Every mailbox provider sends you DMARC aggregate reports — a daily list of every server sending as your domain, including the spoofers. Almost nobody reads them. DmarcWatch does.

Features

• Upload .xml, .xml.gz or .zip exactly as Google and Microsoft send them
• WHO sends as your domain: every source IP with volume and SPF/DKIM alignment
• Spoofing detection: sources failing both aligned mechanisms at volume become a High finding with the fix
• New-sender alerts the week a source starts sending
• Readiness verdict: at 98%+ alignment across reporters it tells you plainly when p=quarantine, then p=reject, is safe
• Catches reports that stop arriving (a broken rua= looks like “all clear”)

Server

• Linux x86-64; static binary or Docker
• ~10 MB binary, ~10 MB RAM idle, SQLite (no DB server)
• Minimum host: 1 vCPU, 512 MB RAM, 500 MB disk (parsed reports are small; history is the only growth)
• Dashboard 127.0.0.1:8429; no inbound ports; no outbound needed unless you enable alerts

Tiers. Free: 1 domain (GitHub). Pro: 10 domains, 365-day history, email/Slack/Telegram, on-demand rescan. Team: unlimited, PagerDuty/Teams, multi-user. 14-day trial.

Wazuh/Splunk-ready, every tier: file, syslog JSON/CEF, Splunk HEC; free Wazuh rules + Splunk add-on on GitHub.

AI Assist (optional, offline): explains any finding on your hardware; the engine decides.

Whop sells paid licences only. Free: github.com/nizartuanku/dmarcwatch