DMARC report analyser
Drop the DMARC aggregate reports that arrive at your rua address. See who is sending email as your domain, what is failing and why, and what to fix before you tighten your policy.
Drop report files here
Accepts .xml, .xml.gz and .zip files, as many as you like. Duplicate reports are skipped.
Files are read in your browser and never uploaded. Nothing in them is sent anywhere or kept.
How this tool works
Your browser unpacks each file (gzip and zip files included), reads the XML and adds up every record. Nothing is uploaded: the files never leave your device, and closing the page forgets them.
- Pass or fail comes from each receiver's own verdict in the report. DMARC passes when DKIM or SPF passes and its domain aligns with the domain in the From address.
- Alignment is checked the way your policy asks: relaxed (the default) lets
mail.example.co.ukmatchexample.co.uk, strict needs an exact match. Two-part endings such as.co.ukand.com.auare handled. - Diagnosis explains each failure: a service signing with its own domain instead of yours, SPF passing for the service's bounce domain, your own DKIM signature broken by forwarding, or no authentication at all (spoofing, or a sender you haven't set up). Mail that passes on SPF alone is flagged, because it fails as soon as it's forwarded.
- Sender names are best guesses from DKIM selectors, the authenticated domains and some well-known IP ranges (Google, Microsoft 365, SendGrid, Amazon SES, Mailchimp, Postmark, Zoho and others).
It reads DMARC aggregate (rua) reports, including the newer DMARCbis format. Forensic (ruf) failure reports use a different format and aren't supported.
What are DMARC aggregate reports?
When your domain has a DMARC record with a rua tag, big mailbox providers such as Google, Microsoft and Yahoo send a daily XML report to that address. Each one lists the IP addresses that sent email using your domain, how many messages each sent, and whether they passed SPF, DKIM and DMARC. They contain no message content. Most arrive zipped or gzipped as an email attachment.
Pointing rua at an address
Add a rua tag with a mailto: address to the DMARC TXT record at _dmarc.yourdomain, for example:
A separate mailbox or alias is best, because a busy domain gets many reports a day. You can list more than one address, separated by commas. The DMARC record generator builds the whole record for you, and the email DNS checker shows what's published now.
Sending reports to a different domain
If the reports go to an address on another domain (say example.co.uk sends them to reports@example-mail.com), receivers first check that the other domain agrees to take them. That domain must publish a TXT record named example.co.uk._report._dmarc.example-mail.com containing:
Without it, most receivers silently drop the reports. Reporting services usually set this up for you.
What none, quarantine and reject mean
p=none: monitor only. Failing mail is delivered as normal, and you just get reports. The right place to start.p=quarantine: failing mail goes to spam or junk. Addpct=25to apply it to a quarter of failing mail at first, then raise it.p=reject: failing mail is refused outright, so spoofed email using your domain never arrives. The goal once every legitimate sender passes.
Tips for reading DMARC reports
- Collect at least two weeks. Some senders (invoicing systems, monthly newsletters) only send now and then, so a few days of reports can miss them.
- Fix the big legitimate senders first. For each service that sends as you, turn on custom DKIM signing with your domain. It survives forwarding, unlike SPF.
- Don't chase forwarding failures. A small number of failures where your own DKIM signature broke is normal: mailing lists and forwarders change messages.
- Unknown IPs with no authentication are usually spoofing. That's what
quarantineandrejectare for. - Tighten in steps. Move from
nonetoquarantinewith a lowpct, then to 100, then toreject, checking reports at each step.
Frequently asked questions
Are my report files uploaded anywhere?
No. The files are opened and analysed by your own browser. Nothing in them, and nothing worked out from them, is sent to our server or anyone else, and nothing is stored. Closing or reloading the page forgets them. Like every page on this site, the page itself counts visits with privacy-friendly statistics, which never see your files.
Why does a message show as failing when SPF passed?
DMARC needs SPF to pass for a domain that matches the From address. Many sending services use their own bounce domain (such as bounces.sendgrid.net), so SPF passes for them, not for you. The fix is usually to set up custom DKIM for your domain with that service, or a custom return-path on your own domain.
What does "your DKIM signature failed to verify" mean?
The message was signed with your domain, but something changed it on the way, most often a mailing list adding a footer or a forwarding service. It's normal in small numbers and usually nothing to fix.
Why are some senders "Unrecognised"?
The tool names senders from DKIM selectors, domains and a short list of well-known IP ranges. An unrecognised source that passes is probably a service or server of yours we don't know about. One that fails with no authentication at all is usually someone spoofing your domain.
I dropped the email and got an error. What should I do?
The tool needs the attachment, not the email it came in. Save the .zip, .gz or .xml attachment from the report email and drop that file instead.
Can I look at several domains at once?
Yes. Drop reports for as many domains as you like, then choose one from the domain list to look at it on its own.
What's in the CSV file?
One row per sending IP address: the sender name, message count, how many passed DMARC, the pass rate, the From, DKIM and SPF domains seen, which receivers reported it, and the diagnosis. It opens in Excel, Numbers or Google Sheets.