DMARC report viewer
Drop the cryptic .xml.gz attachments from your DMARC rua reports and read them as a human: who sends as your domain, how much, and what fails SPF or DKIM.
- 100% in your browser — never uploaded
- Reads .xml, .gz, and .zip — drop several at once
- Free, no signup
No report handy?
How it works
Your reports never leave your device
01
Drop the attachments
The .xml, .xml.gz, or .zip files from your rua report emails — drop a whole week of them at once.
02
Decompressed & parsed locally
JavaScript in your browser unpacks the archives and reads the XML. No upload, no server, no account.
03
Read the verdict
One aggregated table across all reports: sources, volumes, alignment results, and what looks like spoofing.
What are DMARC aggregate reports?
When you publish a DMARC record with a rua=mailto: address, every major mailbox provider starts sending you a daily XML summary of all mail that claimed to come from your domain — with filenames like google.com!example.com!1720137600!1720223999.xml.gz. Each report lists the sending IPs, message counts, and whether that mail passed SPF and DKIM. If you're not receiving reports yet, build the record with our DMARC record generator and verify it's live with the DMARC checker.
Aligned vs. raw results
The DKIM and SPF columns in the table are the aligned results from policy_evaluated: a check only counts if it passed and the authenticated domain matches the From domain your recipients actually see. The expandable row shows the raw auth_results underneath — a raw SPF pass for somebody else's domain is still an aligned fail. DMARC passes when at least one aligned check passes.
Common patterns you'll see
- Forwarders — SPF fails (the forwarder's IP isn't in your record) but DKIM survives, so DMARC still passes. Normal; nothing to fix.
- Mailing lists — lists that add footers or rewrite subjects can break DKIM too. Modern lists rewrite the From address to compensate, so these usually fade out of your reports.
- Platforms sending on your behalf — your CRM, invoicing tool, newsletter, or helpdesk software shows up as its own IPs. If those rows fail, you usually need to enable that platform's custom DKIM (a CNAME they give you) and add them to SPF. Validate the result with our SPF checker and DKIM checker.
- Unknown IPs failing both at volume — likely someone spoofing your domain. That's what moving your policy from p=none toward quarantine or reject is for.
No message content inside
Aggregate (rua) reports contain counts, source IPs, domains, and authentication verdicts — never subject lines, bodies, or your recipients' addresses. They're safe to share with a consultant or paste into a viewer. (Forensic ruf reports are a separate mechanism that can contain message data, but almost no provider sends them anymore.)
FAQ
Why am I getting these XML report emails?
Because your domain's DMARC record has a rua tag (rua=mailto:[email protected]). That tag asks every receiving mail provider — Google, Microsoft, Yahoo, and many more — to send you a daily aggregate summary of all mail that claimed to come from your domain. They're a feature, not a problem: reports are how you find out who sends as your domain and whether that mail authenticates.
Are DMARC report attachments safe to open? Is anything uploaded here?
The attachments are plain data files — XML, usually compressed as .xml.gz or .zip — not executables. Apply the usual caution to unexpected attachments, but reports arriving at the address in your rua tag from reporters like google.com are expected mail. This viewer parses them entirely in your browser with JavaScript; nothing is uploaded to any server.
What does disposition=none mean?
The disposition is what the receiver actually did after evaluating your policy. disposition=none means the message was delivered normally — either it passed DMARC, or your published policy is p=none (monitor only). quarantine and reject mean the receiver enforced your stricter policy on mail that failed.
Why does SPF fail for forwarded mail?
SPF checks whether the connecting server's IP is authorized to send for the envelope sender's domain. When someone forwards your message, the forwarder's server does the delivering — and its IP isn't in your SPF record, so SPF fails. DKIM usually survives forwarding because the signature travels inside the message. That's exactly why DMARC passes if either aligned check passes.
Do I need a paid DMARC monitoring service?
Not to get started. For a small domain receiving a handful of reports a day, reading them in a free viewer like this one is plenty. Paid services earn their keep on busy domains: they aggregate months of reports across dozens of reporters, track trends, and alert on new sending sources. Start at p=none, identify every legitimate sender, then tighten your policy.
How do I start receiving DMARC reports?
Publish a DMARC TXT record at _dmarc.yourdomain.com with a rua tag, for example: v=DMARC1; p=none; rua=mailto:[email protected]. Our free DMARC record generator at inboxbucket.com/tools/dmarc-generator builds the record for you, and the DMARC checker verifies it's live. The first reports typically arrive within 24–48 hours.
Chasing one specific suspicious message instead of aggregates? Paste its raw headers into our free email header analyzer to trace the delivery path and see the SPF, DKIM, and DMARC verdicts for that exact email.