DMARC Report Analyzer

Drop one or more aggregate DMARC XML reports here. The tool analyzes alignment, enforcement, failing sources, policy risk and practical next steps.

Report parsing stays local

Drop DMARC reports here

Supports XML and GZIP-compressed XML. You can select multiple reports.

Choose reports

Or paste XML

Current reported policy

The policy published in the most recent uploaded aggregate report.

Traffic summary

Combined totals across all uploaded reports.

Actions and recommendations

Prioritized guidance based on the uploaded evidence.

Sending sources

Each aggregate record, with authentication and alignment results.

Optional PTR, ASN and network-owner lookup. Only the listed source IPs are sent to the lookup services.

Source	Messages	From domain	DMARC	DMARC alignment	Authentication results	Receiver action	Assessment

DMARC record builder

Start from the reported policy, review each setting and generate a proposed DNS TXT value.

Policy (p) What receivers should do with mail that fails DMARC.

Subdomain policy (sp) Optional separate policy for subdomains.

DKIM alignment (adkim) Strict requires an exact signing-domain match.

SPF alignment (aspf) Strict requires an exact return-path domain match.

Enforcement percentage (pct) Apply enforcement to this percentage of failing mail.

Failure options (fo) Controls when forensic failure reports are requested.

Aggregate report address (rua) Not normally included in aggregate XML, so enter the existing mailbox manually.

Forensic report address (ruf, optional) Many providers do not send forensic reports; they can contain sensitive message details.

Generated TXT value

What the settings mean

p: none, quarantine or reject

none only monitors. quarantine asks receivers to treat failing mail as suspicious, commonly routing it to spam. reject asks receivers to refuse failing mail.

DMARC passes when aligned DKIM or aligned SPF passes

Only one aligned authentication mechanism is required. A report can therefore show SPF failure while DMARC still passes because DKIM passed and aligned with the visible From domain.

Strict versus relaxed alignment

Strict alignment requires the authenticated domain to exactly match the visible From domain. Relaxed alignment also allows organizational subdomains. Strict is stronger but can require custom return-path and DKIM configuration at each sender.

Why aggregate reports do not reveal the complete DNS record

Aggregate XML normally includes the effective policy fields but not every original tag, such as the aggregate reporting mailbox. Verify the generated proposal against the live DNS record before publishing it.