Turn the XML files that mailbox providers send to your DMARC rua address into a readable report. Drop one or many .xml, .xml.gz or .zip files to see every sending IP, how many messages it sent, whether SPF and DKIM aligned, and your overall pass rate.
Last updated:
Drop DMARC aggregate reports here or choose files.xml, .xml.gz, .gz or .zip, several at once. Files never leave your device.
Pass rates
DMARC passDMARC fail
Findings
Sources
Auth results
Advertisement
Advertisement
How to use the DMARC Report Analyzer
Download the reports from the mailbox that receives your DMARC rua emails. They are usually .zip or .gz attachments.
Drop the files on the upload area (or choose them). Several files from different providers are merged.
Check the pass rate cards and the chart to see which sources fail DMARC.
Read the findings: they tell you which senders need SPF or custom DKIM set up for your domain.
Sort and filter the table, look up host names to identify servers, and download a CSV for your records.
Reading the fields in a DMARC report
XML element
Shown as
Meaning
report_metadata/org_name
Reporter
The receiver that wrote the report, for example google.com
date_range/begin, end
Period
Unix timestamps (UTC) covered by the report, usually 24 hours
policy_published
Policy
Your DMARC record as the receiver saw it: p, sp, pct, adkim, aspf
row/source_ip, count
Source IP, Messages
The connecting server and how many messages it sent in the period
policy_evaluated/dkim, spf
DKIM aligned, SPF aligned
The aligned results that decide DMARC: pass if the authenticated domain matches the From domain
policy_evaluated/disposition
Disposition
What the receiver did: none (delivered), quarantine or reject
identifiers/header_from
Header From
The domain in the visible From address
auth_results/dkim, spf
Auth results
Raw SPF and DKIM results with the domain each one checked, before alignment
Typical patterns and what to do
Both aligned results pass: a correctly configured sender, such as your main mail provider.
Raw DKIM passes for another domain, aligned DKIM fails: a third-party tool signing with its own domain. Turn on custom DKIM for your domain in that tool.
SPF fails or is for another domain, DKIM aligned passes: usually forwarding or mailing lists. DMARC still passes thanks to DKIM.
Everything fails from an unfamiliar IP: likely spoofing or a forgotten service. Look up the host name and check it with the IP Blacklist Checker. If it is not yours, an enforced DMARC policy will block it.
Once the reports show only legitimate, aligned senders, raise your policy with the DMARC Record Generator and confirm the published record with the DMARC Checker.
Frequently asked questions
What is a DMARC aggregate report?
It is an XML file that receivers such as Gmail, Outlook.com and Yahoo send, usually once a day, to the address in your DMARC record's rua tag. It lists every IP that sent mail using your domain in the From header, how many messages each sent, and whether SPF and DKIM passed and aligned. It contains no message content.
Why does a source pass SPF but fail DMARC?
DMARC needs alignment: the domain that passed SPF (the envelope sender or Return-Path) must match the From domain. Newsletter and help desk services often use their own bounce domain, so SPF passes for them, not for you. Fix it by enabling DKIM signing with your domain (custom DKIM) or a custom return-path at that service.
What does the DMARC pass rate count?
A message passes DMARC when the receiver reports an aligned SPF pass or an aligned DKIM pass (the policy_evaluated result). The pass rate is passing messages divided by all messages in the loaded reports, weighted by the count of each record.
Can I open .zip and .gz report files directly?
Yes. Gzip files are decompressed with your browser's built-in DecompressionStream, and ZIP files with the JSZip library, all on your device. You can drop many files at once, and XML files inside ZIP archives are read automatically.
What should my pass rate be before moving to p=reject?
There is no official threshold, but most administrators wait until every legitimate source passes and the remaining failures are unknown IPs that look like spoofing. Forwarded mail can fail SPF yet still pass through DKIM. Move to quarantine first and watch the reports for a few weeks.
Are my reports uploaded anywhere?
No. Files are read and parsed in your browser. The only optional network request is the Look up host names button, which sends the IP addresses to Cloudflare's public DNS-over-HTTPS resolver to get their reverse DNS names.
Are all the tools on FreeToolCabin tested for quality and accuracy?
Yes! Every tool on our site undergoes automated Q/A testing in real browser environments to ensure high precision, correct output, and zero errors. If you happen to spot a bug or have a suggestion, please contact us at [email protected] and our team will review it right away.