DMARC aggregate report analyzer
Paste the raw XML, get a readable table. No account, nothing uploaded.
Paste the raw XML from a DMARC aggregate report (unzip the .xml.gz your mailbox provider sent first), or upload the file directly. Parsing happens entirely in your browser - nothing is sent to a server.
Reading the results table
Each row is one sending IP that mail claiming to be from your domain came from, during the report's time window. Count is how many messages that IP sent. Disposition is what the receiver did with them: none (delivered as normal), quarantine (usually the spam folder) or reject. SPF and DKIM are the raw results. Aligned is the column that decides DMARC: a row passes only if SPF or DKIM passed for the same domain as the visible From header.
Start with the rows that have the highest counts. Those are your real senders: your application's email provider, your office mailbox provider, your CRM. Every one of them should show aligned. Low-count rows from IPs you don't recognise are usually spoofing, and they are what a stricter policy blocks. For a field-by-field walkthrough of the XML itself, see how to read a DMARC aggregate report.
Common patterns and what they mean
Your own sending service, SPF pass but not aligned, DKIM fail
The provider passes SPF for its own bounce domain and signs DKIM with its own domain. Neither matches your From domain, so DMARC fails.
→ Set up DKIM signing with your own domain at that provider, and a custom MAIL FROM subdomain if it offers one.
A known tool (CRM, helpdesk, billing) failing both checks
Someone connected a service that sends as your domain and nobody added it to SPF or DKIM.
→ Add that service's DKIM records, or move its mail to a subdomain with its own DMARC policy.
Unknown IPs, low counts, failing everything
Usually spoofing or a misconfigured forwarder. This is the traffic DMARC exists to stop.
→ Nothing to fix on your side. Once your legitimate sources pass, these are why you move to p=quarantine and p=reject.
Mail you sent, failing SPF only, from a mailbox provider's IPs
Forwarding: the forwarder re-sends your mail from its own IP, which breaks SPF. DKIM usually survives.
→ Make sure every source signs DKIM with your domain, so DMARC still passes through forwarders on DKIM alone.
Getting reports in the first place
Receivers only send aggregate reports if your DMARC record asks for them with a rua tag. A record that collects reports without changing delivery looks like this:
_dmarc.example.com TXT "v=DMARC1; p=none; rua=mailto:[email protected]"
Reports arrive as email attachments, usually gzip or zip compressed, once a day from each provider that saw your mail. Run p=none for a few weeks, fix every legitimate source the reports show as unaligned, then tighten the policy. The SPF, DKIM and DMARC checker shows what your domain publishes today.
FAQ
Is this free?
Yes, no account needed.
Where does the parsing happen?
Entirely in your browser, using the DOMParser API. The XML never leaves your machine or touches a server - useful since aggregate reports contain sending infrastructure details you may not want uploaded anywhere.
My mailbox provider sent a .gz file, not XML - what do I do?
Unzip it first (most OSes handle .gz natively, or use gunzip/7-Zip). What's inside is the raw XML this tool expects.
What does "aligned" mean in the results?
SPF or DKIM passed against your visible From: header domain, not just against some other domain in the message. That's the field DMARC actually checks - a message can pass SPF in isolation and still fail DMARC if the alignment check fails.
Who sends DMARC aggregate reports, and how often?
Any receiving provider that supports DMARC reporting and sees mail claiming to be from your domain, such as Google, Yahoo and Microsoft. Most send one report per day per reporting organisation, to the address in your DMARC record's rua tag.
Does this handle forensic (ruf) reports?
No. It reads aggregate (rua) reports only, the daily XML summaries. Forensic reports are per-message samples, and most large providers don't send them at all.
Not sure what to do with what you find? Read how to read a DMARC aggregate report or how to move from p=none to p=reject.