DMARC Aggregate Report Viewer

Upload a DMARC aggregate report (XML, gzip, or ZIP) from your mail server to see SPF/DKIM authentication and policy results by source IP in a readable table. Parsing happens 100% in your browser — the file is never uploaded to a server.

Last updated: 2026-09-09

What is a DMARC Report Viewer

If a domain has DMARC enabled, receiving mail providers such as Gmail, Yahoo, and Microsoft send back a daily XML file summarizing who sent mail claiming to be from that domain, how many messages arrived, how SPF and DKIM authentication turned out, and how the DMARC policy was applied. This is called a DMARC aggregate report. The raw XML is not meant for humans to read, and it usually arrives compressed as gzip or inside a ZIP archive, so opening the attachment directly tells you almost nothing.

This tool converts that aggregate report XML, gzip, or ZIP file into a readable table of message counts, SPF/DKIM authentication results, and policy disposition per sending IP, right after you upload it in your browser. All parsing happens client-side in JavaScript, and the file contents are never transmitted to any server. Because these reports expose sensitive details such as your organization's mail sending IPs, that guarantee is a core part of the design.

How to Use the DMARC Report Viewer

Get the aggregate report file Locate the attachment (.xml, .xml.gz, or .zip) that was delivered to the mailbox listed in your DMARC record's rua tag.
Upload the file Drag and drop it onto the drop zone, or click to choose the file from your device.
Check the report metadata Review the reporting organization, date range, target domain, and the published policy (p) with its enforcement percentage (pct).
Review results by sending IP Each row lists a source IP's message count, SPF/DKIM pass or fail status, and how the policy was actually applied.
Look for unfamiliar senders If an IP you don't recognize is sending a large volume, treat it as a possible spoofing attempt and cross-check it against the From header.

Tips for getting more out of it

DMARC aggregate reports are normally emailed daily (as gzip or ZIP-compressed XML) to the address you specified in the "rua" tag of your DMARC record. You can upload that attachment directly to this tool.
A low "SPF & DKIM pass rate" often means a legitimate sender — your marketing platform, CRM, or an outsourced mail vendor — isn't configured correctly for SPF/DKIM. Note the source IP and investigate it.
While your policy (p) is still "none", messages that fail authentication are still delivered. Only tighten it to quarantine or reject once your pass rate is consistently high.
An unfamiliar source IP sending a large volume of messages under your domain can be a sign of phishing or spam abusing your brand. Check the Header From value and reverse-lookup the source IP.
When comparing multiple days of reports, jot down the date range (begin/end) embedded in each file so you can track how the pass rate changes over time.

When to Use the DMARC Report Viewer

Checking for spoofing and phishing attempts

Regularly scan the sending IPs claiming your domain for ones you don't recognize, so impersonation attempts surface early.

Verifying a new SPF/DKIM setup after migration

Right after switching mail providers or updating DNS records, confirm in the report that your actual sending sources are passing authentication.

Monitoring subdomain policy compliance

If you've published a subdomain policy (sp), verify that mail sent through subdomains is actually being handled the way you intended.

Auditing third-party senders

Identify marketing platforms, agencies, or SaaS tools sending on your domain's behalf, and check whether their SPF/DKIM setup is complete.

Deciding when to tighten your policy

Before moving from none to quarantine or reject, use the pass rate in the report to make sure legitimate mail won't get blocked by mistake.

DMARC Glossary

DMARC: Domain-based Message Authentication, Reporting & Conformance. It ties SPF and DKIM results together and lets a domain owner declare, via DNS, how mail that fails authentication should be handled.
SPF: Sender Policy Framework. The domain owner publishes a list of IP addresses authorized to send mail on its behalf in DNS, and receivers check the actual sending IP against that list.
DKIM: DomainKeys Identified Mail. It attaches a cryptographic signature to outgoing mail so receivers can verify the message wasn't altered in transit and genuinely came from the claimed domain.
Aggregate report: A daily XML report delivered to the address named in a DMARC record's rua tag, summarizing message counts, authentication results, and policy disposition for each sending IP.
Policy (p / sp): How mail that fails authentication should be treated: none (take no action, monitor only), quarantine (treat as suspicious, e.g. send to spam), or reject (refuse delivery). 'p' applies to the domain itself and 'sp' to its subdomains.
Alignment: Whether the domain in the From header matches the domain actually verified by SPF or DKIM. If they don't match, the message fails DMARC even if SPF or DKIM individually passed.
pct: The percentage of qualifying messages to which the DMARC policy is applied. Setting it below 100 applies enforcement to only that share of traffic, which is useful for a gradual rollout.
Disposition: The action a receiving server actually took on a message, recorded per source IP in the report, so you can confirm whether it matched the declared policy (p/sp).

Frequently Asked Questions

If you've listed an email address in the "rua" tag of your DMARC DNS record, major mail providers will send a daily XML attachment (gzip or ZIP compressed) to that mailbox. If you haven't set "rua" yet, add it to your TXT record first — otherwise you won't receive any reports.

No. Decompression and XML parsing all happen in JavaScript inside your browser, and the contents are never sent anywhere. Since DMARC reports contain your organization's outbound mail source IPs, this tool is designed with privacy and security in mind.

If a legitimate sender is failing authentication, tightening your DMARC policy to quarantine or reject could cause that sender's mail to stop being delivered. Keep your policy at "none" (monitor only) until your pass rate is consistently high.

This tool only supports the daily aggregate report format ("rua"). Forensic reports ("ruf"), which contain copies of individual failed messages, use a different format and aren't supported here.

The current version supports one file per upload. To compare several days of reports, upload and review them one at a time.

Side Note — How DMARC reports turned an invisible problem visible

DMARC (Domain-based Message Authentication, Reporting & Conformance), standardized in 2012, ties together two existing authentication mechanisms — SPF and DKIM — and lets a domain publish, via DNS, exactly how mail that fails authentication should be handled. But for most administrators, the real value isn't the policy enforcement itself — it's the aggregate reporting ("rua") feature.

Before DMARC, there was almost no way to know how much mail was being sent claiming to be from your domain, or how much of it was legitimate versus spoofed. Abuse of your domain's reputation could go on indefinitely — an invisible threat you'd only learn about from angry recipients, if at all.

A DMARC aggregate report makes that traffic visible: which IPs sent how many messages claiming your domain, and how each one fared against SPF and DKIM. Major providers (Gmail, Yahoo, Microsoft, and others) faithfully report back on the mail they receive, letting you discover senders you didn't even know about — a cloud service, a salesperson's personal mail tool, or an outright impersonator.

When Google and Yahoo effectively made DMARC mandatory for bulk senders in 2024, demand for parsing aggregate reports surged among developers and mail administrators. Many organizations adopt a paid monitoring SaaS, but for a quick, one-off look at a single report, a free, fully client-side tool like this one is often all you need.

Browse all trivia