DMARC Report Analyzer
Parse a DMARC aggregate (RUA) XML report.
Quick answer
This tool parses the XML aggregate (RUA) reports that mailbox providers send to your DMARC address and turns them into a readable summary. It shows which servers sent mail using your domain and whether each passed SPF and DKIM, so you can spot both legitimate sources and spoofing.
DMARC aggregate reports (RUA) arrive as compressed XML files sent daily by mailbox providers like Google, Microsoft and Yahoo. Each file summarizes how your messages passed or failed SPF, DKIM and DMARC alignment, grouped by sending IP. The raw XML is hard to read by eye. This analyzer parses a single report in your browser and lays out the source IPs, message counts, and authentication outcomes as a readable table so you can spot spoofing and misconfigured senders quickly.
How to use it
Providers deliver RUA reports as .gz or .zip attachments. Extract the XML first, then paste its contents or upload the file into the tool. It reads the report header (the reporting organization and date range) and every record block, then displays each sending IP with its message volume, DKIM result, SPF result, and the final DMARC disposition. Because parsing happens entirely in your browser, the report never leaves your machine, which matters since it lists real recipient-domain traffic.
How to read the results
Each row is one sending source. Focus on the disposition column: none means the message was delivered, quarantine means it went to spam, and reject means it was blocked, per your policy. A source is DMARC-aligned when SPF or DKIM passes and the authenticated domain matches your From domain. Rows showing pass volume from your own mail servers are healthy. High-volume IPs you do not recognize with failing results are potential spoofing or an unconfigured third-party sender.
Common problems & fixes
Seeing your own newsletter or ticketing provider fail usually means DKIM was never set up or SPF lacks their include mechanism. Add the provider's DKIM key and SPF entry, then recheck the next report. Forwarded mail often fails SPF but passes DKIM, which is normal and still counts as aligned. Do not move your policy from p=none to quarantine or reject until legitimate sources consistently show pass across several days of reports.
Frequently asked questions
- Why is the report an XML file and how do I get it?
- DMARC aggregate reports follow a standard XML schema so any provider can generate them. You receive them because you published a rua= address in your DMARC record. Providers compress each report as .gz or .zip and email it to that address, usually once per day. Unzip the attachment and load the resulting XML file here.
- Does DMARC alignment need both SPF and DKIM to pass?
- No. DMARC passes when at least one of SPF or DKIM both authenticates and aligns with your From domain. A message can fail SPF but still pass DMARC through DKIM, and vice versa. This is why forwarded mail, which breaks SPF, often remains DMARC-compliant. Aim for both to pass for the most resilient authentication.
- Is my report data uploaded to a server?
- No. This analyzer parses the XML locally in your browser, so the file and the recipient-domain traffic it contains stay on your device. Nothing is sent to dnslab.io or any third party. That said, aggregate reports show sending IPs and volumes rather than message content, so they never contain the bodies of your emails.