📊 DMARC Report Analyzer

Upload a DMARC aggregate (RUA) report to see every source sending as your domain and which ones fail SPF, DKIM or DMARC.

What Is a DMARC Aggregate (RUA) Report?

Once you publish a DMARC record with rua=mailto:you@example.com, receiving providers (Google, Microsoft, Yahoo…) send you a daily aggregate report — an XML file, usually compressed (Google sends a .zip, Microsoft an .xml.gz), summarising every source that sent mail claiming to be from your domain. There's no message content, just statistics. These reports show:

Which servers are sending email claiming to be from your domain
SPF and DKIM authentication results for those emails
Alignment status — whether the authentication passed your DMARC policy
Volume metrics — how many emails passed or failed

DMARC also defines forensic (RUF) reports — per-message samples — but those are rarely sent today for privacy reasons. When people say "DMARC reports," they almost always mean aggregate/RUA, which is what this tool parses.

Reading Your Results, Column by Column

Upload a report and the Email Sources table breaks every sending IP down like this:

Source IP — the server that sent the mail. Recognise it as your provider, a marketing platform you use, or something unfamiliar (a potential spoofer).
Count — how many messages that IP sent in the window. A big count from an unknown IP is a red flag.
DMARC — the overall verdict: did the mail pass DMARC (an aligned SPF or DKIM pass)?
SPF / DKIM — the raw authentication results, before alignment. none under DKIM means the mail wasn't signed.
Disposition — what the receiver actually did: none (delivered), quarantine (spam), or reject (blocked), based on your published policy.

💡 Pass ≠ aligned.

A source can show SPF pass yet DMARC fail — because the SPF domain didn't match your visible From: domain. That gap is alignment, and it's the most common surprise in a DMARC report. Our guide walks through it field by field: How to read a DMARC report.

A Practical Workflow

Sort the sources into three buckets and act on the middle one:

✅ Known IP, DMARC pass — healthy, nothing to do.
⚠️ Known service, DMARC fail — fix its SPF include or DKIM signing so it aligns.
🚩 Unknown IP, DMARC fail — likely spoofing; this is what DMARC protects against.

Get every legitimate source passing first, then tighten your policy from p=none → quarantine → reject. Don't enforce while real senders are still failing.

Frequently Asked Questions

Can I upload the .zip or .gz file from the email?

Yes. Upload the attachment exactly as it arrived: a .zip, a .gz / .xml.gz, or the extracted .xml. The analyzer detects the format and decompresses it for you. Files up to 10 MB are accepted (25 MB once decompressed).

Is my report uploaded or stored?

The file is sent over HTTPS, parsed in memory to build your results page, and then discarded — it isn't saved. Like every DNSLens tool, the run itself is logged (time, IP address and country), but not the file or anything in it.

Why does a source show SPF pass but DMARC fail?

DMARC needs alignment: SPF must pass for a domain that matches your From: domain, or a DKIM signature must pass with a matching d= domain. Email services often pass SPF for their own bounce domain, so the SPF result is pass but DMARC still fails. Fix it by enabling DKIM signing with your own domain at that service (or a custom return-path). See DMARC alignment explained.

Where do DMARC reports come from?

Receiving mail providers (Google, Microsoft, Yahoo, etc.) generate them and send them to the address in your DMARC record's rua= tag — typically once per day, per domain.

Is this DMARC report analyzer free?

Yes, completely free — no account and no sign-up.

What's the difference between RUA and RUF reports?

RUA (aggregate) reports are daily statistical summaries with no message content — the ones this tool parses. RUF (forensic) reports are per-message samples and are rarely sent today.