DMARC Report Analyzer
Analyze aggregate DMARC XML reports and export normalized results locally.
DMARC aggregate XML
Choose an uncompressed XML report. It is read locally and sent only to an isolated browser worker.
No upload
Turn aggregate XML into evidence
Inspect weighted alignment and disposition results without sending the report to StackCache.
Working notes
Use DMARC Report Analyzer with the boundary visible.
DMARC Report Analyzer turns a user-selected aggregate XML report into weighted alignment, disposition, source-IP, and record summaries in an isolated browser worker.
What is DMARC Report Analyzer?
DMARC aggregate reports are XML files that email receivers (Gmail, Microsoft 365, Yahoo, and other mail providers) send to domain owners, summarizing how messages from your domain performed against SPF, DKIM, and DMARC checks. When you publish a DMARC record with a rua= address, receivers send these reports daily or more frequently, each covering a reporting period and containing one record per unique combination of source IP, SPF result, DKIM result, and disposition. A typical domain receives dozens to hundreds of reports per month, each containing hundreds or thousands of records. Reading raw XML is impractical, and commercial DMARC monitoring services charge monthly fees. This analyzer processes aggregate report XML entirely in your browser using a Web Worker. It calculates message-weighted alignment rates, groups results by source IP and domain, highlights records where authentication failed, summarizes the published policy that was in effect, and identifies which sending sources need attention. Results can be exported as normalized CSV or JSON for spreadsheet analysis or integration with other tools.
When to use it
- Monitoring DMARC deployment — analyze reports during the transition from p=none to p=quarantine to p=reject to ensure legitimate senders are aligned before tightening the policy.
- Identifying unauthorized senders — find source IPs sending email as your domain that are not in your SPF record and do not have valid DKIM signatures.
- Investigating delivery issues — when emails are being quarantined or rejected, analyze reports to find which authentication check is failing and for which sending source.
- Auditing third-party senders — verify that marketing platforms, CRM systems, and other services sending on behalf of your domain are properly authenticated.
- Aggregate reporting — export normalized data as CSV for further analysis in spreadsheets or data tools.
How to use it
- 01Choose an uncompressed DMARC aggregate XML file or paste its XML.
- 02Review the reporting period, published policy, message-weighted alignment, dispositions, sources, and failed records.
- 03Export normalized CSV or JSON locally for further investigation.
Common mistakes
- Analyzing compressed files directly — DMARC reports arrive as ZIP or Gzip attachments. Extract the XML file first before uploading to the analyzer.
- Confusing message count with email count — each report record includes a count field representing how many messages matched that combination. A report with 10 records may represent thousands of messages.
- Ignoring "none" disposition — records with disposition "none" (no action taken) still show authentication failures. These indicate problems that will cause rejections when you move to p=reject.
- Single report conclusions — one report from one receiver covers a limited time window. Analyze reports from multiple receivers and periods before drawing conclusions about your authentication posture.
- SPF alignment vs SPF authentication — SPF can pass authentication (the sending server is authorized) but fail DMARC alignment (the envelope sender domain does not match the From header domain). Both must pass for DMARC SPF alignment.
Synthetic example
Analyze a synthetic aggregate report
Input
Two example records: eight aligned messages and two failed messages
Result
10 messages · 80% aligned · 8 none · 2 quarantine
Related standards
Limits and data boundary
- Only DMARC aggregate XML is supported; forensic message reports and compressed ZIP/Gzip files are not accepted.
- Input is limited to 5 MiB and 50,000 records; tables display the first 250 rows while exports include all normalized records.
- Aggregate reports describe one receiver's observations and cannot establish overall deliverability or sender identity.
Frequently asked questions
- What is a DMARC aggregate report?
- DMARC aggregate reports are XML files sent by email receivers (Gmail, Microsoft, etc.) to domain owners, summarizing authentication results for messages claiming the domain.
- Can I analyze compressed report files?
- Not directly. Extract the XML from the ZIP or Gzip archive first, then upload or paste the XML into the analyzer.
- What do alignment results mean?
- SPF alignment checks that the envelope sender domain matches the From header domain. DKIM alignment checks that a passing DKIM signature domain matches the From header domain. Both must align for DMARC to pass.
Keep working