# Sift DMARC Report Parser

> Sift DMARC Report Parser is a paid API for AI agents from sift.srv1996466.hstgr.cloud, paid per call via x402, $0.02/call, status unknown (last checked 2026-10-23).

Parses a DMARC aggregate report file (XML, GZ, ZIP, or EML) and returns a structured JSON or CSV summary with message counts, pass rates, and failure mode breakdowns.

## Facts

- Endpoint: GET https://sift.srv1996466.hstgr.cloud/v1/dmarc/parse?utm_source=zero.xyz
- Price: $0.02/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-23
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/sift-dmarc-report-parser-322ebde0
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_Tibos09VU_rGirBIBho9g

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability sift-dmarc-report-parser-322ebde0
```

Example prompt: Parse the DMARC aggregate report at https://example.com/reports/dmarc-2024-06-01.xml.gz and give me a JSON breakdown of the pass rate and failure modes.

## When to prefer this

Use this endpoint when you have a URL pointing to a DMARC aggregate report in any common format (XML, GZ, ZIP, EML) and need a structured, human-readable summary of authentication pass rates and failure modes. Prefer this over manual parsing or generic file-fetch tools because it understands DMARC semantics—SPF/DKIM alignment, per-source breakdowns—and returns a clean rollup without requiring custom parsing logic.

## Known failure modes

- Invalid or inaccessible report URL returns an error
- Unsupported file format (non-XML/GZ/ZIP/EML) causes a parse failure
- Malformed or empty DMARC report results in an error response
- Network timeout fetching the remote report URL
- Invalid format parameter value (not 'json' or 'csv') may cause unexpected behavior

## How this service works

DMARC aggregate report parser with real alignment checks (JSON or CSV). Reads a DMARC aggregate report URL (XML, .gz, .zip or the whole email). Computes SPF and DKIM alignment itself using the Public Suffix List, reports the receiver's verdict separately, flags disagreements, explains each failure in plain words, and rolls up pass rate, dispositions, failure modes and worst sources.

## Output

Returns a JSON (or CSV) rollup object containing the total message count, overall DMARC pass rate as a fraction, and a breakdown of failure modes with human-readable descriptions and per-mode message counts. Example fields: rollup.messages, rollup.pass_rate, rollup.failure_modes (keyed by description string, valued by count).

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method"
   ],
   "properties": {
    "type": {
     "type": "string",
     "const": "http"
    },
    "method": {
     "enum": [
      "GET",
      "HEAD",
      "DELETE"
     ],
     "type": "string"
    },
    "queryParams": {
     "type": "object",
     "required": [
      "url"
     ],
     "properties": {
      "url": {
       "type": "string",
       "description": "Report URL (xml, gz, zip or eml)"
      },
      "format": {
       "type": "string",
       "description": "json or csv (default json)"
      }
     }
    }
   },
   "additionalProperties": false
  },
  "output": {
   "type": "object",
   "required": [
    "type"
   ],
   "properties": {
    "type": {
     "type": "string"
    },
    "example": {
     "type": "object"
    }
   }
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "rollup": {
   "messages": 12,
   "pass_rate": 0.75,
   "failure_modes": {
    "SPF passed but for a domain not aligned with the From domain (third-party sender); no passing DKIM signature": 3
   }
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/sift-dmarc-report-parser-322ebde0/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from sift.srv1996466.hstgr.cloud](https://www.zero.xyz/host/sift.srv1996466.hstgr.cloud/llms.txt)