[{"data":1,"prerenderedAt":50},["ShallowReactive",2],{"tool-guide:dmarc-report-analyzer":3},{"overview":4,"whatIs":5,"useCases":6,"commonMistakes":12,"relatedStandards":18,"steps":28,"example":32,"limitations":36,"faq":40},"DMARC Report Analyzer turns a user-selected aggregate XML report into weighted alignment, disposition, source-IP, and record summaries in an isolated browser worker.","DMARC aggregate reports are XML files that email receivers (Gmail, Microsoft 365, Yahoo, and other mail providers) send to domain owners, summarizing how messages from your domain performed against SPF, DKIM, and DMARC checks. When you publish a DMARC record with a rua= address, receivers send these reports daily or more frequently, each covering a reporting period and containing one record per unique combination of source IP, SPF result, DKIM result, and disposition. A typical domain receives dozens to hundreds of reports per month, each containing hundreds or thousands of records. Reading raw XML is impractical, and commercial DMARC monitoring services charge monthly fees. This analyzer processes aggregate report XML entirely in your browser using a Web Worker. It calculates message-weighted alignment rates, groups results by source IP and domain, highlights records where authentication failed, summarizes the published policy that was in effect, and identifies which sending sources need attention. Results can be exported as normalized CSV or JSON for spreadsheet analysis or integration with other tools.",[7,8,9,10,11],"Monitoring DMARC deployment — analyze reports during the transition from p=none to p=quarantine to p=reject to ensure legitimate senders are aligned before tightening the policy.","Identifying unauthorized senders — find source IPs sending email as your domain that are not in your SPF record and do not have valid DKIM signatures.","Investigating delivery issues — when emails are being quarantined or rejected, analyze reports to find which authentication check is failing and for which sending source.","Auditing third-party senders — verify that marketing platforms, CRM systems, and other services sending on behalf of your domain are properly authenticated.","Aggregate reporting — export normalized data as CSV for further analysis in spreadsheets or data tools.",[13,14,15,16,17],"Analyzing compressed files directly — DMARC reports arrive as ZIP or Gzip attachments. Extract the XML file first before uploading to the analyzer.","Confusing message count with email count — each report record includes a count field representing how many messages matched that combination. A report with 10 records may represent thousands of messages.","Ignoring \"none\" disposition — records with disposition \"none\" (no action taken) still show authentication failures. These indicate problems that will cause rejections when you move to p=reject.","Single report conclusions — one report from one receiver covers a limited time window. Analyze reports from multiple receivers and periods before drawing conclusions about your authentication posture.","SPF alignment vs SPF authentication — SPF can pass authentication (the sending server is authorized) but fail DMARC alignment (the envelope sender domain does not match the From header domain). Both must pass for DMARC SPF alignment.",[19,22,25],{"title":20,"url":21},"RFC 7489 — DMARC","https:\u002F\u002Fdatatracker.ietf.org\u002Fdoc\u002Fhtml\u002Frfc7489",{"title":23,"url":24},"RFC 7489 Section 7.2 — Aggregate Reports","https:\u002F\u002Fdatatracker.ietf.org\u002Fdoc\u002Fhtml\u002Frfc7489#section-7.2",{"title":26,"url":27},"Google — About DMARC Reports","https:\u002F\u002Fsupport.google.com\u002Fa\u002Fanswer\u002F10032472",[29,30,31],"Choose an uncompressed DMARC aggregate XML file or paste its XML.","Review the reporting period, published policy, message-weighted alignment, dispositions, sources, and failed records.","Export normalized CSV or JSON locally for further investigation.",{"label":33,"input":34,"output":35},"Analyze a synthetic aggregate report","Two example records: eight aligned messages and two failed messages","10 messages · 80% aligned · 8 none · 2 quarantine",[37,38,39],"Only DMARC aggregate XML is supported; forensic message reports and compressed ZIP\u002FGzip files are not accepted.","Input is limited to 5 MiB and 50,000 records; tables display the first 250 rows while exports include all normalized records.","Aggregate reports describe one receiver's observations and cannot establish overall deliverability or sender identity.",[41,44,47],{"question":42,"answer":43},"What is a DMARC aggregate report?","DMARC aggregate reports are XML files sent by email receivers (Gmail, Microsoft, etc.) to domain owners, summarizing authentication results for messages claiming the domain.",{"question":45,"answer":46},"Can I analyze compressed report files?","Not directly. Extract the XML from the ZIP or Gzip archive first, then upload or paste the XML into the analyzer.",{"question":48,"answer":49},"What do alignment results mean?","SPF alignment checks that the envelope sender domain matches the From header domain. DKIM alignment checks that a passing DKIM signature domain matches the From header domain. Both must align for DMARC to pass.",1788868141299]