Read your DMARC report in plain English
DMARC reports arrive as XML that nobody can read. Paste one in and find out who is sending as your domain, how much of it authenticated, and what's failing alignment. No account, no domain limit, no monthly cap.
Tighten your policy only when it is safe.
Connect your domain and DMARC starts at p=none. The one-click step up to quarantine, and then to reject, is offered only when your alignment data shows it is safe, rather than on a calendar that could reject your own mail.
How to read a DMARC aggregate report
A DMARC aggregate report is an XML file that a receiving mailbox provider sends to the address in the rua tag of your DMARC record. It lists every server that sent mail using your domain in the From address during the period, how many messages each one sent, and whether they passed SPF and DKIM. Paste one into the analyser above, or upload the .xml file, and you get a verdict, pass and fail totals, and a list of who sent as you.
Who sends reports, and when
You only receive reports if your DMARC record has an rua address, for example rua=mailto:dmarc@yourdomain.com. Each provider that supports reporting and received mail claiming to be from your domain sends its own report, typically once a day. They arrive as email attachments, compressed because a busy domain's report can run to thousands of lines. The standard recommends gzip, so most arrive as .xml.gz, and some providers send .zip instead. If you have a DMARC record but no reports, check the rua tag first: the domain checker flags a record without one.
Every field, explained
A report has three parts: metadata about the report, the policy you published, and one record per combination of source IP and results.
| Field | Section | What it means |
|---|---|---|
| org_name, date_range | report_metadata | Who sent the report and the period it covers. The dates are Unix timestamps in seconds, UTC. |
| p | policy_published | Your DMARC policy when the report was made: none, quarantine or reject. |
| sp | policy_published | The policy for subdomains. If it's missing, subdomains follow p. |
| pct | policy_published | The percentage of failing mail your policy applies to. The rest is treated as if p were one step softer. |
| adkim, aspf | policy_published | Alignment mode for DKIM and SPF. r (relaxed) accepts a subdomain of the From domain; s (strict) needs an exact match. |
| source_ip | record / row | The server that sent the mail. |
| count | record / row | How many messages came from that IP with these results. |
| disposition | policy_evaluated | What the provider did: none (delivered), quarantine (usually spam folder) or reject. |
| dkim, spf | policy_evaluated | The DMARC verdicts: pass only if the check passed for a domain aligned with your From domain. |
| header_from | identifiers | The domain in the visible From address. This is the domain DMARC protects. |
| envelope_from | identifiers | The bounce address domain that SPF checked. Optional, and many providers leave it out. |
| dkim, spf | auth_results | The raw checks: which domain was tested, the DKIM selector, and the result, before any alignment test. |
policy_evaluated and auth_results are different answers
This is the part of a report that confuses people most. auth_results is the raw check: SPF passed for some domain, DKIM verified a signature from some domain. policy_evaluated is the DMARC verdict: did a check pass for a domain that matches your From domain? A message passes DMARC when SPF or DKIM passes there. A tool that sends with its own domain can show pass in auth_results and fail in policy_evaluated, and only the second one decides what happens to the message.
Press Try sample above to see both. The first source, 209.85.220.41, sent 847 messages that passed DKIM and SPF and were delivered. The second, 1.2.3.4, sent 15 that failed both and were quarantined: that is what an unknown sender looks like once your policy is enforcing.
What the analyser shows
The verdict reads the share of messages that passed DMARC: 98% or more is healthy, 90% to 98% means some sources need attention, and under 90% means fix the failing sources before you tighten your policy. The totals count a message as passing when SPF or DKIM passed in policy_evaluated. Below them you get the reporting organisation, your domain, p, sp, pct and the report ID, then every source grouped by From domain and disposition, with each IP's message count and its DKIM and SPF verdicts. Notes explain what your current policy means, and flag a pct under 100. The analyser accepts reports up to about 8 MB of XML.
What to do with what you find
Sources that are yours and pass need nothing. Sources that are yours and fail usually need DKIM set up with your domain, or adding to SPF. Failures from a forwarder are normal in small numbers: forwarding breaks SPF, and a mailing list that edits the message breaks DKIM. Unknown IPs that fail both are what an enforcement policy is for. Start at p=none, which changes nothing about delivery, then move to p=quarantine and p=reject once every source you use passes. Moving sooner can block your own mail from a tool you forgot about.
DMARC report questions
How do I open a .gz or .zip DMARC report?
Extract it first, then paste the XML or upload the .xml file. The analyser reads plain XML, so a compressed file won't work as it is. On a Mac, double-click the .gz or .zip and Archive Utility extracts it next to the original. On Windows, right-click a .zip and choose Extract All; for a .gz, use an archive tool such as 7-Zip. On Linux or in a Mac terminal, run gunzip report.xml.gz or unzip report.zip. Then open the .xml file in a text editor to copy it, or use the upload button.
Why are there IP addresses in my report I don't recognise?
Usually one of three things: a service you use and forgot (a help desk, a billing tool, a CRM), a forwarder or mailing list passing your mail on, or someone spoofing your domain. A reverse DNS or WHOIS lookup on the IP usually tells you who runs it. Spoofed mail tends to fail both SPF and DKIM.
SPF and DKIM pass, so why does DMARC fail?
Because DMARC also needs alignment. A service can pass SPF for its own bounce domain and sign DKIM with its own domain, and both raw checks pass while neither matches your From domain. That shows as pass in auth_results and fail in policy_evaluated. The usual fix is to set up DKIM with your own domain in that service.
How often do DMARC reports arrive?
Usually once a day from each provider that received mail from your domain. The DMARC standard sets the default reporting interval at one day, and most providers send daily whatever you ask for. A provider that saw no mail from you that day usually sends nothing.
Is it safe to paste a DMARC report here?
Aggregate reports hold IP addresses, domains, message counts and pass or fail results. They don't contain message content or recipient addresses. The analyser reads the report, sends back the result and doesn't store the report. No account is needed.