📊 DMARC Report Analyzer

Upload and parse DMARC aggregate reports (RUA) to identify email authentication issues.

What Is a DMARC Aggregate (RUA) Report?

Once you publish a DMARC record with rua=mailto:you@example.com, receiving providers (Google, Microsoft, Yahoo…) send you a daily aggregate report — an XML file (often .xml.gz) summarising every source that sent mail claiming to be from your domain. There's no message content, just statistics. These reports show:

Which servers are sending email claiming to be from your domain
SPF and DKIM authentication results for those emails
Alignment status — whether the authentication passed your DMARC policy
Volume metrics — how many emails passed or failed

DMARC also defines forensic (RUF) reports — per-message samples — but those are rarely sent today for privacy reasons. When people say "DMARC reports," they almost always mean aggregate/RUA, which is what this tool parses.

Reading Your Results, Column by Column

Upload a report and the Email Sources table breaks every sending IP down like this:

Source IP — the server that sent the mail. Recognise it as your provider, a marketing platform you use, or something unfamiliar (a potential spoofer).
Count — how many messages that IP sent in the window. A big count from an unknown IP is a red flag.
DMARC — the overall verdict: did the mail pass DMARC (an aligned SPF or DKIM pass)?
SPF / DKIM — the individual authentication results behind that verdict.
Disposition — what the receiver actually did: none (delivered), quarantine (spam), or reject (blocked), based on your published policy.

💡 Pass ≠ aligned.

A source can show SPF pass yet DMARC fail — because the SPF domain didn't match your visible From: domain. That gap is alignment, and it's the most common surprise in a DMARC report. Our guide walks through it field by field: How to read a DMARC report.

A Practical Workflow

Sort the sources into three buckets and act on the middle one:

✅ Known IP, DMARC pass — healthy, nothing to do.
⚠️ Known service, DMARC fail — fix its SPF include or DKIM signing so it aligns.
🚩 Unknown IP, DMARC fail — likely spoofing; this is what DMARC protects against.

Get every legitimate source passing first, then tighten your policy from p=none → quarantine → reject. Don't enforce while real senders are still failing.

Frequently Asked Questions

How do I read a DMARC XML report?

Upload it here and read the Email Sources table — identify each source IP, its message count, and its DMARC/SPF/DKIM result. For a field-by-field breakdown of the raw XML, see how to read a DMARC report.

Where do DMARC reports come from?

Receiving mail providers (Google, Microsoft, Yahoo, etc.) generate them and send them to the address in your DMARC record's rua= tag — typically once per day, per domain.

Is this DMARC report analyzer free?

Yes, completely free. Upload an aggregate XML report and it's parsed in your browser session — no account, no limits.

What's the difference between RUA and RUF reports?

RUA (aggregate) reports are daily statistical summaries with no message content — the ones this tool parses. RUF (forensic) reports are per-message samples and are rarely sent today.