// TOOLS
Security Tools
📬 DMARC Report Analyzer
Upload the aggregate reports that reach your rua mailbox (XML, .gz or .zip, as they come) and we show who sends mail on behalf of your domain, what passes DMARC and what is missing to reach p=reject without losing legitimate mail.
🔒 Processed in your browser: the file is not uploaded anywhere and no network lookup is made, not even for the IP addresses it contains.
The analyzer needs JavaScript.
Have the XML as text? Paste it
How these reports work
Where do they come from?
Large providers (Google, Microsoft, Yahoo…) send a daily summary of the mail they received with your domain as the sender to the address in the rua tag of your DMARC record. Without it, you get none:
_dmarc.yourdomain.com TXT "v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com"Generate your DMARC record · audit the one you have
How to read them
- A message passes DMARC if SPF or DKIM passes and is also aligned with the visible sender domain. That is what the receiver records in each row.
- Every service that sends on your behalf (your mailbox, the CRM, newsletters, the website) should show up as passing. If a legitimate one fails, fix it before tightening the policy.
- What fails and you do not recognise is almost always spoofing: exactly what p=reject makes receivers reject.
- Forwarding breaks SPF (the source IP changes) but not DKIM: sign everything you send with DKIM.