DMARC Report Analyzer
Upload or paste a DMARC aggregate (RUA) report. See pass rates, per-source breakdowns, and actionable findings. Your report never leaves your browser.
Your report never leaves your browser.
How to get your DMARC aggregate reports. Add an rua tag to your DMARC DNS record with a mailto address you control: v=DMARC1; p=none; rua=mailto:dmarc-reports@yourdomain.com. Gmail, Outlook, and Yahoo start delivering reports within 24–48 hours. Each report arrives as an email with a compressed XML attachment. Save it and upload it here, or open it in a text editor and paste the XML. If the rua tag is missing from your record, the DMARC record generator can add it.
How to read DMARC aggregate reports. A DMARC aggregate report lists every IP that sent mail claiming to be from your domain, with message counts and per-source verdicts: SPF alignment, DKIM alignment, and the DMARC disposition (none, quarantine, or reject). The DMARC verdict depends on whether SPF or DKIM aligned with your visible From domain — a raw SPF pass from the envelope sender is not enough when the domains do not match. Start with the pass rate: 100% means everything authenticated correctly. For any failing source, check whether your SPF record covers that IP and whether your sending platform signs with a DKIM key whose domain aligns with your From address. The findings panel flags the most actionable issues.
DMARC report analyzer FAQ
What is a DMARC aggregate (RUA) report?
A DMARC aggregate report is an XML file that mail receivers (Gmail, Outlook, Yahoo, and others) send to the address in your DMARC record's rua tag. Each report covers one period, usually 24 hours, and lists every source IP that sent mail claiming to be from your domain, with counts and per-source SPF, DKIM, and DMARC verdicts. Aggregate reports are defined in RFC 7489. They differ from forensic (RUF) reports, which cover individual failing messages.
How do I get DMARC aggregate reports?
Add an rua tag to your DMARC record pointing to an address you control, for example: v=DMARC1; p=none; rua=mailto:dmarc-reports@example.com. Receivers start sending within 24–48 hours. The DMARC record generator can build the record if you need one. Reports arrive as compressed XML attachments. Download the attachment and upload it here.
What is the difference between aggregate (RUA) and forensic (RUF) reports?
Aggregate reports (rua) have rolled-up counts per source IP for a reporting period — how many messages passed or failed, without message content or headers. Forensic reports (ruf) are per-message failure reports with selected headers, sent only when DMARC fails. Many receivers stopped sending RUF reports over privacy concerns. This tool reads aggregate (RUA) XML reports.
Why is the report a .zip or .xml.gz file, and is it safe to analyze here?
Reports usually arrive as compressed attachments (.xml.gz or .zip) because the XML can be large. Parsing happens entirely in your browser, so the file never leaves your machine. If you want to verify that, open the network tab in devtools and click Analyze — there is no outbound request.