Free, nothing is stored
DMARC report analyzer
Upload a DMARC aggregate (RUA) report and read what receivers reported — sending sources with SPF/DKIM pass and fail counts. Nothing is stored.
messages
Sending sources ()
Direct answer
What is a DMARC aggregate report?
A DMARC aggregate report is a daily XML file that receivers send to the address in your DMARC rua tag. It lists the IP addresses that sent mail as your domain, how many messages each IP sent, and whether SPF and DKIM passed and aligned. It does not include the email body or the subject. Reading it is how you find a forgotten sender before you change the policy to p=reject.
- The file is usually XML, often gzipped, and sometimes inside a zip. The analyzer accepts .xml, .xml.gz, and .zip.
- A row with SPF or DKIM fail and a large count is a source that will be rejected the day you set p=reject.
- A pass on a vendor domain that does not align with your From domain still fails DMARC.
- Reports arrive only after a DMARC record with rua= has been published, and only from receivers that choose to send them. Gmail and Yahoo usually do.
Questions people ask
Where do DMARC reports come from?
You publish rua=mailto:dmarc@yourdomain.com on the _dmarc record. Receivers that support aggregate reports mail an XML file to that address, typically once a day. The checker on this site reads the policy. This page reads a file you already have.
What is the difference between aggregate and forensic reports?
Aggregate reports (rua) are counts by IP. Forensic reports (ruf) are meant to be copies of failing messages. Most large receivers send aggregate reports and do not send forensic copies. Use the aggregate file to decide whether enforcement is safe.
Is the report uploaded to an account?
No. The file is parsed to show sources and pass or fail counts, and it is not stored. You can also paste the XML.
A source fails SPF and passes DKIM. Is that safe?
DMARC passes if either SPF or DKIM passes and aligns. A DKIM pass on your domain is enough, even when SPF fails because of forwarding. If both fail, or the pass is on a different domain, that source is not safe to reject yet. Add the sender to SPF or turn on their DKIM before you change p=.
The records are only half of inbox placement.
Once SPF, DKIM, and DMARC pass, a cold domain still needs a slow sending history. iSend warms the domain and sends with the same authentication these tools just checked.