DMARC report analyzer

Drop a DMARC aggregate report (XML, gz or zip) and see who sends email as your domain and which sources fail.

Sample reports

Example: a day of Google, Microsoft and Yahoo reports for northwind-outbound.com

Runs in your browser. The files never leave your device.Showing the sampleXML, gz, zip or .eml, up to 200 files at once

81%

of 1,285 messages passed DMARC

1 sender fails DMARC

northwind-outbound.comp=none

81% of 1,285 messages passed DMARC for northwind-outbound.com. SendGrid sent 195 messages that failed. Fix them, then move to p=quarantine.

1,041 passed9 forwarded235 failed

Messages

1,285

Oct 15, 2026

Senders

2 recognized, 2 unrecognized

Reporters

google.com, Enterprise Outlook, Yahoo

Blocked by receivers

p=none, all delivered

Needs attention

3 findings, worst first.

SendGrid fails DMARC

195 of 195 messages from SendGrid passed neither SPF nor DKIM for northwind-outbound.com. DKIM signed as sendgrid.net and SPF passed for sendgrid.net, its bounce domain. Neither is your domain, so DMARC fails.

2 IPs

SendGrid > Settings > Sender Authentication > Authenticate Your Domain. Publish the CNAME records it gives you (s1 and s2).Check the DKIM record

40 messages from 2 unrecognized networks fail DMARC

Nothing in the reports ties them to a service you use. If you don't recognize them, someone is sending as northwind-outbound.com, which is what quarantine and reject stop. If one is yours, a server or app you run, set up DKIM there.

203.0.113.0/24, 35 messages

p=none: nothing is blocked yet

Receivers send reports but deliver mail that fails DMARC as normal, spoofed mail included.

p=none

Fix the senders above first, then move to p=quarantine and watch a week of reports.Build the new record

1 passed, 1 for information

Nothing to do here. Open it to see the detail.

9 forwarded messagesGoogle Workspace passes with alignment

ShowHide

9 forwarded messages

Forwarding changes the sending server, so SPF fails, and mailing lists that edit the message break DKIM. There is nothing to fix on your side; ARC lets receivers trust the forwarder.

Google Workspace passes with alignment

1,041 messages, DKIM aligned with northwind-outbound.com and SPF too.

Senders

Grouped by service, named from the DKIM and SPF domains in the reports. Shares are of each sender's messages.

Sender

Messages

DMARC pass

DKIM aligned

SPF aligned

Status

Google Workspace

2 IPs

1,041

100%

Aligned

SendGrid

2 IPs

195

Failing

203.0.113.0/24

Unrecognized network, 1 IP

Failing

Forwarded mail

Mailing lists and forwarders

Forwarded

198.51.100.0/24

Unrecognized network, 1 IP

Failing

Policy

The record receivers saw in the newest report.

p=noneReports only, all mail delivered

p=quarantineFailing mail goes to spam

p=rejectFailing mail is refused

Policy for the domain

p=none

Policy for subdomains

sp=none

DKIM alignment, r relaxed or s strict

adkim=r

SPF alignment, r relaxed or s strict

aspf=r

Share of mail the policy covers (removed in RFC 9989)

pct=100

When to send failure reports

fo=0

All 7 sending IPs

Most mail first. They stay on this page and never go in the emailed report.

ShowHide

Sender

Messages

DKIM

SPF

Result

209.85.220.41

Google Workspace

600

pass

Aligned

209.85.220.69

Google Workspace

441

pass

Aligned

167.89.101.24

SendGrid

137

fail

Failing

167.89.101.31

SendGrid

fail

Failing

203.0.113.77

203.0.113.0/24

fail

Failing

2607:f8b0:4864:20::1046

Forwarded mail

fail

Forwarded

198.51.100.14

198.51.100.0/24

fail

Failing

3 reports read

One row per report, oldest first.

ShowHide

Reporter

Period

Messages

Report ID

google.com

Oct 15, 2026

975

13790553480941276508

Yahoo

Oct 15, 2026

1792111853.402917

Enterprise Outlook

Oct 15, 2026

229

4b6f0c2e9a1d4e7b8c35f1a2d9e06b47

DMARC checker

Then

DMARC record generator

Email me the summary

The verdict, the fixes and the senders that fail, so you can check again after a change. Counts only: no IPs, no report rows, and the files never leave this tab.

Senders that fail, with the fixFixes worst firstNo IPs or files in the email

Ken watches this for every domain it sends from.

Add your domains and Ken watches DNS, blacklists and bounce rates for you, and pauses an inbox before it does damage.

Start free - 1,000 credits, no card

What the DMARC report analyzer does

Receivers that honor your rua tag send aggregate DMARC reports as XML, usually zipped or gzipped. Drop the .xml, .gz or .zip files here and the analyzer reads them in your browser. It groups sending IPs by provider and network, shows how many messages each sent, and whether SPF and DKIM passed and aligned with your domain.

Files never leave your device. Reports list IP addresses and domains, and reading them locally keeps them on your machine. If you email yourself the summary, it holds counts and the services that send as you, never an IP, a report row or a file.

How to read a report

Each record is one source IP with a message count. policy_evaluated holds the DMARC verdict: whether SPF and DKIM counted as aligned passes, and the disposition the receiver applied, none, quarantine or reject. auth_results holds the raw SPF and DKIM checks with the domains they ran on.

The gap between the two is where the answers are. SPF pass in auth_results with SPF fail in policy_evaluated means SPF passed for a domain that isn't yours, usually a sending tool's bounce domain. A DKIM pass for a d= domain that isn't yours means the tool signs with its own key.

How to fix unaligned sources

If your own mail provider fails, check its include in your SPF record and its DKIM setup.
If a service you use fails, such as a CRM or billing tool, set up DKIM with your domain in that service, and a custom Return-Path if it offers one.
Forwarders and mailing lists break SPF. DKIM usually survives, and ARC helps receivers trust the forwarder. These failures need no fix on your side.
If an unknown network sends in volume as your domain, someone may be spoofing you. That's what p=quarantine and p=reject stop.

Why it matters for cold email

Before you move a domain from p=none to quarantine or reject, reports are the only way to know which senders would get blocked. On a sending domain, a week of reports shows whether every inbox and tool passes with alignment.

Reports also catch drift. A tool that changes how it signs, a new inbox added without DKIM, or a provider sending from a new range all show up in the next day's reports.

Questions

How do I read a DMARC aggregate report?

Look at each source IP, its message count and its policy_evaluated result. Sources that fail both SPF and DKIM alignment are the ones quarantine or reject would block. Then check auth_results to see which domain each check ran on.

Why do DMARC reports come as zip or gz files?

Receivers compress the XML to keep attachments small. The DMARC reporting standard asks for gzip, and some large receivers send zip instead. Drop the compressed file here as it is. The analyzer unpacks it in your browser.

Who sends DMARC aggregate reports?

Most large mailbox providers, Google, Microsoft and Yahoo among them, send them daily to the rua address in your record. Many smaller providers don't, so reports cover most of your mail but rarely all of it.

Are my report files uploaded anywhere?

No. Unzipping, parsing and the charts all run in your browser. If you email yourself the summary, it holds counts, the findings and the services that fail, never an IP, a report row or the files.

What does SPF pass but DMARC fail mean in a report?

SPF passed for a domain that doesn't align with your From address, most often the bounce domain of a sending service. Set up DKIM with your own domain in that service. DMARC needs only one aligned pass.