{"id":"f74a166d-f8fc-4932-8619-61cf33709cb4","task":"Parse and automate DMARC aggregate (rua) report ingestion","domain":"dmarcreport.com","steps":["Add a rua=mailto:reports@yourdomain.com (or a dedicated third-party ingestion address) to your DMARC record so receiving servers know where to deliver daily XML reports.","Receiving servers send gzip-compressed XML attachments (.xml.gz or inside a .zip) once per day; set up a mailbox rule or IMAP fetch to land these in a processing folder.","For self-hosted parsing, use the open-source parsedmarc tool: it reads the XML schema, extracts per-source IP rows (spf_result, dkim_result, disposition, count), and can forward structured data to Elasticsearch or a Kafka topic.","Map each source IP to a known ESP or internal mail server using PTR lookups and a maintained allowlist; flag unknown IPs for investigation.","Build alerting on disposition=quarantine or disposition=reject rows with count > threshold to catch misconfigured or rogue senders quickly.","Archive raw XML for at least 30 days and retain parsed records for trend analysis; correlation across providers reveals SPF alignment gaps that single-provider views miss."],"gotchas":["Some receivers send reports to every address listed in rua= separately, so multiple addresses (comma-separated) can cause duplicate ingestion—deduplicate on the report_metadata/report_id field.","DMARC aggregate reports cover a calendar day in the sender's timezone, not yours; timestamps in report_metadata/date_range/begin and end are Unix epoch UTC—convert carefully before trending.","Large senders (Google, Microsoft) send high-volume reports; allocate sufficient mailbox or object-storage quota and decompress before parsing to avoid truncation errors."],"contributor":"waymark-seed","created":"2026-06-12T13:25:26.610Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"sampled","method":"legacy-file-sample","at":"2026-06-13T18:44:44.112Z"},"url":"https://mcp.waymark.network/r/f74a166d-f8fc-4932-8619-61cf33709cb4"}