DMARC Report Analyser
Read a DMARC aggregate (RUA) report in plain English.
Drop a DMARC aggregate report (RUA) and read it in plain English: who sent mail as your domain, how much passed authentication and which sources are failing. Everything runs in your browser. No file is uploaded and nothing is stored.
Drop your DMARC report here
or choose a file. Supports .xml and .xml.gz. Zipped reports need to be unzipped first.
Aggregate reports arrive at the address in your DMARC rua= tag, usually once a day from each mailbox provider. The file is an XML document, often compressed as .xml.gz.
The DMARC Report Analyser takes a raw aggregate (RUA) report, the gzipped XML that mailbox providers send to your rua address, and translates it into plain English. Instead of reading nested XML tags, you see which sources sent mail as your domain, how many messages passed or failed, and whether SPF and DKIM aligned.
What an aggregate report contains
Each report covers a time window from one receiver, such as Google or Microsoft. It lists sending IP addresses, the message volume from each, the DMARC result applied, and the underlying SPF and DKIM outcomes, including whether the authenticated domain aligned with the visible From address. Aggregate reports never contain message content; that is the role of forensic (ruf) reports.
How to act on what you see
Group the sources into three buckets and respond accordingly:
- Your legitimate senders failing alignment, for example a marketing platform or helpdesk. Fix these by adding the source to SPF or setting up DKIM signing for your domain before you enforce.
- Forwarders that break SPF but where DKIM survives. These are usually fine, because DMARC passes if either method aligns.
- Unknown IPs failing everything, which is likely spoofing and exactly what a
rejectpolicy will stop.
Once every genuine source passes, you can confidently move the policy from p=none through quarantine to reject. Working through reports by hand is laborious across many domains, which is why DMARC Engine aggregates them for you; see how the audit works or start at signup.
Frequently asked questions
What format does an aggregate report arrive in?
It is an XML file, almost always compressed as .gz or .zip and sent as an email attachment to your rua address. Paste or upload the XML here and the analyser presents it in readable rows rather than raw tags.
Why does a source pass DMARC when SPF fails?
DMARC passes if either SPF or DKIM aligns with the From domain, so both are not required. A forwarded message often breaks the SPF path but keeps its valid DKIM signature, so it still passes overall. This is why DKIM signing makes enforcement far more robust.
Will these reports show me the content of spoofed emails?
No. Aggregate reports contain only counts, IP addresses and authentication results, never subject lines or bodies. Message-level detail comes from forensic (ruf) reports, which are far less commonly sent by receivers.
I see lots of failing IPs I don't recognise. Am I being spoofed?
Possibly, but not always. Some are abusers spoofing your domain, which a reject policy stops; others are forgotten legitimate services or auto-forwarders. Identify each source before enforcing so you do not block your own mail.
How often do reports arrive?
Most large receivers send one aggregate report per day per domain, covering a 24-hour window. Volumes and timing vary by provider, so build a picture over one to two weeks rather than judging from a single report.
What is the difference between policy_evaluated and the auth results?
The auth results show the raw SPF and DKIM outcomes and whether each aligned. policy_evaluated shows what the receiver actually did after applying your DMARC policy and any pct sampling. The two can differ when overrides like forwarding or a partial percentage are in play.