Postscale
Sign Up

DMARC Reporting API

Point your RUA mailbox at Postscale. Daily aggregate reports arrive parsed and queryable: by source, by policy outcome, by DKIM/SPF alignment. Stop opening XML by hand.

Get started free See DMARC docs

Everything the product needs. Nothing it does not.

A focused API surface with production controls, predictable resources, and the operational visibility to run email confidently.

01

Parsed aggregate reports

Upload or receive RUA XML reports and get structured JSON: per-source IP counts, DKIM/SPF alignment, and policy evaluation.

02

Per-domain dashboards

Group results by your own sending domain. Identify unauthorized senders and deliverability drift before reputation damage.

03

Unauthorized-source alerts

Webhook when a new IP starts sending under your domain or when SPF/DKIM pass rate crosses a threshold. Catch spoofing attempts day one.

04

Historical trend API

Query pass/fail rates over time to measure DMARC enforcement progress from p=none → quarantine → reject.

05

Receive RUA or POST XML

Give Postscale a dedicated RUA address, or POST existing reports to the API. Works with any DMARC-receiving setup.

06

EU-hosted, GDPR-friendly

Primary report service data is hosted in the EU/EEA. IP addresses are retained per your retention policy, and subprocessors are documented.

Start with one request.

The public API uses explicit resources and familiar JSON. Move from a first request to production without changing integration models.

See DMARC docs
cURL: parse a DMARC aggregate report ready
curl -X POST https://api.postscale.io/v1/dmarc/reports \
  -H "Authorization: Bearer ps_live_..." \
  -H "Content-Type: application/xml" \
  --data-binary @report.xml

# Response (abridged)
{
  "report_id": "rpt_01HY...",
  "domain": "yourapp.com",
  "date_range": {
    "begin": "2026-04-15T00:00:00Z",
    "end": "2026-04-16T00:00:00Z"
  },
  "records": [
    {
      "source_ip": "185.12.14.5",
      "count": 412,
      "dkim": "pass",
      "spf": "pass",
      "policy_evaluated": "none"
    }
  ]
}

Further reading

01

How to parse DMARC aggregate reports (RUA) programmatically

The full workflow from receiving zipped XML to actionable per-source insights, with SQL examples.

Read more
02

SPF, DKIM, and DMARC: the 2026 setup guide

Ground-up authentication setup that feeds clean DMARC reports instead of noise.

Read more
03

Inbound Email API

Use the same webhook pipeline to catch DMARC RUA mailbox submissions without running a mailbox.

Read more

Frequently asked questions

What are RUA and RUF reports?

RUA is the aggregate DMARC report: a daily XML summary of all mail claiming to be from your domain, grouped by source. RUF is forensic (per-message) reports. Postscale parses RUA; RUF support is on the roadmap.

Do I need to change my DMARC record?

Only the rua= tag. Point it at the address Postscale gives you, or keep your current mailbox and POST the reports to our API. Either works.

Can this help me move from p=none to p=reject?

Yes: that's the core use case. You see which sources are aligned and which aren't, fix the gaps, then tighten policy without breaking legitimate mail.

What does it cost?

DMARC reporting is included on paid plans. Free domains can still publish a DMARC policy, but Postscale RUA collection, dashboards, and API access require an upgrade.

Build the email workflow your product needs.

The free tier includes everything required to evaluate the API. No credit card required.

Create a free account