parsedmarc

What it is and what it does

parsedmarc is a Python module and CLI tool that extracts structured data from DMARC aggregate and failure reports, as well as SMTP TLS Reporting (TLS-RPT) messages. It handles the parsing of multiple DMARC schema versions (legacy draft, RFC 7489, RFC 9989/9990) and transparently decompresses gzip or zip archives. The tool can retrieve reports directly from mailboxes via IMAP, Microsoft Graph, or Gmail API, then normalize the results into consistent data structures.

The package is designed as a self-hosted alternative to commercial DMARC report processing services. It outputs results as JSON or CSV and can forward them to multiple backends—Elasticsearch, OpenSearch, Splunk, PostgreSQL, Apache Kafka, Amazon S3, Azure Log Analytics, Graylog, syslog, or HTTP webhooks—enabling integration with existing monitoring and analytics platforms. It is actively maintained, production-stable, and supports current Python versions (3.10 through 3.14).

Use it for:

• Ingest DMARC reports from an email inbox and load them into Elasticsearch/Kibana for dashboard monitoring of email authentication failures.
• Parse forensic (failure) DMARC reports to investigate specific email authentication incidents and identify spoofing attempts.
• Automate DMARC report collection and export to CSV or JSON for compliance auditing and historical record-keeping.
• Forward parsed DMARC and TLS-RPT data to Splunk or Azure Sentinel for centralized security event correlation.
• Stream DMARC report results to Apache Kafka or Amazon S3 for downstream processing in data pipelines.

Worth the install?

AI-flagged interpretation of the facts on this page — verify before relying

Parses DMARC, TLS-RPT, and related email authentication reports from multiple sources (IMAP, Microsoft Graph, Gmail API) and exports results to JSON, CSV, Elasticsearch, OpenSearch, Splunk, PostgreSQL, Kafka, S3, Azure, Graylog, syslog, or HTTP webhooks.

Yes. parsedmarc is actively maintained (release 17 days ago), production-stable, permissively licensed, and has low install friction. It fills a clear need for organizations that want to self-host DMARC report processing without commercial services. The broad export backend support (Elasticsearch, Splunk, PostgreSQL, Kafka, S3, Azure, etc.) makes it adaptable to existing infrastructure. Install it if you manage email domains and need structured DMARC analytics.

Install

parsedmarc on PyPI

pip install parsedmarc

uv add parsedmarc

poetry add parsedmarc

Installing parsedmarc

Before you install

Low friction install with a pure-Python wheel. Actively maintained with a release 17 days ago. Requires Python 3.10 or later; 19 runtime dependencies cover email access, data parsing, and multiple export backends.

License in practice

Apache-2.0 (permissive) allows commercial and private use with attribution; no restrictions on modification or redistribution.

Quickstart

pip install parsedmarc

from parsedmarc import parse_report_file
results = parse_report_file('dmarc_report.xml')
print(results)

Requires Python 3.10 or later. Optional: IMAP, Microsoft Graph, or Gmail API credentials if parsing from mailboxes; Elasticsearch/OpenSearch/Splunk/PostgreSQL for result storage.

Verify before relying

• Exact feature coverage for RFC 9989 and RFC 9990 DMARC schema support beyond the description excerpt
• Performance characteristics when processing large volumes of reports
• Whether all 19 runtime dependencies are required or conditionally installed based on export backend choice

Package facts

Evidence: parsedmarc-10.4.1-py3-none-any.whl

Keywords: DMARC, parser, reporting

Tags

More Monitoring packages