Parse-DMARC MCP Server

Parse DMARC

• What it does
• Run it
• Get reports flowing
• Deploy anywhere
• Platform as a Service (PaaS)
• Self-hosted PaaS
• Infrastructure
• Configuration
• Metrics, Grafana and MCP
• Parse DMARC or DMARCguard?
• Roadmap and contributing
• License

Read your DMARC aggregate reports in one dashboard. One Go binary, SQLite, no Elasticsearch.

Parse DMARC is built and maintained by the team behind DMARCguard, a hosted DMARC monitoring service. The two do not share code, and this repository stays Apache-2.0 in full.

What it does

When your DMARC record carries a rua= address, mail receivers such as Google, Microsoft and Yahoo send you aggregate reports: gzip or zip XML attachments, usually once a day, listing every IP that sent mail as your domain and whether SPF and DKIM passed (RFC 7489 section 7.2, carried forward by RFC 9990). Nobody reads those by hand. Parse DMARC does:

• Fetches reports over IMAP from any mailbox, or from a local Maildir when the mail server is on the same host (MAILDIR_PATH, see Configuration). Reports that Exchange or Outlook forward as message/rfc822 attachments are unwrapped too.
• Parses gzip, zip and raw XML, with a 16 MB decompression cap per report.
• Stores everything in one SQLite file. No database server, no JVM.
• Shows pass rate, message volume and top sending sources, and opens any report down to its raw records.
• Generates your _dmarc TXT record from a form.
• Exposes 28 Prometheus metrics and ships a Grafana dashboard.
• Serves an MCP server, so an AI assistant can query your reports.
• Dark mode. One static binary in a minimal container image.

It reads aggregate (RUA) reports only. Failure reports (RUF), TLS-RPT, alerting, login and multi-mailbox intake are not built; see Roadmap and contributing.

Run it

Docker, with a named volume for the database:

docker run -d --name parse-dmarc -p 8080:8080 \

-e IMAP_HOST=imap.gmail.com \ -e IMAP_PORT=993 \ -e IMAP_USERNAME=dmarc@example.com \ -e IMAP_PASSWORD='your-app-password' \ -v parse-dmarc:/data \ dmarcguard/parse-dmarc

Homebrew on macOS or Linux:

brew install dmarcguardhq/tap/parse-dmarc

parse-dmarc --gen-config # writes a config.json template parse-dmarc --config config.json

Nix, from our NUR-style repo:

nix profile install github:dmarcguardhq/nur#parse-dmarc   # or: nix run github:dmarcguardhq/nur#parse-dmarc

Or download a release archive, parse-dmarc_ _ .tar.gz (.zip on Windows), from the releases page.

Open http://localhost:8080. Gmail needs an App Password, not the account password. The same image is on Docker Hub as meysam81/parse-dmarc; both names track the same builds, and tags such as v1 or v1.6.0 pin a release.

Get reports flowing

Receivers only send reports if your DMARC record asks for them. Publish this TXT record at _dmarc.example.com, with your own domain and mailbox:

v=DMARC1; p=none; rua=mailto:dmarc@example.com

• p=none asks receivers to deliver as usual and only report. Move to p=quarantine, then p=reject, once every legitimate sender in the reports passes (RFC 9989 section 5.1).
• rua= is the mailbox Parse DMARC reads. It has to exist and accept mail before the first report arrives.
• Check the record with dig +short TXT _dmarc.example.com. Reports typically start within 24 to 48 hours.

Cloudflare, Route 53 and every other DNS host take the same three fields: name _dmarc, type TXT, value as above. SPF and DKIM do not have to be set up first; the reports are how you find out what they are doing.

Deploy anywhere

One click on a platform, or a template for the self-hosted PaaS you already run. Every option needs the IMAP settings from Configuration.

Platform as a Service (PaaS)

Self-hosted PaaS

Infrastructure

Configuration

Every setting in this table is an environment variable or a key in config.json. Environment is read first and the file overrides it. The command-line flags further down take an environment variable but no config.json key.

| Seconds between fetches | FETCH_INTERVAL | 300