DMARC Report Analyzer
Add your DMARC aggregate reports and see who sends mail as your domain and whether it passes.
Analyze a reportWhat Are DMARC Reports?
When you publish a DMARC record with a rua tag, receiving mail servers send aggregate reports to the address you specify. These reports contain data about every message sent from your domain during a reporting period.
Each report lists the sending IP addresses, the number of messages, and whether SPF and DKIM authentication passed or failed. This information tells you which services are using your domain and whether they are configured correctly.
Without analyzing these reports, you have no visibility into who is sending email from your domain. DMARC reports are the foundation for moving from monitoring to enforcement.
How to Read DMARC Reports
Upload Reports
Add the aggregate report files you received from mailbox providers: .xml, .xml.gz or .zip. The analyzer reads them in your browser and extracts the authentication data.
View Sources
See every sending source using your domain. Each source shows its IP address, email volume, and whether it passed or failed authentication.
Check Authentication
Review SPF and DKIM results for each source. Find out which senders pass alignment and which ones need attention before you move to enforcement.
Take Action
Read the suggested next steps based on your report data. Fix legitimate senders that fail, and look into sources you do not recognize.
What Our Analyzer Shows
Sending Sources
See every IP address and service sending email on behalf of your domain. Identify authorized and unauthorized senders at a glance.
Authentication Results
View SPF and DKIM pass and fail rates for each sending source. Know exactly which senders authenticate and which ones do not.
IP Addresses
Every sending IP is listed with its authentication status. Track which IPs belong to your services and which are unknown or suspicious.
Reverse DNS
Look up the host name behind each sending IP on request. Host names often reveal the service, such as a mail provider or a marketing platform.
Next Steps
Get plain guidance on what to fix. The analyzer points out failing sources and when your results support moving from p=none to quarantine.
Upload Your Report
Drop your DMARC aggregate report files below. The analyzer adds up every report you give it and shows the results on this page.
Your files are read in your browser. Nothing is uploaded to a server.
Frequently Asked Questions
DMARC reports are XML files sent by receiving mail servers to the address specified in your rua tag. Aggregate reports summarize authentication results for all messages from your domain over a reporting period. Forensic reports include details about individual messages failing authentication.
Add your email address in the rua tag of your DMARC record. Receiving servers send aggregate reports to this address, usually once a day. You need to set up a service that accepts DMARC reports via email or use a platform like DMARC+ that processes the reports for you.
An aggregate report contains the domain name, reporting period, policy published, and results for each sending source. Each result includes the source IP, email count, SPF result, DKIM result, and DMARC disposition. This data tells you who is sending email from your domain and whether it passes authentication.
Start by reviewing the sending sources. Check which IPs pass SPF and DKIM authentication. Sources with high failure rates need investigation. After confirming all legitimate senders pass, you can move from p=none to p=quarantine or p=reject.
First determine if the failure comes from a legitimate sender or an unauthorized source. Legitimate failures often mean a sending service is not configured correctly for SPF or DKIM. Fix the configuration. Unauthorized failures indicate spoofing attempts and should be blocked by moving to a stricter DMARC policy.
Analyze your DMARC reports with DMARC+
DMARC+ processes your aggregate reports automatically and gives you clear visibility into every sender using your domain.
Start Your 14-Day Trial