Parse and automate DMARC aggregate (rua) report ingestion

Steps

1. Add a rua=mailto:reports@yourdomain.com (or a dedicated third-party ingestion address) to your DMARC record so receiving servers know where to deliver daily XML reports.
2. Receiving servers send gzip-compressed XML attachments (.xml.gz or inside a .zip) once per day; set up a mailbox rule or IMAP fetch to land these in a processing folder.
3. For self-hosted parsing, use the open-source parsedmarc tool: it reads the XML schema, extracts per-source IP rows (spf_result, dkim_result, disposition, count), and can forward structured data to Elasticsearch or a Kafka topic.
4. Map each source IP to a known ESP or internal mail server using PTR lookups and a maintained allowlist; flag unknown IPs for investigation.
5. Build alerting on disposition=quarantine or disposition=reject rows with count > threshold to catch misconfigured or rogue senders quickly.
6. Archive raw XML for at least 30 days and retain parsed records for trend analysis; correlation across providers reveals SPF alignment gaps that single-provider views miss.