Trust beats tactics™

DMARC

DMARC Aggregate Report Parser

Mailbox providers send a daily XML report to the address in your rua= tag, almost always as a gzipped or zipped file. Drop that file here (or paste the XML) and we turn it into a plain-English summary: who is sending as your domain, and what share of your mail actually passes DMARC.

Just need to read the DMARC record itself? Use the DMARC Record Parser.

Upload the report a mailbox provider sent you

Reports are almost always gzipped (.xml.gz) or zipped.

We decompress and parse the report on our server. XML is read with a safe parser (no DTDs, no external entities). Nothing you upload is stored beyond the time it takes to render this summary.

How this tool works

What the parser is actually doing

  1. 1

    It opens the report

    An aggregate report is one XML document, wrapped in a <feedback> element. The parser decompresses the file and reads that structure.

  2. 2

    It lists who sent as you

    Every source IP that sent mail claiming to be your domain during the window, with a message count and the SPF, DKIM and DMARC verdicts for each.

  3. 3

    It rolls it up

    A pass rate plus a per-source table, so you can see at a glance which senders are legitimate and which are failing.

  4. 4

    It keeps nothing

    Everything runs on our server. The XML parser ignores document type definitions and never expands external or custom entities, so a hostile report can only fail cleanly. We do not keep the report after the summary is rendered.

Example report, made-up numbers

92%
pass rate
3
sources

Per source

192.0.2.10
1,204 messages. SPF, DKIM and DMARC pass.
192.0.2.44
310 messages. SPF, DKIM and DMARC pass.
198.51.100.7
131 messages. DMARC fails. Do you know this one?

When to use it

Reach for it in these moments

  • The reports are unreadable XML

    You published a DMARC record at p=none and the reports started arriving. This tool tells you what they say.

  • Before you tighten your policy

    Before you move to quarantine or reject, you need to know every legitimate service that sends as you is already passing. The failing-sources list is where you check.

  • You want to catch spoofing early

    If an IP you do not recognise is sending as your domain and failing DMARC, the report shows it.

  • While you tighten a policy

    Run each daily report through the parser, and keep the ones with failures until you have explained every source.

Email Almanac

  • Not sure what this means?

    Ask a real person. The Email SOS Hotline is free help with any email problem, no pitch. Cleaning a list does not fix a DNS record, so if this check found a problem, start here.

    Ask the Email SOS Hotline

  • Keep this result

    Send it to your inbox, to share with your team or compare after a fix.

    Run a check, then email it

  • Your setup is one half. Your list is the other.

    A record that passes proves the mail is yours. Mailbox providers also judge you on who you send to. Clean your first 1,000 addresses free.

    Clean your first 1,000 free