DMARC Report Analyzer

Open a DMARC aggregate (RUA) report as received (.xml, .xml.gz or .zip) and see every sending source, message counts, SPF and DKIM alignment and what the receiver did, parsed in your browser.

Status: Live
Last updated: October 3, 2026

Receivers such as Google, Microsoft and Yahoo send daily XML reports to the rua= address in your DMARC record. They are hard to read by hand; drop one here to get a table of who sent mail as your domain and whether it passed. The file is decompressed and parsed locally; nothing is uploaded.

What to look for

Sort by volume and identify every source IP: your own server, your mail relay (MailBaby, Microsoft 365, Google Workspace) and any marketing or CRM platform. Legitimate sources that fail need an SPF include or DKIM signing with your domain before you move DMARC to p=quarantine or p=reject. Unknown IPs with small volumes that fail are usually spoofing attempts, which is exactly what DMARC enforcement will block.

DMARC passes if either SPF or DKIM passes and aligns with the From domain. A message can show SPF pass in the auth results but still fail DMARC when the envelope sender belongs to a different domain, which is common with third-party senders.

Receiving fewer reports

Use a dedicated mailbox or a subaddress for rua= reports, because a busy domain can receive dozens a day. Reports to an address on a different domain require an authorization record at that domain (example.com._report._dmarc.otherdomain.com).