DMARC Report Analyzer

About the DMARC Report Analyzer

When your domain publishes a DMARC record with a rua= address, mailbox providers such as Google, Microsoft and Yahoo e-mail you aggregate reports: XML files, usually zipped or gzipped, that list every server that sent mail claiming to be from your domain, how many messages it sent, and whether they passed DKIM, SPF and DMARC. They are hard to read by eye.

Drop the files here — .xml, .xml.gz or .zip, up to 20 at a time — and they are read in your browser into a summary: the share of mail that passed DMARC, a day-by-day chart, every sending source with its network (AS number and name) and country, the DKIM signers and SPF domains it used, the reporters, and plain-language findings such as unknown senders and forwarding. Filter the rows and export them as CSV. Nothing is uploaded.

Common uses

• Finding every service that sends mail as your domain (newsletters, CRM, helpdesk, invoices) before tightening DMARC.
• Checking that the move from p=none to p=quarantine or p=reject will not block legitimate mail.
• Spotting spoofing: sources on unknown networks that fail both DKIM and SPF.
• Turning a month of reports into one CSV for a security review.

How DMARC passes or fails

DMARC passes when DKIM or SPF passes and the domain it checked is aligned with the domain in the visible From header. The report’s policy_evaluated section gives the receiver’s verdict for each: dkim and spf there mean “passed and aligned”, which is why a message can show spf=pass under auth_results and still spf=fail under policy_evaluated — SPF passed for another domain, such as a mailing service’s bounce domain. The analyzer counts a message as passing DMARC when the receiver marked DKIM or SPF as passing there.

The raw results under auth_results are shown as DKIM signatures and SPF: the domains that signed or were checked, with their results. A valid signature from a domain that is not yours, on mail that fails DMARC, is the typical mark of a forwarder or a mailing list.

The report format

Aggregate reports are defined in RFC 9990, which with RFC 9989 and RFC 9991 replaces the original DMARC specification, RFC 7489 (its Appendix C held the old XML schema, which many receivers still send). Each report has the reporter (report_metadata), the policy it found in your DMARC record (policy_published: p, sp, and in newer reports np, testing and discovery_method; older ones pct), and one record per sending IP and outcome with a message count. RFC 9990 adds the disposition pass (it passed DMARC under an enforcing policy, so nothing was done) and the override reason policy_test_mode; the reasons mailing_list, trusted_forwarder, local_policy and other were already in RFC 7489, whose forwarded and sampled_out RFC 9990 drops.

Before moving to p=reject

• Collect reports for at least a few weeks, so that services that send rarely (monthly invoices, annual renewals) show up.
• For every failing source that is yours, make it pass: let the service sign with DKIM using your domain (the most robust fix), or add it to SPF if its bounces use your domain.
• Expect some failures from forwarding and mailing lists; receivers often override the policy for them, and the reports say so in the reason.
• Move step by step: p=quarantine first, then p=reject, watching the reports after each change. The DMARC Record Checker checks the record you publish.

Limitations

• Up to 20 report files per analysis (a .zip may contain several reports); files up to 30 MB and reports up to 100 MB of XML.
• Only aggregate (rua) reports are read. Failure (forensic, ruf) reports are individual messages in a different format.
• The day chart groups messages by the day each report period starts (UTC); reporters choose their own periods.
• Networks and countries of the sending addresses come from snapshots built into this page (IPtoASN and DB-IP Lite) and can lag behind recent changes.

Privacy

Your reports are unpacked and read in your browser and never uploaded. To name the networks of the sending addresses the page downloads data files from MySmartCoPilot that cover large blocks of addresses; the addresses themselves are not sent anywhere.