Turn a raw DMARC aggregate (rua) report into a readable breakdown - every source sending as your domain, whether SPF and DKIM align, and what to fix. Paste the XML or upload the .xml, .gz, or .zip. It's parsed in your browser; nothing is uploaded.
Parsed entirely in your browser - the report is never uploaded or stored. Aggregate reports contain only per-source counts and SPF/DKIM results, never message contents or recipient addresses.
DMARC aggregate reports arrive daily by email (as .xml, .xml.gz, or .zip) once you publish a rua= address. Drop one in above to see every source sending as your domain and whether it passes DMARC.
What the report is telling you
Each row groups mail by the server that sent it. For every source you get the message count, the SPF and DKIM alignment result, and the policy that was applied. A healthy domain shows nearly all volume passing from a handful of known senders. Anything unaligned is either a legitimate service you still need to authenticate, or someone spoofing you - and you want to know which before you tighten your policy.
From monitoring to enforcement
Most domains start at p=none - monitoring only. The reports are how you safely get to enforcement: watch them until every legitimate source aligns, then step the policy to quarantine and finally reject. Build the record with the DMARC record generator, confirm what's published with the domain health check, and if a sender is failing SPF, fix it with the SPF record generator.
DMARC report analyzer FAQ
Once you publish a DMARC record with a rua= address, mailbox providers (Google, Microsoft, Yahoo, and others) send you a daily XML report summarizing all the mail they saw claiming to be from your domain - grouped by sending source, with the SPF and DKIM alignment result and how many messages each source sent. They're the feedback loop that tells you who is sending as you and whether it passes authentication.
No. Aggregate reports are counts and metadata only - sending IP, message volume, and SPF/DKIM pass/fail per source. They never contain message subjects, bodies, or recipient addresses. (That's the separate, rarely-sent 'forensic' or RUF report, which this tool does not handle.) This analyzer also parses everything in your browser and uploads nothing.
Yes. Upload the file as-is - the analyzer decompresses .gz and single-file .zip attachments in your browser. You can also just paste the raw XML if you've already extracted it.
DMARC passes if either SPF or DKIM passes AND is aligned - meaning the authenticated domain matches your From domain. A source can fail SPF but still pass DMARC because its DKIM signature aligns (common for services like SendGrid that send from their own return-path but sign as you), and vice versa. You only need one aligned pass, so a source showing one aligned mechanism is authenticating correctly.
Not necessarily. Failing sources fall into two buckets: legitimate services you haven't authenticated yet (your CRM, invoicing, or a marketing platform whose SPF/DKIM you need to add), and genuine unauthorized senders spoofing your domain. Identify each source before you move your policy toward enforcement - enforcing while a legitimate sender is unaligned will send your own mail to spam.
Authenticated - now keep the list clean
Passing DMARC gets you to the inbox; a clean list keeps you there. Verify and clean yours - start free with 100 credits, no card required.
