DMARC report analyser
Drop the DMARC aggregate reports mailbox providers send you (.xml, .gz or .zip) to see every server sending as your domain, which pass or fail SPF and DKIM alignment, and whether you are ready for quarantine or reject. Reports are read in your browser and never uploaded.
Making sense of DMARC reports
With a rua address in your DMARC record, Google, Microsoft, Yahoo and others send a daily XML report of every IP that sent mail as your domain and whether it passed. They are unreadable by hand; drop them here (several at once, compressed or not) to get one summary.
- Pass rate overall and per sending source.
- Which sources fail SPF or DKIM alignment, and what receivers did with their mail.
- Forwarded mail, which often fails SPF but passes DKIM, flagged so you don't chase it.
- Advice on whether it is safe to move to quarantine or reject.
Private by design
Reports list every server that sends as your domain, so they stay in your browser and are never uploaded. "Identify senders" sends only the IP addresses to MtrXTools, and only when you press it, to show which provider each one belongs to.
Questions
- Where do I get the reports?
- Add
rua=mailto:you@example.comto your DMARC record. Reports arrive as email attachments, usually daily, from each large mailbox provider that received your mail. - A source I don't recognise is failing. Is it spoofing?
- Use "Identify senders" to see its provider. Unknown IPs failing both SPF and DKIM are usually spoofing, which an enforced DMARC policy blocks. A service you use that fails needs SPF or DKIM set up for your domain.