Every mailbox provider sends you DMARC aggregate reports — a daily list of every server sending as your domain, including the spoofers. Almost nobody reads them. DmarcWatch does.

Features

• Upload .xml, .xml.gz or .zip exactly as Google and Microsoft send them
• WHO sends as your domain: every source IP with volume and SPF/DKIM alignment
• Spoofing detection: sources failing both aligned mechanisms at volume become a High finding with the fix
• New-sender alerts the week a source starts sending
• Readiness verdict: at 98%+ alignment across reporters it tells you plainly when p=quarantine, then p=reject, is safe
• Catches reports that stop arriving (a broken rua= looks like “all clear”)
• Findings to webhook or syslog (Loglight)

Server requirements

• Linux x86-64; single static binary or Docker
• Measured: ~10 MB binary, ~10 MB RAM idle, SQLite file — no database server
• Minimum host: 1 vCPU, 512 MB RAM, 500 MB disk (parsed reports are small; history is the only growth)
• Dashboard 127.0.0.1:8429; no inbound ports; no outbound needed unless you enable alerts

Tiers. Free: 1 domain (GitHub). Pro: 10 domains, 365-day history, email/Slack/Telegram, on-demand rescan. Team: unlimited, PagerDuty/Teams, multi-user. 14-day trial.

Self-hosted, offline-first, no telemetry, offline licence activation.

Whop sells paid licences only. Free: github.com/nizartuanku/dmarcwatch