DMARC report analyzer that reads aggregate XML reports, even .zip and .gz files, and shows which IPs pass SPF, DKIM and alignment. Free, no signup or upload.
Also known as: dmarc report analyzer · dmarc xml viewer · dmarc aggregate report viewer · read dmarc report · dmarc rua report parser · dmarc report reader free · dmarc xml to csv · dmarc report visualizer · analyze dmarc xml file · dmarc zip file viewer
DMARC report analyzer that reads aggregate XML reports, even .zip and .gz files, and shows which IPs pass SPF, DKIM and alignment. Free, no signup or upload.
Is DMARC Report Analyzer free to use?
Yes. DMARC Report Analyzer is completely free with no usage limits, and there is no paid tier required to use it.
Do I need an account to use DMARC Report Analyzer?
No. DMARC Report Analyzer works immediately in your browser with no signup, login, or email address required.
Share code snippets, logs, and text with a shareable link. Syntax highlighting for 30+ languages, expiration controls, and password protection for Pro users.
Drop DMARC report attachments here (.xml, .xml.gz, .zip or the saved .eml), or click to browse
Select as many files as you like; they are combined and duplicates are skipped. Read in your browser, never uploaded.
DMARC Analysis
Every sending IP, its message count, whether SPF and DKIM aligned with your domain, what receivers did with the mail, and plain-English findings about spoofing and misconfigured senders will appear here.
About DMARC Report Analyzer
A DMARC report analyzer is used to read the aggregate (rua) XML reports that Gmail, Outlook.com and other mailbox providers send to your domain, and to see every server that sends mail as you. It groups the records by source IP, shows whether SPF and DKIM aligned, estimates what p=quarantine or p=reject would block, and flags spoofing and misconfigured senders.
Key Features
Opens .xml, .xml.gz and .zip report attachments, and pulls them out of saved .eml report emails
Combines any number of reports from many receivers into one view and skips duplicates by reporter and report ID
Groups records by source IP with message counts, DMARC pass rate, aligned SPF and DKIM, and the raw auth results behind them
Flags spoofing, DKIM or SPF that passes for a provider's domain instead of yours, DKIM broken by mailing lists, and receiver overrides
Explains the published policy (p, sp, np, pct, adkim, aspf, fo, t) and counts the mail that p=quarantine or p=reject would have stopped
Reads RFC 7489 and RFC 9990 (DMARCbis) reports and exports every record to CSV
Use Cases
Checking that Gmail and Yahoo see aligned SPF or DKIM on your marketing mail, which their bulk sender rules have required since February 2024
Confirming mail to Outlook.com, Hotmail and Live.com authenticates under Microsoft's high-volume sender rules, enforced from May 5, 2025
Finding every service that sends as your domain (Google Workspace, SendGrid, Amazon SES, your CRM) before moving from p=none to p=reject
Spotting an unknown IP spoofing your domain in invoice or payroll phishing aimed at your customers
Exporting a CSV of every record as evidence of DMARC monitoring for a SOC 2 or cyber insurance review
Reading the report a receiver emailed you without signing up for a paid DMARC dashboard
Supported Formats
Aggregate report XML (.xml)
Gzip reports (.xml.gz, .gz)
Zip reports (.zip), several files per archive
Saved report emails (.eml)
RFC 7489 and RFC 9990 (DMARCbis) schemas
Related Keywords
dmarc report analyzer
dmarc xml viewer
dmarc aggregate report viewer
read dmarc report
dmarc rua report parser
dmarc report reader free
dmarc xml to csv
dmarc report visualizer
analyze dmarc xml file
dmarc zip file viewer
How do I read a DMARC aggregate report?
Each <record> says how many messages (count) one server (source_ip) sent with your domain in the From header (header_from), and how the receiver judged them. The verdict that counts is policy_evaluated: a message passes DMARC when dkim or spf there is pass, which means that check passed for a domain aligned with your From domain. auth_results lists the raw SPF and DKIM results, including passes for other domains such as amazonses.com that do not count toward DMARC. disposition is what the receiver did: none (delivered), quarantine (spam folder) or reject. Start with the sources that fail. If you recognize one, set up custom DKIM or a custom return-path at that provider; if you do not, it is spoofing that p=quarantine or p=reject will stop.
Your reports never leave this tab
Files are unpacked and parsed in your browser. Nothing is uploaded, no IP address is looked up, and auto-save keeps only the text summary.