Who sent the report
The receiver’s organization (e.g. google.com or Enterprise Outlook), a contact address, a unique report ID and the date range as Unix timestamps.
Free tool · private
Free DMARC report analyzer
DMARC aggregate reports are hard to read: compressed XML full of IP addresses. Drop them here to see who sends e-mail as your domain, how much of it passes DMARC and which sources fail — before you move your policy to quarantine or reject.
Runs 100% in your browser — nothing is uploaded
Or paste the XML
🔒 Private by design: reports are decompressed and analyzed in your browser and never uploaded.
Reports
| Reporter | Domain | Period | Policy | Messages | Report ID |
|---|
Sending sources (by IP)
| Source IP | Messages | DMARC | Aligned | Auth results | Header From | Disposition |
|---|
What to do with failing sources
- Recognize the service (newsletter tool, CRM, helpdesk, billing)? Set up DKIM with your domain in that service and, if it supports it, a custom return-path on your domain.
- Failures from Google, Microsoft or other mailbox providers with DKIM passing are usually forwarding — no action needed.
- Unknown IPs that fail both DKIM and SPF are likely spoofing. They are exactly what p=quarantine and p=reject will stop.
- Re-check after changes: new reports arrive daily. When legitimate volume passes consistently, tighten the policy.
→ DMARC record generator · SPF record generator · SPF, DKIM & DMARC checker
Authentication is half of deliverability — the other half is your list
Create free account — 200 credits Perfect SPF, DKIM and DMARC do not stop bounces. Sending to invalid, disposable or abandoned addresses hurts your sender reputation just as much. Validate your list before the next campaign.
How the DMARC report analyzer works
- 1
Collect the reports
Receivers such as Google, Microsoft and Yahoo send them daily to the rua address in your DMARC record, usually as .zip or .gz attachments.
- 2
Drop the files
Select one or many files — XML, .gz or .zip. They are decompressed and parsed in your browser; nothing is uploaded.
- 3
Read the summary
See total messages, the share passing DMARC, aligned DKIM and SPF rates and the dispositions applied by receivers.
- 4
Fix the failing sources
Each source IP is listed with its volume and results. Legitimate services that fail need DKIM or SPF; unknown ones may be spoofing.
What is inside a DMARC aggregate report
The format is defined in RFC 7489 (Appendix C). Every report covers one domain, one receiver and one period — usually 24 hours.
Your DMARC record, as they saw it
The domain, p, sp, pct and the adkim/aspf alignment modes the receiver found in DNS when it evaluated your mail.
The DMARC verdict per source
For each source IP: the number of messages, the disposition applied (none, quarantine, reject) and whether DKIM and SPF passed with alignment. DMARC passes if either one does.
The raw SPF and DKIM checks
The domains that were actually checked and their results, before alignment. A DKIM pass for another domain or an SPF pass for a platform’s bounce domain explains most “fail” rows.
Frequently asked questions
Are my DMARC reports uploaded?
No. Files are read, decompressed and parsed in your browser with built-in APIs. Nothing is sent to our servers, so you can safely open reports that contain your infrastructure’s IP addresses.
Which file formats are supported?
Plain XML, gzip (.gz, .xml.gz — typical of Microsoft and Yahoo) and ZIP (.zip — typical of Google), several files at once. Decompression uses your browser’s built-in DecompressionStream, available in all current versions of Chrome, Edge, Firefox and Safari. If yours is older, unzip the file first and drop the .xml.
Why do some legitimate sources fail DMARC?
Usually because the service sends with its own domain: SPF passes for its bounce domain and DKIM signs with its domain, so neither aligns with your From domain. Set up DKIM with your domain in that service (or a custom return-path) and the rows turn green.
What does the disposition mean?
What the receiver did with the messages: none (delivered normally), quarantine (spam folder) or reject. With p=none it is always none; the column shows what would change when you tighten the policy.
Why is forwarded mail failing?
When a mailing list or a forwarding rule resends a message, the new server’s IP is not in your SPF, so SPF fails. DKIM usually survives forwarding, so a passing DKIM signature keeps DMARC passing. Small numbers of SPF-only failures from mailbox providers are normal.
How do I get DMARC reports?
Add a rua tag to your DMARC record, e.g. rua=mailto:[email protected]. Our free DMARC generator builds the record for you. Reports start arriving within a day or two from every provider that receives your mail.
When can I move to p=reject?
When the reports show that practically all of your legitimate volume passes DMARC for a few weeks and the remaining failures are unknown sources or forwarding. Go through p=quarantine first, optionally with pct.
Authenticated domain + clean list = inbox
A free account gives you 200 credits to validate e-mail lists in bulk, through the REST API or in real time on your forms.
Create free account — 200 creditsNo credit card. Credits never expire.