Tool
DMARC report analyzer
Aggregate reports arrive as compressed XML that nobody reads, which is why most domains publish p=none and stay there for years. Paste one here and it tells you the only thing that matters: which senders would lose mail if you enforced today.
A source failing both SPF and DKIM alignment is either a legitimate sender you have not authorised yet, or someone spoofing your domain. The distinction is made by identifying the IP, not by the report, so work down the failing list and account for every entry before raising your policy.
Alignment, not authentication, is what DMARC evaluates. A newsletter platform can pass its own SPF and DKIM checks while still failing alignment because the visible From domain is yours and the signing domain is theirs. The fix is a delegated subdomain signed with your own key rather than a wider SPF record.
What this doesn't cover
- This reads aggregate (RUA) reports only; forensic (RUF) reports have a different format.
- It does not query DNS, so it cannot tell you what your published record currently says.
- One report is one reporter's view of one day. Enforcement decisions need several reports across at least two weeks.
Questions we get asked
- How do I read a DMARC aggregate report?
- Extract the XML from the .gz or .zip attachment, then look at the policy_evaluated block for each record: a source passing neither SPF nor DKIM alignment is a sender that would lose mail once you enforce.
- Is my DMARC report uploaded anywhere?
- No. The XML is parsed in your browser and never leaves the page. Nothing is stored, logged or transmitted.
- When is it safe to move to p=reject?
- Once alignment sits at or near 100% across several reports covering at least two weeks. Low-volume senders such as billing and recruitment tools appear intermittently and are the usual cause of enforcement surprises.
Related pages
Want the failing senders identified for you?
We inventory every source across a full reporting period, fix alignment sender by sender, and take the domain to p=reject without dropping legitimate mail.