DMARC Report Reader: Upload Aggregate Reports and See Who Sends as You

Once you publish a DMARC record, XML reports start arriving by email, usually daily. Drop those files here to see which services sent mail as your domain, how many messages passed DMARC, and what to fix when they didn't. Everything is read in your browser, and the files are never uploaded.

Files are read only in your browser. Nothing is uploaded or stored.

How to use it

  • Save the attachments (.zip, .gz or .xml) from the emails sent to the address in your DMARC record's rua= tag. Google sends .zip files; most other mailbox providers send .gz.
  • Drag and drop the files onto the box above, or click "Choose files". There's no need to extract them, and you can load many reports at once (up to 20 MB in total).
  • To see what the results look like first, click "Try a sample report".

What a DMARC aggregate report is

DMARC lets receiving servers check, using SPF and DKIM, whether mail that uses your domain in the From address really came from you. If your DMARC record includes rua=mailto:…, mailbox providers such as Gmail and Yahoo send you a summary of the mail they received from your domain: which IP addresses sent it, how many messages, and how authentication went. These aggregate (RUA) reports usually arrive once a day, in the XML format defined in RFC 7489.

Reports include the services you use and also mail that spoofs your domain. Fix the legitimate senders that fail first; then a stricter policy stops only the spoofing.

How to read the results

  • DMARC pass: either SPF or DKIM passed with a domain that aligns with your From domain.
  • SPF aligned: the share where the sending IP is allowed by SPF and the envelope sender's domain aligns with your From domain.
  • DKIM aligned: the share signed with DKIM as your domain (or a subdomain of it) that verified.
  • Sender: identified from DKIM signing domains, the sending IP ranges providers publish in their SPF records, and SPF domains. For providers that don't publish sending ranges, the sender is marked as estimated from the provider's network.
  • With email services such as Amazon SES, SendGrid and Mailchimp, the envelope sender is the service's own domain, so SPF normally won't align. That's fine as long as DKIM aligns with your domain.

Common reasons for failing and how to fix them

  • Missing from SPF: add the service's value to your SPF record, such as include:_spf.google.com for Google Workspace or include:spf.protection.outlook.com for Microsoft 365. Keep a single SPF record per domain.
  • No DKIM: turn on DKIM signing for your domain in the service's settings and publish the public key it shows in DNS.
  • DKIM signed as the service's domain: set up domain authentication in the email service so it signs as your domain.
  • Forwarding and mailing lists: forwarding often breaks SPF, and changes to the subject or body break DKIM. A few failures like these are normal.
  • Senders you don't recognize: these may be spoofing your domain. Once all your legitimate senders pass, moving to p=quarantine and then p=reject keeps that mail out of inboxes.

What's in the files

Aggregate reports contain sending IP addresses, message counts and authentication results, not message content or recipients. This tool extracts and reads the files only in your browser and sends nothing to a server. The results disappear when you close the page.

Send newsletters that pass DMARC with DKIM

Newsletter Ready sends through Amazon SES. When you set up sending from your own domain, DKIM is signed as your domain, so your newsletters pass DMARC through DKIM. The DNS records you need are shown on screen.

See a sample issue made from your websiteSPF, DKIM & DMARC checker →What is DMARC? →Gmail and Yahoo sender requirements →

Sources

Senders are identified from published IP ranges and domains and may not always be accurate. Before changing your policy, also check your DNS settings and each service's documentation.