Type	Default	Description
mode	string	"parse"	Operation mode: parse, batch, or analyze
xmlInput	string	""	Raw DMARC XML report to parse (inline)
xmlUrl	string	""	URL to a DMARC XML report to fetch and parse
forceType	string	""	Force report type: "aggregate" or "forensic" (empty = auto-detect)
batchUrls	array	[]	List of URLs to DMARC XML reports for batch processing
batchXmls	array	[]	List of inline DMARC XML reports for batch processing
domain	string	""	Target domain for security analysis (inferred from reports if omitted)
parsedData	array	[]	Pre-parsed DMARC record objects (bypasses XML parsing)

---

📤 Output Format

Parse mode (single report)

{
  "mode": "parse",
  "success": true,
  "report_type": "aggregate",
  "metadata": {
    "org": { "name": "google.com", "email": "noreply@dmarc.google.com" },
    "report_id": "12345",
    "date_range_begin": "2025-01-01T00:00:00+00:00",
    "date_range_end": "2025-01-02T00:00:00+00:00"
  },
  "policy_published": {
    "domain": "example.com",
    "p": "none",
    "sp": "none",
    "pct": 100
  },
  "records": [
    {
      "row": {
        "source_ip": "203.0.113.5",
        "count": 150,
        "disposition": "none",
        "dkim_aligned": true,
        "spf_aligned": true
      }
    }
  ],
  "record_count": 1
}

Analyze mode

{
  "mode": "analyze",
  "success": true,
  "domain": "example.com",
  "security_score": 72,
  "security_rating": "Strong",
  "spf_alignment_rate": 85.5,
  "dkim_alignment_rate": 92.3,
  "dmarc_compliance_rate": 88.0,
  "total_messages": 1500,
  "unauthorized_senders": ["198.51.100.7", "192.0.2.99"],
  "recommendations": [
    "Improve SPF alignment: ensure all sending sources are listed in your SPF record..."
  ]
}

---

🎯 Use Cases

• Email security monitoring — Regularly fetch DMARC reports from mailbox providers and track authentication metrics over time
• Domain takeover detection — Identify unauthorized senders attempting to spoof your domain
• Compliance automation — Generate DMARC compliance reports for auditors without manual XML processing
• Security consulting — Analyze client domains, produce professional security posture reports with recommendations
• CI/CD integration — Include DMARC report parsing in your deployment pipeline to catch misconfigurations before they affect deliverability

---

💎 Premium Features

This actor includes premium charge events:

Event	Description
apify-actor-start	Charged on every run
batch-processing	Charged when using batch mode
security-score-analysis	Charged when using analyze mode
forensic-parsing	Charged when forensic reports are detected

---

🧪 Local Testing

You can test this actor locally without an Apify account using the apify SDK in local mode:

import asyncio
from apify import Actor

async def test():
    async with Actor:
        from main import parse_dmarc_report
        with open("sample_dmarc.xml") as f:
            result = parse_dmarc_report(f.read())
        print(f"Parsed {result['record_count']} records")

asyncio.run(test())

Or set the APIFY_LOCAL_STORAGE_DIR environment variable to use local storage:

export APIFY_LOCAL_STORAGE_DIR=./apify_local
python3 main.py

---

🛡️ Security Considerations

• The actor only makes outbound HTTP requests to URLs you explicitly provide
• No API keys or external services are required
• All XML parsing happens locally in-process
• Reports are processed in memory and are not stored on any external server

---

📜 Changelog

1.0.0

• Initial release
• Parse single DMARC aggregate report XML into structured JSON
• Parse single DMARC forensic (failure) report XML
• Auto-detect aggregate vs. forensic report type
• Batch parsing of multiple reports from URLs or inline XML
• Domain security score analysis with SPF, DKIM, DMARC alignment rates
• Unauthorized sender detection and IP enumeration
• Security rating engine (Critical / Weak / Moderate / Strong)
• Actionable security recommendations generation
• Gzip decompression support for fetched reports
• Comprehensive XML validation with detailed error reporting
• Namespace-agnostic XML parsing (handles both prefixed and bare tags)
• Structured dataclass models for all DMARC report components

---

❓ FAQ

What is a DMARC report?

DMARC reports are XML files generated by mailbox providers (Google, Microsoft, Yahoo, etc.) that show how email receivers evaluated messages claiming to be from your domain. Aggregate reports summarize authentication results over a period, while forensic reports contain details about individual failed messages.

Does this actor require any API keys?

No. The DMARC Report Analyzer is fully self-contained. It does not call any external APIs beyond fetching XML reports from URLs you explicitly provide.

How is the security score calculated?

The security score (0–100) is a weighted composite:

• SPF alignment rate (25%)
• DKIM alignment rate (25%)
• DMARC compliance rate (30%)
• Policy strictness (20%)

The score maps to ratings: Critical (0–29), Weak (30–49), Moderate (50–69), Strong (70–100).

What is the maximum XML file size?

The actor accepts DMARC XML reports up to 10 MB in size. Larger files will be rejected with a clear error message.

Can I process multiple domains at once?

Yes. Use mode: "batch" with a list of batchUrls. The actor will parse all reports concurrently and return individual results for each.

What happens if the XML is malformed?

The actor performs a well-formedness check before parsing. If the XML is invalid, it returns a detailed error message describing the parse failure.

🔌 MCP Integration

The DMARC Report Analyzer can be integrated with the Model Context Protocol (MCP) for AI-assisted security analysis workflows:

MCP Server Setup

{
  "mcpServers": {
    "dmarc-analyzer": {
      "command": "apify",
      "args": ["run", "-a", "dmarc-report-analyzer"],
      "env": {
        "APIFY_TOKEN": "${APIFY_TOKEN}"
      }
    }
  }
}

Example MCP Tool Call

{
  "mode": "analyze",
  "domain": "example.com",
  "batchUrls": ["https://reports.google.com/dmarc/example.com/recent.xml"]
}

The actor returns structured JSON that an AI agent can consume to generate natural-language security assessments, track trends over time, or integrate into automated incident response pipelines.

🔑 SEO Keywords

DMARC report parser, DMARC XML parser, email security analyzer, SPF DKIM DMARC alignment, domain security score, DMARC aggregate report, DMARC forensic report, email authentication analysis, DMARC compliance tool, unauthorized sender detection, DMARC XML to JSON, email spoofing detection, DMARC batch parser, DMARC security analysis, DMARC report analyzer Apify

🧰 Related Tools

• Email Security Analyzer — Comprehensive email authentication and security analysis
• DNS Records Inspector — Inspect A, AAAA, MX, TXT, NS, CNAME records for any domain
• Domain Intel — Domain intelligence gathering and reconnaissance
• SSL Certificate Checker — Inspect and validate SSL/TLS certificates
• All perryay actors — Browse the full collection