DMARC Report Analyzer
Turn the daily DMARC aggregate (RUA) XML your mailbox receives into a readable pass/fail-by-source view. Spot spoofing and misconfigured legitimate senders.
.gz inflated locally too) — nothing is uploaded or stored.
How to read this — in 20 seconds
A DMARC aggregate report lists every IP that sent mail claiming to be your domain over a day, and whether it passed DMARC. DMARC passes when either SPF or DKIM both authenticates and is aligned with the Header From domain (RFC 7489 §4.2).
- SPF / DKIM columns are the aligned results from
<policy_evaluated>— the verdict your receiver actually applied. - Auth detail shows the raw
<auth_results>: which domain authenticated, the DKIM selector, and whether that domain is strict/relaxed-aligned or unaligned withHeader From. Raw auth that isn’t aligned does not make DMARC pass. - A failing source is either spoofing, or a legitimate sender (newsletter, ticketing, forwarder) you haven’t authorised yet.
Relaxed alignment compares the organisational domain, which this tool works out with Mozilla’s Public Suffix List (so you.github.io and other.github.io are different organisations). The alignment hint is still advisory — the pass/fail verdict always comes from the report itself.
Drop DMARC report files here
Raw .xml or gzip’d .xml.gz — one or many. .zip archives: unzip first. Or paste XML below.