Free tool · Deliverability DMARC Report Analyzer
Those daily XML attachments from Google and Microsoft are answering one question: who is sending email as your domain, and is it authenticating? Paste a report below and get the answer as a readable table, parsed entirely in your browser, nothing uploaded.
What's inside a DMARC aggregate report
Every reporter (Gmail, Outlook, Yahoo…) sends one XML file per domain per day. Each file has three parts: metadata about the reporter and date range, the DMARC policy you had published, and a list of records, one per sending source, with the IP, message count, the SPF and DKIM alignment verdicts, and the disposition (delivered, quarantined, or rejected). The analyzer flattens that into a summary and a per-source table, sorted by volume.
How to act on the results
Read the failing rows first. A failing source you recognize is a configuration gap: add the platform to your SPF record or switch on DKIM signing in its settings using the DKIM setup helper. A failing source you don't recognize, showing up repeatedly, is spoofing. The fix is ramping your DMARC policy from none to quarantine and eventually reject, so receivers stop delivering it.
When the pass rate matters
A 100% pass rate across reporters for a few consecutive weeks is the green light to tighten your policy. Below ~95%, look closely: forwarding accounts for some legitimate SPF breakage (DKIM usually survives forwarding, which is why you need both), but persistent double failures at volume mean either an unauthenticated tool or abuse of your domain.
Beyond one-off analysis
This tool is built for reading individual reports. At outbound scale, dozens of sending domains, each collecting reports from every major provider. You want continuous monitoring, which is part of how we run cold email infrastructure for clients. Start with the deliverability test to see where your domains stand today, or read the SPF, DKIM & DMARC guide for the full picture.
Frequently asked questions
How do I read a DMARC report?
DMARC aggregate reports are XML files listing every IP that sent mail claiming to be your domain during the period, with message counts and SPF/DKIM results. Unzip the attachment from the report email, then paste or upload the .xml file above. You'll get a summary: total messages, pass rate, what was quarantined, plus a per-source table. Sources failing both SPF and DKIM are either tools you forgot to authenticate or someone spoofing you.
Where do DMARC reports come from?
From the mailbox providers receiving your mail. Once your DMARC record includes a rua address, Google, Microsoft, Yahoo, and most others email that address a daily XML summary of every message they saw with your domain in the From header. No DMARC record, or no rua tag, means no reports; generate one with our DMARC record generator first.
Is it safe to paste my DMARC report here?
Yes, the analyzer runs entirely in your browser. The XML never leaves your machine and nothing is uploaded to our servers. Aggregate reports also contain no message content or recipient addresses by design: only sending IPs, counts, and authentication results.
The report file is a .zip or .xml.gz. What do I do?
Providers compress report attachments. Unzip the file first (double-click on Mac or Windows; for .gz files, any archive utility works), then upload the .xml inside. If you paste compressed bytes by accident, the analyzer detects it and tells you.
A source in my report fails SPF and DKIM. Am I being spoofed?
Not necessarily. First check whether the IP belongs to a tool you actually use: helpdesks, billing software, and CRMs are the usual suspects, and the fix is adding them to your SPF record or enabling DKIM in their settings. Forwarded mail also legitimately breaks SPF. If the source is genuinely unknown and persistent, that's spoofing, which is exactly what moving your DMARC policy to quarantine or reject shuts down.
Keep your outbound landing.
DMARC Record Generator
v=DMARC1; p=quarantine; rua=mailto:dmarc@yourdomain.com
Create a DMARC policy with reporting, pct and alignment options, and guidance on ramping safely from none to reject.
DMARC Checker
v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com
"p=none" only monitors. It doesn't protect against spoofing. It's the right place to start; once your reports look clean, move to "quarantine" then "reject".
Read your DMARC policy in plain English, see whether you're protected or just monitoring, and confirm reporting is on.
Email Deliverability Test
Check SPF, DKIM, DMARC and MX for any domain in one pass, and get a single 0 to 100 score with specific fixes.
Want us to build your outbound system?
Skip the DIY. We'll orchestrate your entire outbound operation, on infrastructure registered in your name from day one.
Book your free ICP review →