DMARC XML Report Analyzer
Paste a raw DMARC aggregate report XML. Get a human-readable breakdown of every sending source, alignment result, and flagged issue.
Parsed entirely in your browser. Your report data never leaves your device.
Processed in your browser, no account required. Get reports ingested and parsed automatically.
See plans →What's inside an aggregate report
DMARC aggregate reports arrive as gzipped XML attachments with filenames like google.com!yourdomain.com!1736380800!1736467200.xml.gz. They're unreadable as-is. This tool parses them for you: paste or upload the XML and see every sending source, what passed, what failed, and what each result means in plain language. No account required, processed entirely in your browser.
What you'll see
- Source IPs:every server that sent mail claiming to be your domain
- Alignment results:whether DKIM and SPF passed or failed for each source
- Disposition:what the receiver actually did with the mail (none / quarantine / reject)
- Message counts:volume per source, so you can spot an unknown sender at a glance
Frequently asked questions
What is a DMARC aggregate report?
rua=tag. It summarizes every message they received claiming to be from your domain: the source IP, how many messages, whether DKIM and SPF aligned, and what disposition was applied. It's the primary signal for catching misconfigured senders or spoofing attempts.How do I read a DMARC report?
.xml.gz file directly. The tool decodes every record and surfaces what matters: unknown senders, alignment failures, and volume spikes. For a deeper walkthrough of what each field means, see what's actually in a DMARC aggregate report.What does rua mean in DMARC?
rua=stands for “reporting URI for aggregate”: the email address where receivers send your daily DMARC reports. Without a rua=tag in your DMARC record, you receive no reports and have no visibility into what's passing or failing. It's the most important tag to get right.Why am I getting DMARC reports?
rua=email address to your DMARC record. Major mail receivers like Google and Microsoft send these reports every 24 hours for any domain with a valid DMARC record and a reporting address. They're not spam. They're your earliest warning system for email authentication problems.Don't want to upload reports manually?
DMARCdrift ingests your DMARC reports automatically as they arrive, alerts you to alignment failures, and tracks your sending sources over time, so you always know what's happening with your domain's email authentication.
Get started free →Stop parsing XML manually, monitor reports automatically, free.
See plans →