DMARC report analyzer: the XML nobody can read, in the shape of a decision.
Aggregate reports arrive as machine-readable XML that answers one question badly: which of your senders are failing, and are any of them not yours. This puts that first.
Parsed entirely in this browser. Nothing is uploaded — which matters, because an aggregate report names every server that sends as your domain.
A sample from one receiver, on one day.
Every mailbox provider sends its own report about the mail it saw. One report covers one provider for one window. A sender missing from it did not send there that day. It may still exist.
That is the limit of reading reports by hand. A sender inventory you can trust comes from weeks of reports across every provider, deduplicated and tracked over time, and doing that in a text editor is a job nobody keeps up.
Frequently asked questions.
A DMARC aggregate report is an XML file a mailbox provider sends, typically once a day, to the address in your DMARC record's rua= tag. It lists total volume, pass and fail counts, and the source IP of every server that sent mail claiming to be from your domain during that window.
No. The file is parsed in your browser with JavaScript and is never uploaded to a server. DDMARC keeps no per-visitor record of what you paste or upload beyond standard server logs.
Any server that sent mail as your domain during the report window appears, including marketing platforms, CRMs, and forwarders you authorized and forgot about. A source you genuinely do not recognize is worth investigating as a possible spoofing attempt.
This page reads one XML or gzipped XML (.xml.gz) file at a time. For a combined view across every report from every provider, a monitoring plan such as Monitor, free for 2 domains, parses and merges them automatically.
For help reading what comes back, see the reading DMARC reports guide.
DMARC Record Generator
Create a valid DMARC record for your domain. Configure policy, reporting emails, and advanced options.
SPF Record Generator
Build an SPF record to authorize your email senders. Includes common services and DNS lookup counter.
DKIM Key and Record Generator
Generate a DKIM key pair in your browser and get the TXT record to publish. The private key never leaves your device.
MTA-STS Record and Policy Generator
Build the _mta-sts TXT record and the mta-sts.txt policy file together, with MX patterns and max_age checked.
TLS-RPT Record Generator
Build the _smtp._tls record that asks senders to report failed TLS connections, with email and https destinations checked.
SPF Checker
Look up a domain's SPF record, walk every include, and count DNS lookups against the limit of 10.
Domain Checker
Check your domain's email authentication setup. See your SPF, DKIM, DMARC, and MTA-STS configuration.
DMARC Checker
Look up any domain's DMARC record and get every tag explained — policy, alignment, reporting, and coverage.
DKIM Checker
Check a domain's DKIM record by selector. See the key type, size, and each tag, with quick-picks for common providers.
MTA-STS & TLS-RPT Checker
Check a domain's MTA-STS policy record and TLS-RPT reporting — the pair that forces inbound mail over TLS.
BIMI Checker
Look up a domain's BIMI record, preview the logo, and confirm the VMC and DMARC enforcement it requires.
One report is a sample. A month of them is an inventory.
If reports are already arriving, the free Monitor plan collects and parses them for 2 domains — which is the same job as this page, done continuously and without you opening an attachment.