Free DMARC Report Analyzer
Drop a DMARC aggregate report (XML or .gz) and instantly see senders, pass rates, alignment, and per-record details.
What is a DMARC Aggregate Report?
When you publish a DMARC record with a rua= address, receiving mail servers email you a daily summary of every message claiming to be from your domain. These XML files are how you find out who is sending mail as you - your own infrastructure, your authorized vendors, and anyone trying to spoof your domain.
Each report contains source IPs, message volumes, the SPF and DKIM results, whether each result aligned with the From header, and the policy that was applied. Reading them by hand is painful. This tool gives you the same view you would get from a paid DMARC monitoring platform - for a single report, on demand.
How to Read the Results
Pass Rate
Percentage of messages that passed DMARC (SPF or DKIM aligned). Healthy domains sit at 99%+. Anything lower means real legitimate mail is failing - or someone is spoofing you.
Passed but Unaligned
SPF or DKIM passed for a different domain than the From header. Common with third-party senders. Fix it by adding a custom return-path or DKIM signing on your domain.
Top Source IPs
Where your traffic comes from, with reverse-DNS hostnames. If you see IPs you don't recognize sending mail at scale, that is your spoofing problem.
Per-Record Details
Expand any row to see DKIM signing domains, selectors, the SPF return-path domain, and the From header. This is how you trace a failure back to a specific service.
One report at a time is fine. Hundreds per day is not.
DMARC Report ingests every aggregate and forensic report automatically, classifies senders by vendor, tracks pass rates over time, and tells you when something changes. Free plan covers 1 domain and 10,000 monthly reports.
Frequently Asked Questions
What is a DMARC aggregate report?
A DMARC aggregate report (RUA) is an XML file sent daily by receiving mail servers like Google, Microsoft, and Yahoo to the address listed in your DMARC record. It contains a summary of every authentication result for messages claiming to be from your domain - source IPs, message counts, SPF and DKIM results, alignment status, and the policy applied.
Is my report uploaded to a server?
No. The DMARC Report Analyzer parses your XML file entirely in your browser using JavaScript. Nothing is sent to a server, stored, or logged. You can verify this by opening your browser DevTools and watching the Network tab while you upload a file.
What file formats are supported?
You can upload uncompressed .xml files or gzipped .xml.gz files. Most mail providers email reports as .xml.gz attachments - drop them in directly without extracting. Encrypted .zip archives are not yet supported; please extract the .xml first.
What does "aligned" vs "not aligned" mean?
DMARC alignment means the domain in the SPF or DKIM check matches the domain in the From header. SPF can pass on its own, but only "aligned" SPF helps DMARC. The same applies to DKIM. A message can pass DMARC if either SPF or DKIM passes AND aligns - so unaligned passes are not protective.
Why does an SPF result show "passed but unaligned"?
This usually means a third-party sender (like Mailchimp, SendGrid, or Salesforce) is using their own return-path domain in the envelope. Their SPF passes for their domain, but it does not match your From header. Either configure them to use a custom return-path on your domain, or rely on DKIM signing for that sender.
How do I get my own DMARC reports?
Add a DMARC record to your DNS with a rua= tag pointing to a mailbox you own (e.g., v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com). Mail providers will start sending daily aggregate reports to that address within 24-48 hours. Use our free DMARC Record Generator to create a valid record.
What if I receive hundreds of reports per day?
Manually parsing each XML file is unsustainable at scale. The paid DMARC Report platform automatically ingests every aggregate and forensic report, classifies senders by vendor (Google Workspace, Microsoft 365, Mailchimp, etc.), tracks trends over time, and alerts you on suspicious activity.
Is the source IP hostname information accurate?
The hostname comes from the IP's reverse DNS (PTR) record, resolved live via Google's public DNS. PTR records are set by the network owner, so they are usually accurate for major senders (mail.google.com, outlook.com, sendgrid.net) but can be missing or misleading for shared hosting and consumer ISPs.
Stop reading XML by hand
DMARC Report parses every aggregate and forensic report automatically. Free plan includes 1 domain and 10,000 monthly reports - no credit card required.
Start Free - No Credit CardTrusted by Security Teams
Rated 4.8/5 on G2 · 469 verified reviews
Zunaid K.
Director
"Essential tool for email delivery"
This tool helps us to implement DMARC reporting for our domains in an easy to use manner.
Verified User in Information Technology and Services
"Best security tool for your own domains"
The weekly reports help me a lot to analyze quickly the emails sent from my domains and that gives me peace of mind.
Larry H.
Research & Development Manager
"Good tool to buy"
I have used many tools for monitoring DMARC reports. But DMARC Report is a good tool to use. It helps avoid sending emails to spam.