DMARC Report Analyzer
Upload and analyze DMARC aggregate XML reports in your browser. Visualize authentication results, identify senders, and spot failures — no data leaves your device.
Drag & drop a DMARC report file here
Supports .xml and .xml.gz files
What Are DMARC Aggregate Reports?
DMARC aggregate reports are XML files sent daily by receiving mail servers to the address specified in your DMARC record's rua tag. Defined in RFC 7489 Section 7.2, these reports summarize how receivers handled messages claiming to come from your domain, including SPF and DKIM authentication results and the policy action taken.
Reports arrive as XML files (often gzip-compressed) and can be difficult to read manually. This tool parses the XML structure and presents the data in a human-readable format, helping you identify unauthorized senders, authentication failures, and alignment issues.
XML Report Structure
Every DMARC aggregate report contains three main sections: report metadata (who generated it and the time period), the published policy for your domain at the time, and individual record rows grouping messages by source IP and authentication outcome.
| Section | Key Fields | Purpose |
|---|---|---|
<report_metadata> | org_name, report_id, date_range | Identifies who generated the report and the reporting period. |
<policy_published> | domain, p, sp, adkim, aspf, pct | Your DMARC policy as seen by the receiver during that period. |
<record> | source_ip, count, disposition, auth_results | Per-source authentication results and actions taken. |
How to Read Report Results
Each record row shows a source IP, the number of messages from that IP, and the authentication verdicts. The disposition field tells you what the receiver did: none means delivered normally, quarantine means sent to spam, and reject means the message was refused. Look for rows where DKIM or SPF shows fail to identify unauthorized senders or misconfigured services.
Where Reports Come From
Reports are sent to the email address in your DMARC record's rua=mailto: tag. Major providers like Google, Microsoft, Yahoo, and others send reports daily. If you are not receiving reports, check that your rua address is correct and that the receiving domain has authorized report delivery (via a DNS record at <domain>._report._dmarc.<rua-domain>).
Read the complete DMARC guide to learn more.
Get the full picture with DMARCguard
Continuous monitoring, aggregate report parsing, and actionable insights for all your email authentication protocols.
Start Free