DMARC Report Viewer

Paste a DMARC aggregate report and see who sent mail as your domain, how many messages, and whether each source passed DKIM and SPF alignment.

Free · No sign-up · Your inputs stay in your browser

Input

Read a DMARC aggregate report

Report XML

<?xml version="1.0" encoding="UTF-8" ?>
<feedback>
  <report_metadata><org_name>google.com</org_name><report_id>1759276800123</report_id>
    <date_range><begin>1759276800</begin><end>1759363199</end></date_range></report_metadata>
  <policy_published><domain>example.com</domain><adkim>r</adkim><aspf>r</aspf><p>quarantine</p><pct>100</pct></policy_published>
  <record><row><source_ip>209.85.220.41</source_ip><count>412</count>
    <policy_evaluated><disposition>none</disposition><dkim>pass</dkim><spf>pass</spf></policy_evaluated></row>
    <identifiers><header_from>example.com</header_from></identifiers>
    <auth_results><dkim><domain>example.com</domain><result>pass</result></dkim><spf><domain>example.com</domain><result>pass</result></spf></auth_results></record>
  <record><row><source_ip>54.240.8.12</source_ip><count>96</count>
    <policy_evaluated><disposition>none</disposition><dkim>pass</dkim><spf>fail</spf></policy_evaluated></row>
    <identifiers><header_from>example.com</header_from></identifiers>
    <auth_results><dkim><domain>example.com</domain><result>pass</result></dkim><spf><domain>amazonses.com</domain><result>pass</result></spf></auth_results></record>
  <record><row><source_ip>185.220.101.9</source_ip><count>14</count>
    <policy_evaluated><disposition>quarantine</disposition><dkim>fail</dkim><spf>fail</spf></policy_evaluated></row>
    <identifiers><header_from>example.com</header_from></identifiers>
    <auth_results><spf><domain>mail.spoofer.test</domain><result>pass</result></spf></auth_results></record>
</feedback>

The file inside the .zip or .gz that rua reports arrive as.

Output

0 messages, 0% passing DMARC

The DKIM and SPF columns under policy_evaluated are the aligned results DMARC used; auth_results shows the raw checks. A source that passes SPF for its own domain (amazonses.com above) but not for yours is unaligned: fix it by setting a custom MAIL FROM domain or by having the service sign with DKIM as your domain.

Runs in this browser. Nothing you paste is sent to a server.

About this tool

Method, assumptions, practical next steps, and limits.

Reading a row

policy_evaluated holds the aligned results that decide DMARC; auth_results holds the raw checks. A source that passes SPF for amazonses.com but shows SPF fail under policy_evaluated is sending for you without alignment: configure a custom MAIL FROM domain or DKIM signing with your domain on that service. The format is defined in RFC 7489 appendix C.

Unknown sources

An IP you do not recognise with failing results is either spoofing, which DMARC enforcement will stop, or a legitimate service nobody told you about. Reverse DNS on the IP usually tells which.

Frequently asked questions

Why are reports zipped?

Receivers compress them to keep mail small; most send .zip or .gz attachments. Extract the XML file first.

How often do reports arrive?

Usually once a day per receiving organisation that sends reports, covering the previous 24 hours.

Is what I paste sent anywhere?

No. The tool runs entirely in your browser with JavaScript. Nothing you type or paste is sent to our server or stored.

DMARC Report Viewer

Read a DMARC aggregate report

0 messages, 0% passing DMARC

Reading a row

Unknown sources

Frequently asked questions

Similar tools

nmap Command Builder

SSL Certificate Decoder

SHA Hash Generator