DMARC Report Analyzer

How DMARC aggregate reports work

When your DMARC record includes a rua tag, receivers such as Gmail, Outlook, Yahoo and many smaller providers send a report to that address, usually once a day. Each report covers one receiver and one time window. It arrives as an email with a compressed XML attachment (zip or gzip), and a busy domain can get dozens of them every day.

Inside, the XML has three parts. The report_metadata block names the receiver and the date range. The policy_published block repeats the DMARC record the receiver saw. Then come the record rows, one per sending IP and result combination.

The fields that matter in each row

The difference between auth_results and policy_evaluated is the part people miss. A message can pass SPF for bounces.esp-example.com in the raw results and still fail DMARC, because that domain does not match your From domain. That is an alignment failure, and it is the most common reason a legitimate tool fails DMARC. Our guide on how to read a DMARC aggregate report goes through a full example.

How to analyze a report by hand

Steps one to four are fine for a single file. Step five is why people look for a DMARC report analyzer. The value is not in any one report but in the merged view over weeks: which sources appear every day, which only on the first of the month, and which never should have appeared at all.

1. 1 Save the attachment and unzip it.
2. 2 Open the XML in a text editor or a browser and find the record rows.
3. 3 For each source IP, look up who owns it with a reverse DNS or WHOIS query.
4. 4 Note which rows fail DKIM or SPF alignment and add up the counts.
5. 5 Repeat for every report from every receiver, every day, and merge the results.

Your rua address per workspace

Every workspace gets its own reporting address. You add it to the rua tag of each domain you want analyzed, separated by a comma from any address you already use, for example rua=mailto:[email protected],mailto:your-workspace-address. Your own copies keep arriving as before.

Agencies with client workspaces get one address per client, so reports never mix between clients. Reports start arriving within a day or two, depending on how often each receiver sends.

Subdomains need a moment of thought. A subdomain without its own DMARC record inherits the parent record, including the sp tag if you set one, and its traffic appears in the parent's reports. If you send marketing from news.example.com and invoices from example.com, the analyzer shows them as separate From domains, so you can tighten the policy on one without waiting for the other. A malformed record, a missing rua tag or a policy that ignores subdomains is flagged the moment you add the domain.

What the analyzer shows

• Sources, not IPs. From the Business plan, sender source discovery groups IPs by the service behind them, so you see your ESP, your CRM, your help desk and unknown senders as named rows.
• Alignment per source. Pass rates for SPF alignment and DKIM alignment, so you know which fix each tool needs.
• Volume over time. Daily counts per source, so a new sender stands out the day it appears.
• Policy readiness. The share of your mail that would still be delivered at quarantine or reject.
• Plain findings. For example, "Your billing tool signs DKIM with its own domain, so 1,240 invoices failed DMARC this week. Set up custom DKIM in its settings."

Volume limits and history

Plans count the messages described in incoming reports each month: 50,000 on Starter, 1,000,000 on Business, 5,000,000 on Agency and 25,000,000 on Scale. History is kept for 90 days, one year, two years and three years respectively. The analyzer is part of DMARC monitoring, which also alerts you when your record changes. To check the record itself right now, use the free DMARC checker.

Frequently asked questions