DMARC report analyzer
Upload one DMARC aggregate report and see who sent mail as your domain, what passed, and what the receiver did with the rest. No account needed, and we don't store the file.
What a DMARC report analyzer shows you
An aggregate report is an XML file about your domain. A receiver writes one, usually once a
day, and mails it to the address in your DMARC record's rua= tag. It has one row
per sending IP with the message count, whether SPF and DKIM passed and aligned, and what the
receiver did with mail that failed. Upload one file here and you'll see each row in plain
English.
Start with the rows that failed DMARC. A source can show spf=pass and still fail
DMARC, because the pass was for the sending platform's domain instead of yours. That's an
alignment failure. Receivers act on the DMARC result.
Next, check the disposition. none means the receiver took no DMARC action.
Newer receivers write pass when mail passes DMARC under an enforcing policy.
Other filters can still block either kind of mail.
quarantine means the receiver treated the mail as suspicious, and
reject means it refused the mail under DMARC.
Check which sources fail before you move from p=none to an enforcing policy.
Questions
Who sends these reports, and why is the file zipped?
Google, Microsoft, Yahoo and many smaller receivers send them, each in its own file. They
compress the file with gzip or zip and give it a name like
google.com!example.com!1754956800!1755043199.zip. The report has no subjects, bodies or recipients. It's a count of
who sent mail as you and how SPF, DKIM and DMARC turned out.
Why does the disposition say none when my policy is quarantine?
The disposition shows the receiver's DMARC action. Other filters can still block the mail. A receiver can override your policy, for example when it sees the mail was forwarded. It then adds a reason to the report, and we show that reason next to the disposition.
What do the DKIM selectors tell me?
They show you which platform a source belongs to. Each platform signs with its own selector, so it's the quickest way to put a name to an IP. Use our DKIM checker to see whether the matching key is still in DNS, and the SPF, DKIM and DMARC checker to look up all three of your records at once.
Why is a platform I use missing from this report?
A report covers one day at one receiver. If a platform sends your invoices on the first of the month, it won't appear in the reports for the rest of the month. When it does appear and fails, read that report the day it arrives. You won't see that platform again for a month.
Can I tighten my policy from one report?
No. Read several weeks of reports together, source by source, before you move from
p=none to p=quarantine.
Reading an aggregate report by hand covers
the patterns to look for, and the DMARC setup guide covers
each step up to p=reject.
What happens to the file I upload?
Nothing is stored. The file is parsed in memory to build this page and dropped when the response is sent. It isn't written to disk, logged or attached to an account. If you sign up from the card above, the From domain out of the report is filled into that form, and it reaches us only if you submit it. Reports describe other people's sending setups as well as your own, which is why we don't keep the ones pasted into a public form.
Stop opening these reports by hand
Receivers send one every day. We read them all and mail you a summary each Monday. On a paid plan, we also email you the day a new sender fails.
Get the weekly digestFree for your first domain · No card · Per-source totals kept for life