DMARC monitoring vs. self-hosted parsedmarc
Whenever DMARC monitoring comes up in a budget conversation, someone says it: we could just run parsedmarc. They are not wrong that they could, and parsedmarc is genuinely good open-source software. But 'a parser exists' and 'the problem is solved' are different claims, and the distance between them is exactly what you would be paying for. Here is the honest comparison, including the cases where self-hosting is the right call.
What parsedmarc is
parsedmarc is an open-source Python tool that does one job well: it ingests DMARC aggregate report files, the zipped XML attachments receivers email to your rua= address, and turns them into structured records. Point it at a mailbox, and it will parse what arrives. It is actively maintained, widely deployed, and free.
That job matters because raw aggregate reports are unreadable at any volume: dozens of receivers, each sending zipped XML on their own schedule, each row a source IP with pass/fail counts. Nobody reads these by hand. Everything in this category, open source or paid, starts by parsing them.
What the self-hosted stack actually involves
parsedmarc is a parser, not a product, and its own documentation is upfront about the supporting cast. A working deployment typically means: a dedicated mailbox the reports arrive in, with IMAP credentials the tool polls; somewhere for the parsed records to live, usually Elasticsearch or OpenSearch; Grafana or Kibana dashboards on top so a human can see trends; and a scheduler, plus monitoring for the pipeline itself, so you notice when ingestion silently stops. Each of those pieces needs patching, backups, and someone who owns it.
None of that is exotic. It is an afternoon to stand up for someone comfortable with the stack, and a permanent line on someone's maintenance list afterward. The real cost of self-hosting is never the install; it is the ownership.
What a parser does not do
The larger gap is what happens after parsing, because a dashboard of parsed rows still leaves every decision to you.
No verdicts
parsedmarc will show you that 203.0.113.7 sent 400 messages that failed alignment. It will not tell you whether that is a spoofer being blocked, a forwarder mangling your mail, or your own invoicing tool misconfigured, and those three cases demand opposite responses. Classifying sources is the actual skill in DMARC work, and with a raw parser it stays a human job.
No path to enforcement
The point of DMARC is reaching p=reject safely, and a parser has no opinion about when you are ready, what a stricter policy would have done to last month's mail, or what DNS change to make. There are no staged fixes, no undo, no record of what changed when.
No alerting, no reporting, no tenants
Out of the box there is nobody watching: no alert when a new sender appears or a source starts failing, no digest, no monthly summary a client or an executive could read, and no concept of separate customers with separate access. Consultancies and MSPs bolt all of this on themselves, which is how a free parser becomes an internal product with one maintainer.
When parsedmarc is the right call
Plenty of situations genuinely favor self-hosting, and pretending otherwise would be sales copy, not advice. Run parsedmarc when you have one or two domains and an engineer who enjoys owning the stack; when policy forbids report data leaving your infrastructure; when you already live in Elasticsearch and Grafana and one more index is genuinely cheap for you; or when the goal is learning what is in aggregate reports, where hand-building the pipeline teaches more than any product will.
The honest math
The comparison is not free versus paid. It is engineer-hours versus a published per-domain price. Self-hosting trades a small recurring fee for ingestion upkeep, dashboard care, and, above all, the analyst time to classify sources and drive the policy forward, every month, per domain. For one domain and a willing engineer that trade can be fine. Across a client book it rarely survives contact with a timesheet, which is why most teams that start on parsedmarc revisit the decision the first time a client asks "so are we protected now?" and the dashboard has no answer.
If you are weighing this for client domains specifically, the managed side of the comparison is on our MSP page, published pricing included. The parser is free either way: ours just comes with the verdicts, the fixes, and someone on call for the pipeline.
Keep reading
Was this page helpful?
Free for one domain. Set up in five minutes. We parse the reports; you read plain-English summaries.