DMARC report XML analyzer

Bookmark

Use this free DMARC report analyzer tool to read one aggregate XML, GZIP or ZIP report and review senders, authentication alignment and failures.

Understand your DMARC aggregate report

DMARC report analysis

Use this DMARC report XML analyzer tool to summarize one aggregate report's senders, SPF/DKIM alignment and failures. Open XML, GZIP or ZIP without an account. To collect future reports from participating providers, use Suped's DMARC monitoring.

Get started

"This clarity allows us to take action faster whether it's adjusting content, fixing authentication, or addressing reputation issues. We've moved from reactive guesswork to proactive management."

John Porteous

Group IT Manager

Read a DMARC aggregate report: an annotated example

Each DMARC aggregate report covers one provider and period. Compare counts and alignment by sending source, starting with failures from recognized services; an unknown IP alone does not prove abuse.

Illustrative aggregate row Source IP: 192.0.2.10 Message count: 100 Header From: example.com Aligned SPF: fail Aligned DKIM: pass DMARC: pass Disposition: none

Aligned DKIM lets this illustrative row pass DMARC despite failing aligned SPF.

Inspect authentication on a real test email

Open XML, GZIP, or ZIP DMARC reports

Open one aggregate RUA report as XML, GZIP or ZIP; a ZIP uses its first XML file, not every report. Failure reports, EML messages and JSON are unsupported.

Authentication results versus current DNS checks

The XML reflects historical authentication, while Suped's source and DNS lookups show current configuration that may have changed. Collect reports continuously to compare trends rather than treating one upload as a complete history.

Automatically collect future DMARC reports

DMARC report analysis

Review source IPs, message volume, SPF and DKIM alignment, DMARC results, and policy actions.

DMARC aligned

SPF passed

DKIM signed

Authentication results

See DMARC, SPF, and DKIM pass rates without reading raw XML elements.

DNS provider

Managed in Cloudflare

Sending source breakdown

Group source IPs into recognizable sending services and compare message volume.

DMARC

p=quarantine

SPF failures protected

Alignment visibility

Understand whether SPF and DKIM aligned with the visible From domain.

p=nonequarantinereject

Policy actions

Review whether receivers applied none, quarantine, or reject to failed messages.

Priority fix

Move DMARC from monitoring to quarantine after sender alignment passes.

Failure triage

Separate legitimate sender configuration problems from blocked spoofing attempts.

Record found

Single record

Record valid

Readable report details

Inspect report provider, date range, domain, report ID, and message counts in one view.

DMARC report analyzer FAQs

Answers to common questions about aggregate DMARC XML reports and their authentication results.

It is a machine readable report sent by participating mailbox providers. It summarizes messages using your domain, their source IPs, SPF and DKIM authentication, DMARC alignment, and the policy action applied.

No. It only reads the uploaded report and presents its contents. It does not change DNS, sender configuration, or your published DMARC policy.

No. XML parsing runs in your browser, but source IPs, domains, and DKIM selectors are sent to Suped for live lookups. A file that triggers a parsing or decompression exception may also be included in diagnostic logs. Do not assume this is an offline or no-upload analyzer.

DMARC passes when either SPF or DKIM passes and aligns with the visible From domain. A message can therefore fail SPF but pass DMARC through an aligned DKIM signature.

It means the source IP was not identified as a recognized sending service. It may be an unauthorized sender, a legitimate service that needs configuration, or a source that cannot be identified from the report alone.

No. Failures from legitimate senders usually need SPF or DKIM alignment work. Failures from unauthorized sources can show that quarantine or reject is correctly protecting the domain.

No. Each report covers mail observed by one reporting provider during a specific period. A complete view requires reports from multiple mailbox providers over time.