DMARC Report Analyzer

Private by design: report files are read, decompressed and parsed by JavaScript in this page, using your browser's own DOMParser and DecompressionStream. Nothing is uploaded or sent anywhere, so it is safe to use with real reports.

You can also drop files onto this box. Up to 50 MB at a time (compressed and uncompressed). Load sample fills in two made-up reports for example.com that use documentation IP addresses (192.0.2.x, 198.51.100.x, 203.0.113.x and 2001:db8::).

What the report fields mean

• report_metadata: who sent the report (org_name, email), its report_id and the date_range it covers (begin and end in seconds since 1970, UTC).
• policy_published: the DMARC record the receiver found: domain, p, sp, adkim, aspf and pct (RFC 7489), plus np, testing and discovery_method in the newer RFC 9990 format.
• row: one sending IP (source_ip), how many messages it sent (count) and policy_evaluated: the disposition the receiver applied (none, quarantine or reject; RFC 9990 adds pass) and the aligned DKIM and SPF results (pass or fail). A message passes DMARC when either of those is pass.
• reason (optional): why the receiver did not apply your policy as published. RFC 7489 types are forwarded, sampled_out (left out by pct), trusted_forwarder, mailing_list, local_policy and other; RFC 9990 drops forwarded and sampled_out and adds policy_test_mode.
• identifiers: header_from (the From domain people see) and envelope_from (the Return-Path / MAIL FROM domain).
• auth_results: the raw DKIM results (signing domain d=, selector s=, result) and SPF result (domain, scope, result) before alignment. A pass here that is a fail in policy_evaluated means the domain did not align with header_from.

How to use it

1. Find the reports. Receivers such as Google, Microsoft and Yahoo send them to the address in your DMARC record's rua= tag, usually once a day each. Every report is an email with an XML attachment, normally gzip-compressed (.xml.gz); some receivers send a .zip instead. Getting none? Check that your record has rua=mailto: with the DMARC Record Checker.
2. Load them. Save the attachments and choose them here (select a whole week at once) or drop them on the box. There is no need to unzip them. You can also paste the XML.
3. Read the summary and findings. The DMARC pass rate counts messages where SPF or DKIM passed and aligned with the From domain, as the receiver evaluated it. Findings list sources that failed both, SPF or DKIM passes that didn't align, forwarding and mailing-list hints, and policy advice.
4. Work through the sources table. One row per sending IP, busiest first. For each failing source, work out who it is (the ASN IP Lookup shows which network owns an IP). If it is a service you use, set it up to sign DKIM with your domain or use a Return-Path in your domain. If you don't recognise it, it is probably spoofing, which p=quarantine or p=reject will stop.
5. Forwarders and mailing lists. Rows with reason forwarded, trusted_forwarder or mailing_list, and unfamiliar IPs where only DKIM passed, are usually mail that recipients forwarded or lists reposted. Read why DMARC fails after forwarding or on mailing lists before moving to p=reject.
6. Export. Download CSV saves one line per report record for a spreadsheet.
7. Not covered: this page does no reverse DNS or IP owner lookups (that would send your IPs to a third party), and it reads aggregate (rua) XML only, not failure (ruf) reports or TLS-RPT JSON reports.

Audit hundreds of domains at once

Need SPF, DMARC and MX checks across a whole client list? Run the Bulk SPF / DMARC / MX Auditor on Apify ($2 per 1,000 domains).

Related tools and guides

Check the live record with the DMARC Record Checker and build the next one (quarantine, reject, pct, rua) with the DMARC Record Generator. Test SPF, DKIM, DMARC and MX together with the Email Deliverability Checker, and see how one message was authenticated with the Email Header Analyzer. Step-by-step rollouts: DMARC for Microsoft 365, SPF, DKIM and DMARC for Google Workspace and the Gmail, Yahoo and Outlook bulk sender rules.

FAQ

What is a DMARC aggregate (rua) report?

An XML file that a receiving mail system (Google, Microsoft, Yahoo and others) sends to the address in your DMARC record's rua= tag, usually once a day. It lists every IP address that sent mail using your domain in the From address, how many messages each sent, the SPF and DKIM results, and what the receiver did with the mail. It contains no message content.

Are my DMARC reports uploaded anywhere?

No. The files are read, decompressed and parsed by JavaScript inside this page using the browser's own DOMParser and DecompressionStream. Nothing is sent to this site or any other server, and the page does no DNS or IP lookups on the data.

How do I open a DMARC report .gz or .zip file?

Choose or drop it on this page as it is; there is no need to extract it first. Reports are normally gzip-compressed XML (.xml.gz), and some receivers send a .zip instead. To read one by hand, extract it with 7-Zip, gunzip or tar and open the .xml file in a text editor.

Why does a report show SPF or DKIM pass but DMARC fail?

DMARC only counts a pass that aligns with the From domain. The auth_results part of the report shows raw SPF and DKIM results, and policy_evaluated shows the aligned ones. If an email service sends with its own bounce domain or signs with its own d= domain, SPF or DKIM passes for that domain, but DMARC still fails until it signs with your domain or uses a Return-Path in your domain.

When can I move from p=none to p=quarantine or p=reject?

When a few weeks of reports, including month-end runs, show every legitimate source passing aligned SPF or DKIM, and the only failing sources are ones you don't recognise. Then publish p=quarantine, check the reports again, and finish at p=reject.

Want the full kit?

Runbooks, checklists and helpdesk templates: IT Admin Packs on Gumroad.