Free DMARC Report Analyzer
Load your DMARC aggregate reports to see which services send as your domain, whether their SPF and DKIM pass and align, and what to fix before you enforce.
Drop DMARC reports here
.xml, .gz or .zip, as many as you like
Files are read in your browser. Nothing is uploaded or stored.
Ready to tighten the policy? Build the new record.
What the report tells you
Every receiver that gets mail from your domain counts it by sending IP and records whether SPF and DKIM passed, and whether either pass was for your domain. That last part, alignment, is what DMARC decides on.
The analyzer groups those rows by the service behind them and puts the ones that need work first.
Fix your senders, ignore the noise
A service marked Fix is one you probably use that isn’t signing as your domain yet. Turning on domain authentication in that service is almost always the fix.
Unidentified traffic that fails everything usually isn’t yours. A small amount of forwarded mail that fails is normal too.
Then tighten the policy
Once your own senders pass, p=none is only watching. Move to quarantine, then reject, checking the reports at each step.
The DMARC record generator writes the new record, and the deliverability test checks it once it’s live.
Frequently asked questions
What is a DMARC aggregate report?
An XML file that mailbox providers send to the address in your DMARC record’s rua= tag, usually once a day. It lists every IP that sent mail claiming to be from your domain, how many messages each sent, and whether they passed SPF and DKIM. It doesn’t include message content or recipients.
How do I start getting DMARC reports?
Add a rua=mailto: address to your DMARC record. The DMARC record generator builds the record for you. Reports start arriving within a day or two, mostly from Google, Microsoft and Yahoo.
Which file formats does the analyzer read?
Aggregate reports as plain .xml, gzip (.xml.gz, which Yahoo and others send) or .zip (Google and Microsoft). Load as many as you like at once: reports for the same domain are added together, and the same report loaded twice counts once. Forensic (ruf) reports are a different format and aren’t supported.
Are my reports uploaded anywhere?
No. Files are unpacked and read by JavaScript in your browser. Nothing is sent to a server or stored, and closing the tab clears them.
Why does a sender pass SPF but fail DMARC?
DMARC needs alignment, not just a pass. SPF checks the return-path domain, and most email services use their own there, so SPF passes for them rather than for you. The same goes for DKIM when a service signs with its own domain. Setting up domain authentication in the service makes it sign as your domain, and that’s the pass that counts.
How does the analyzer know which service sent the mail?
Reports only carry IPs and domains, so it reads the clues: the domain a message was signed with, the DKIM selector, and the return-path. A selector like s1 usually means SendGrid, but anyone can choose it, so each sender shows the evidence it was named from. Mail with no passing signature at all is grouped as unidentified.
What should I do about unidentified sources?
Usually nothing. Mail that passes neither SPF nor DKIM and comes from IPs you don’t recognise is often someone else using your domain, and stopping it is what p=quarantine and p=reject are for. If an IP turns out to be yours, such as a server, a printer or an old CRM, add it to your SPF record and sign its mail with DKIM.
When is it safe to move from p=none to p=reject?
When every sender you recognise passes across a few weeks of reports. Move to p=quarantine first, with t=y if you want receivers to soften it while you watch, then to p=reject once the reports stay clean.
Still have questions? Contact us →
Authenticated mail, worth opening
Alterable draws countdown timers, live weather and personalized images the moment each email opens. Your mail reaches the inbox; give people something worth opening.
No trial, no time limit, no credit card.