Browse tools

DMARC Report Analyser

Those daily DMARC emails full of .zip and .gz files are reports on every server that sent mail as your domain. Drop them here to see which are your real services, which are failing SPF or DKIM, which look like spoofing, and what to change before you move to p=quarantine or p=reject.

Open your DMARC reports

Drop report files here
.xml, .xml.gz, .gz or .zip, as many as you like (up to 500 at once, 50 MB each). Add more at any time and they're combined.

The reports are opened and read on your device; nothing is uploaded. If you tick the box, only the sending IP addresses (up to 60) are sent to our server to look up their owner, network and reverse DNS.

Or paste the XML of a report

What are DMARC reports?

When your DMARC record has a rua=mailto: address, big mailbox providers such as Google, Microsoft and Yahoo send a summary each day of all the mail they received claiming to be from your domain. Each report is an XML file, usually zipped or gzipped, attached to an email.

  • Source IP: the server that delivered the mail. Your own services and anyone spoofing you both show up here.
  • Aligned: SPF or DKIM passed for your domain, the one in the From line. A pass for the sending service's own domain doesn't count towards DMARC.
  • DMARC pass needs SPF or DKIM to pass and be aligned. DKIM is the one to rely on, because it survives forwarding.
  • Disposition is what the receiver did: delivered normally (none), sent to junk (quarantine) or refused (reject).

Don't have any reports yet? Add rua=mailto: with an address you read to your DMARC record. The Email Record Builder makes one for you.

Getting safely to p=reject

  1. Start with p=none and collect reports for two to four weeks, so monthly senders such as invoicing, payroll and newsletters show up.
  2. Fix every real service that fails: turn on DKIM with your own domain in each one, and keep SPF under its 10-lookup limit.
  3. Move to p=quarantine once at least 98% of your genuine mail passes. Many receivers let you phase it in with pct=25, then 50, then 100, though the 2026 update to DMARC (RFC 9989) retires pct.
  4. Finish with p=reject when the reports stay clean. Fakes are then refused outright.

Check your live setup any time with the Email Security Checker. Our verdicts are a guide: a source we mark as spoofing might be a service you've forgotten about, so check before you block it.

More free tools