DMARC Report Analyzer

What's inside a DMARC aggregate report

Every reporter (Gmail, Outlook, Yahoo…) sends one XML file per domain per day. Each file has three parts: metadata about the reporter and date range, the DMARC policy you had published, and a list of records — one per sending source — with the IP, message count, the SPF and DKIM alignment verdicts, and the disposition (delivered, quarantined, or rejected). The analyzer flattens that into a summary and a per-source table, sorted by volume.

How to act on the results

Read the failing rows first. A failing source you recognize is a configuration gap: add the platform to your SPF record or switch on DKIM signing in its settings using the DKIM setup helper. A failing source you don't recognize, showing up repeatedly, is spoofing — the fix is ramping your DMARC policy from none to quarantine and eventually reject, so receivers stop delivering it.

When the pass rate matters

A 100% pass rate across reporters for a few consecutive weeks is the green light to tighten your policy. Below ~95%, look closely: forwarding accounts for some legitimate SPF breakage (DKIM usually survives forwarding, which is why you need both), but persistent double failures at volume mean either an unauthenticated tool or abuse of your domain.

Beyond one-off analysis

This tool is built for reading individual reports. At outbound scale — dozens of sending domains, each collecting reports from every major provider — you want continuous monitoring, which is part of how we run cold email infrastructure for clients. Start with the deliverability test to see where your domains stand today, or read the SPF, DKIM & DMARC guide for the full picture.