Tool 2.7

DMARC report reader (XML, GZ and ZIP aggregates)

Open a DMARC aggregate report (.xml, .xml.gz or .zip) and see, for each sending IP, how many messages passed or failed SPF and DKIM. Read in your browser.

Runs on your deviceRuns entirely in your browser: nothing you type or upload leaves your device.

How to use it

Open one of the report emails that arrive at the address in your DMARC record's `rua=` tag, and save its attachment.
Drop the `.xml`, `.xml.gz` or `.zip` file in the box. It's unpacked and read in your browser, not uploaded.
Check the totals first, then the IPs that failed both SPF and DKIM, then the full table of sending IPs.

What arrives once your DMARC record has rua=

When your DMARC record includes a rua=mailto: address, large mail receivers send that address a report, usually once a day, about the mail they saw with your domain in From. Each report lists the sending IPs, how many messages came from each, whether they passed SPF and DKIM for your domain, and what the receiver did with them.

The report is an XML file, often compressed as .gz or .zip, full of tags like <source_ip> and <policy_evaluated> that are hard to read by hand. This page unpacks it and turns it into tables: an overview with your published policy, the totals, the IPs that failed both checks, and every row of the report. It reads one file at a time.

Example: a forgotten invoicing service and an unknown sender

A report for tienda-ejemplo.co shows the policy p=none and 1,250 messages. Passed authentication: 1,190 (95%), counting messages that passed SPF or DKIM for your domain. Failed both SPF & DKIM: 60 (5%), from two IPs: 203.0.113.88 with 45 messages and 198.51.100.23 with 15.

Look each IP up, for example its reverse DNS with the DNS lookup tool. If 203.0.113.88 turns out to be your invoicing software, that's your own mail: add the service to your SPF record or turn on DKIM in it. If 198.51.100.23 is nobody you work with, someone is sending as your domain. With p=none, its Disposition column says none: those messages were delivered. Once all your own services pass, p=quarantine sends the rest to spam.

What a report leaves out, and how late it arrives

Aggregate reports carry counts, not messages: no subjects, no bodies, no recipients. From a report you can tell which server sent how many messages and what happened to them, but not which emails they were.

Each report covers a past period, usually the previous day, so it's for reviewing your setup, not for catching an attack while it happens. And each receiver sends its own report: one file shows only what that company saw, so Gmail's report says nothing about mail sent to Outlook users.

FAQ

What's the difference between rua and ruf reports?

`rua` reports are the aggregate summaries this page reads. `ruf` reports, also called failure reports, describe single messages that failed, sometimes with parts of the message. Many large receivers don't send `ruf` reports at all, so `rua` is what you'll usually get.

What does disposition mean in a DMARC report?

What the receiver did with those messages: `none` means it delivered them as usual (its own spam filter still applies), `quarantine` usually means the spam folder, and `reject` means it refused them. It follows your policy, but receivers can make exceptions, so a domain with `p=reject` can still see some `none`.

What does “Passed authentication” count?

Messages where SPF or DKIM passed for your domain, which is what DMARC asks for: one of the two is enough. Messages that failed both are counted apart, with their IPs listed.

Why does some of my own mail fail SPF and DKIM?

Usually because it went out through a service you haven't set up yet: a newsletter tool, an online store, invoicing software. Forwarding also breaks SPF, and mailing lists that edit the message can break DKIM, so a few failures from a forwarder you know are normal.

Why do DMARC reports come as .zip or .gz files?

They're compressed to save space, since a report can have many rows. You don't need to unpack them: drop the `.zip` or `.xml.gz` as it came. If a `.zip` holds several files, the first `.xml` inside is read.

Guides for this tool

G25How to read your first DMARC report, line by lineWhat each part of a DMARC aggregate report means, why your own services may fail, how to tell a forwarder from a spoofer, and the road to p=reject.

2.1What's my IP?See your public IP address, whether it's IPv4 or IPv6, your country, TLS and HTTP version, and what every website can learn from your connection.
2.2Email securityCheck a domain's SPF, DKIM, DMARC, MTA-STS, BIMI and DNSSEC, and get copy-ready DNS records for what's missing or wrong.
2.3SPF record builderBuild one SPF record for your domain from your mail services, servers and IP ranges.
2.4DNS lookupLook up any domain's DNS records (A, AAAA, CNAME, MX, TXT, NS, SOA, CAA, SRV) or the reverse DNS of an IP, with TTLs and DNSSEC validation.
2.5Email header analyzerPaste an email's raw headers to see the servers it passed through, the SPF, DKIM and DMARC results your provider recorded, and signs of a forged sender.
2.6DNS propagation checkerAsk 10 public resolvers (Google, Cloudflare, Quad9, OpenDNS…) for a name's A, AAAA, CNAME, MX, NS or TXT records and see if your DNS change reached them.
2.8Is it down?Check whether a website answers, with its HTTP status, response time, redirects and HTTPS, measured once from our server in Colombia.
2.9DMARC record generatorBuild a DMARC TXT record: policy, test mode, report addresses and alignment.
2.10Link preview checkerSee how your link will look when shared on WhatsApp, X, LinkedIn or Facebook: check the title, description, og:image and Twitter card tags, with fixes.
2.11Subnet calculatorType an IP address with its prefix to get the network, mask, broadcast, usable host range and count, and split it into equal subnets.

╌╌ END ╌╌