DMARC Report Analyzer
Upload or paste one DMARC aggregate report (the XML that lands in your rua mailbox) and get it read: who sent as your domain, how much, what aligned, what did not, and what to do about it. Handles .xml, .gz and .zip. No signup.
- Domain
- example.com
- Reporter
- google.com
- Window (UTC)
- 2026-08-29 00:00 to 2026-08-29 23:59
- Policy (p=)
- none
- Subdomains (sp=)
- none
- pct=
- 100
- Alignment
- dkim=r spf=r
- Messages
- 59
- Passed DMARC
- 47 (80%)
- Failed
- 12
- Disposition
- none=59
| Source | Who | Messages | DKIM | SPF | Verdict |
|---|---|---|---|---|---|
| 203.0.113.7 | - | 47 | example.com s=google |
example.com, forwarder.example.net | Aligned 5 forwarded on with SPF broken; DKIM carried them. |
| 198.51.100.23 | Amazon SES | 9 | amazonses.com s=224i4yxa5dv7c2xz3womw6peuasteono |
amazonses.com | Unaligned service |
| 192.0.2.99 | - | 3 | - | somewhere-else.net | Unknown |
- Do not tighten the policy yet: every failing source above would be quarantined the moment you do.
- Amazon SES: Amazon SES sends as example.com without an aligned identity. Add its DKIM record for your domain (it signed as amazonses.com) and include it in your SPF.
- 192.0.2.99: No aligned identity and no name. Either someone is spoofing example.com, or a server of yours nobody documented is still sending.
One report is one receiver, one day. Receivers only count what they saw; a source that mails only Outlook users will never appear in Google's report.
What is a DMARC aggregate report
Publish a DMARC record with rua=mailto:... and every large receiver (Gmail, Microsoft, Yahoo, GMX, Mail.ru and many more) mails that address one report a day: an XML file, usually gzipped or zipped, named receiver!yourdomain!begin!end.xml. It contains no message content, only, for each IP that sent mail claiming your domain, how many messages arrived, whether SPF and DKIM aligned with your domain, and what the receiver did with the mail under your published policy.
That table is the only honest way to a stricter policy. Before p=quarantine you need to know every legitimate source is aligned. The reports name the ones that are not, before your customers' mail starts going to spam.
How to read the columns
- Source
- The sending IP, with its reverse DNS name when it has one. A mail service you use shows its own name here (google.com, amazonses.com, outbound.protection.outlook.com).
- DKIM and SPF
- The domain each leg authenticated. DMARC passes only if at least one of them aligns with the From domain: a DKIM pass signed by amazonses.com does not count for yourdomain.com.
- Disposition
- What the receiver did: none (delivered), quarantine (spam folder) or reject. Under p=none it is always none, even for failures.
- Forwarded
- A message forwarded by a mailbox keeps its DKIM signature but loses SPF. DMARC still passes on the DKIM leg. Not a problem to fix.
- Unaligned service
- A known mail provider sending as your domain without an aligned identity: set up, but not with your DKIM key or SPF include. Finish its setup and the failures stop.
- Unknown
- No aligned leg and no recognisable name. Spoofing, or a server of yours that nobody documented. This is what p=reject exists for, once every legitimate source is aligned.
Questions
Why do I get so many of these? One per receiver per day, per domain. Ten domains with DMARC and five big receivers is fifty XML files a day. That is why they go to a dedicated mailbox and why people stop reading them by hand within a week.
Is my data stored? No. The report is parsed in memory, the page is rendered, and the file is gone. The only thing logged is that the tool ran, with the domain the report was about.
Can I upload several at once? Not here, one report at a time. Reading across days and receivers is what continuous monitoring is for.
What about ruf (forensic) reports? Different format, and almost no receiver sends them any more. This tool reads aggregate (rua) reports only.