~/tools / dmarc-report-analyzer

DMARC Report Analyzer

Upload or paste one DMARC aggregate report (the XML that lands in your rua mailbox) and get it read: who sent as your domain, how much, what aligned, what did not, and what to do about it. Handles .xml, .gz and .zip. No signup.

upload_report
or_paste_xml
[ try a sample report ] // .xml, .xml.gz or .zip exactly as the receiver mailed it. One report at a time. Nothing is stored.
[ what_is_a_dmarc_aggregate_report ]

Publish a DMARC record with rua=mailto:... and every large receiver (Gmail, Microsoft, Yahoo, GMX, Mail.ru and many more) mails that address one report a day: an XML file, usually gzipped or zipped, named receiver!yourdomain!begin!end.xml. It contains no message content - only, for each IP that sent mail claiming your domain, how many messages arrived, whether SPF and DKIM aligned with your domain, and what the receiver did with the mail under your published policy.

That table is the only honest way to a stricter policy. Before p=quarantine you need to know every legitimate source is aligned - the reports name the ones that are not, before your customers' mail starts going to spam.

[ how_to_read_the_columns ]
source
The sending IP, with its reverse DNS name when it has one. A mail service you use shows its own name here (google.com, amazonses.com, outbound.protection.outlook.com).
dkim / spf
The domain each leg authenticated. DMARC passes only if at least one of them aligns with the From domain - a DKIM pass signed by amazonses.com does not count for yourdomain.com.
disposition
What the receiver did: none (delivered), quarantine (spam folder) or reject. Under p=none it is always none, even for failures.
forwarded
A message forwarded by a mailbox (a Gmail filter, a mailing list) keeps its DKIM signature but loses SPF. DMARC still passes on the DKIM leg. Not a problem to fix.
unaligned service
A known mail provider sending as your domain without an aligned identity: it is set up, but not with your DKIM key or SPF include. Finish its setup and the failures stop.
unknown
No aligned leg and no recognisable name. Spoofing, or a server of yours that nobody documented. Either way, this is what p=reject exists for - once every legitimate source is aligned.
[ faq ]

Why do I get so many of these? One per receiver per day, per domain. Ten domains with DMARC and five big receivers is fifty XML files a day. That is why they go to a dedicated mailbox and why people stop reading them by hand within a week.

Is my data stored? No. The report is parsed in memory, the page is rendered, and the file is gone. The only thing logged is that the tool ran, with the domain the report was about.

Can I upload several at once? Not here - one report at a time. Reading across days and receivers is what continuous monitoring is for.

What about ruf= (forensic) reports? Different format, almost no receiver sends them any more. This tool reads aggregate (rua) reports only.