DMARC report analyzer: read aggregate XML reports in plain English
A DMARC report analyzer turns the XML aggregate reports that mailbox providers email you into a readable summary: how many messages used your domain, from which IP addresses, and whether each passed DMARC through aligned DKIM or SPF. Drop .xml, .xml.gz or .zip reports here; they're unzipped and parsed in your browser and never uploaded.
DMARC aggregate reports (.xml, .xml.gz or .zip)
Unzipped and read in your browser. Nothing is uploaded, so your sending IPs and volumes stay private.
Sample result
95.2% of 1,240 messages for acme.example passed DMARC; 60 failed.
- Domain
- acme.example
- Policy
- p=none
- Top failing IP
- 192.0.2.10
What this means for you
Fix or approve the failing senders before leaving p=none, or you could block your own mail.
- Reads aggregate rua reports
- Pass rate per sending IP
- Separates unaligned from unauthenticated mail
- Exports every record as CSV
- DMARC
- rua
- CSV
By SimpleVerifier Team · Last updated · Runs in your browser; nothing you paste is sent to us
How do I analyze a DMARC aggregate report?
- Collect the reports from the mailbox in your DMARC record's rua= tag. They arrive as attachments from senders such as google.com and Microsoft, usually as .zip or .xml.gz.
- Choose one or many report files above (no need to unzip them), or paste the XML of one report.
- Press Analyze reports. The headline shows the share of messages that passed DMARC, then every sending IP, failing ones first.
- For each failing source, read who signed it: a service you use that signs as its own domain needs DKIM set up for yours; a source with no authentication at all may be spoofing.
Example
- You enter
- One aggregate (rua) report for
acme.example, as a .xml, .gz or .zip file. - You get
- 95.2% of 1,240 messages passed DMARC and 60 failed, under policy
p=none. The top failing source is192.0.2.10(48 messages), flagged as forwarded or unaligned. - Limits
- Runs in your browser, so reports are not uploaded; several files can be read at once.
How do I read a DMARC report?
Read it source by source: each <record> says how many messages one IP address sent using your domain in the From header, and whether DMARC passed. The format is the aggregate report schema in RFC 7489 (Appendix C). <policy_evaluated> holds DMARC's verdicts, <dkim> and <spf>, which count only when the authenticated domain aligns with your From domain; <auth_results> shows the raw DKIM and SPF results, including the domain each one authenticated.
That split is the key to every report. A message passes DMARC when either aligned DKIM or aligned SPF passes. A record where auth_results shows DKIM passing for sendgrid.net but policy_evaluated says dkim: fail means the message was authenticated, just not as you: the service is signing with its own domain. This tool labels those "unaligned", separately from records where nothing passed at all.
What is a DMARC aggregate report?
A DMARC aggregate report is a daily XML summary that a receiving mail system sends to the address in your DMARC record's rua= tag, listing the IPs that sent mail claiming your domain and their authentication results. RFC 7489 sets a default reporting interval of 86,400 seconds, which is why most arrive once a day per provider.
They contain counts and results, not message content. Failure (forensic) reports, requested with ruf=, are a different thing: copies or excerpts of individual failing messages, which many large providers don't send. This analyzer reads aggregate reports.
Why am I receiving DMARC reports?
Because your domain's DMARC record has a rua=mailto: address, and receivers such as Google, Microsoft and Yahoo honour it. Someone added that tag when the record was set up, often a DMARC monitoring service or your IT provider. Check the record with the DMARC checker.
To stop them, remove the rua= tag from the record. You lose the only view you have of who sends as your domain, so most senders keep the reports and route them to a dedicated mailbox or a parser instead.
What should I do with failing sources in a DMARC report?
Sort them into three kinds. Services you use that aren't aligned (a CRM, help desk or newsletter tool) need their DKIM set up for your domain, or a custom return-path for SPF; their help docs call it domain authentication. Forwarded mail, such as a university alias or a mailing list, fails SPF after forwarding and can't be fixed from your side. Sources with no passing authentication at all, from IPs you don't recognise, are often spoofing, which is exactly what a stricter policy is for.
Once the legitimate senders pass, move the policy from p=none to quarantine and then reject; our guide to going from p=none to reject covers the order. Google's sender guidelines require bulk senders to publish DMARC, with at least p=none.
Do I need a paid DMARC service, or is this enough?
| This analyzer | Paid DMARC monitoring | |
|---|---|---|
| Reads .xml, .gz and .zip | Yes | Yes |
| Where reports go | Stay in your browser | Sent to the vendor's report address |
| History and trends | No, per session | Yes |
| Alerts and IP-to-sender names | No | Usually |
| Cost | Free | Monthly fee |
A one-off investigation or a small domain is fine here; a domain with many senders benefits from continuous monitoring.
Who uses this tool, and for what?
- IT and email admins
- Find every service sending as the company domain before tightening the policy from p=none to quarantine.
- Cold emailers
- Confirm each sending domain's mail aligns, and spot an outreach tool that's still signing with its own domain.
- Agencies
- Read a client's reports without uploading their sending data to a third-party dashboard.
- SaaS teams
- Check that transactional mail from your app provider and marketing mail from your ESP both pass DMARC.
What can’t this tool tell you?
- It reads aggregate (rua) reports only, not forensic (ruf) reports.
- It shows IPs, not company names. A DKIM domain usually reveals the service; for the rest, use reverse DNS.
- Reports cover only providers that send them, and only what they saw; mail to providers that don't report is invisible.
- Nothing is stored, so there's no history: drop a week of files at once to see a week.
- DMARC results say nothing about whether your recipients' addresses exist.
Common questions
- How to read DMARC reports XML?
- Open the XML in a DMARC report analyzer like this one, or read each <record>: source_ip and count say who sent how much, policy_evaluated says whether aligned DKIM and SPF passed, and auth_results shows which domain each check authenticated. A message passes DMARC if either aligned check passes.
- What is a DMARC aggregate report?
- A daily XML summary from a receiving mail provider, sent to your DMARC record's rua address. It lists every IP that sent mail using your domain, with message counts and SPF, DKIM and DMARC results, but no message content.
- Why am I getting DMARC aggregate reports?
- Your domain's DMARC record includes a rua=mailto: tag naming your address, so providers such as Google and Microsoft send you a report for each day they received mail using your domain.
- How do I stop receiving DMARC reports?
- Remove the rua= tag (and ruf=, if present) from the _dmarc TXT record in your DNS. Reports stop once providers see the new record. Many senders keep them and send them to a separate mailbox instead.
- How often are DMARC reports sent?
- Usually once a day per receiving provider. RFC 7489's default reporting interval is 86,400 seconds, and the ri= tag can ask for a different one, which providers aren't required to honour.
- Is a DMARC report analyzer free?
- This one is, with no sign-up and no upload: reports are unzipped and parsed in your browser. Paid DMARC services add a permanent report mailbox, history and alerts, which is worth it if you send a lot.
Sources
You audited one domain. Cold outreach means thousands.
This tool checks a domain you type in. It will not tell you which addresses at that domain are real.
- Bulk mailbox verification with real SMTP checks
- The email finder — name plus company to a verified address
- Website enrichment for emails, owner names and socials
One plan, cancel anytime, no contract. Sign in with Google and your first 100 email checks are free, no card. The free tools stay free either way.