How to read and visualize DMARC XML reports?
Still have a question, spotted an error, or have a better explanation or a source we should cite?
DMARC aggregate reports arrive as gzipped XML attachments from mailbox providers. Nobody reads raw XML, but it's worth understanding the structure so you know what the tools are showing you.
A single report entry looks roughly like this:
<record>
<row>
<source_ip>198.51.100.42</source_ip>
<count>1240</count>
<policy_evaluated>
<disposition>none</disposition>
<dkim>pass</dkim>
<spf>fail</spf>
</policy_evaluated>
</row>
</record>That's saying: 1,240 messages from IP 198.51.100.42 passed DKIM but failed SPF, and the disposition was 'none' (so they were delivered anyway, because you're in monitor mode). Multiply that across dozens of IPs over weeks of reports and you can see why no one reads raw XML.
For one-off checks: our free DMARC parser turns a raw XML file into a readable table. Good for a quick look at a single report.
For ongoing visualization: you want a dedicated reporting service. dmarcian and EasyDMARC both offer dashboards that aggregate your reports over time, map sending IPs to the services behind them, and flag alignment failures by source. Both have free tiers. Postmark also has a free DMARC reporting tool if you're already using them for transactional mail.
In the visualizations, look for: a timeline of pass/fail rates by source IP. Any IP that's consistently failing alignment needs fixing. Any IP you don't recognize at all needs investigating: it's either a forgotten sending service or a spoofing attempt.
Contributors
Who worked on this answer
Every name links to their profile. Every company links to their site. Real people, real accountability.
