Free tool · DMARC
DMARC Report Analyzer
Turn the XML reports mailbox providers send you into a plain answer: who is sending email as your domain, what passes, what fails, and what to fix before you move to quarantine or reject.
Reports are opened and read in your browser. Nothing is uploaded to us.
Add reports
- :
Results
·
Messages reported
Passed DMARC
·
DKIM aligned
SPF aligned
Ready for a stricter policy?
- Published policy
- Reported by
- What receivers did
Grouped by sending IP address, problems first. “Your domain” means the signature or envelope matches the From address — what DMARC calls alignment.
-
messages ·
From address
DKIM
- ()
- No signature
SPF
- ()
- No result
Reports included
- · · ·
What a DMARC aggregate report is
When your domain publishes a DMARC record with a rua= address, mailbox providers that receive mail claiming to be from your domain send you aggregate reports: XML files summarising every server that sent as you, how many messages, and whether SPF and DKIM passed for your domain. They don’t contain message content — just counts, IP addresses and results.
The current format is defined in RFC 9990 (May 2026), which asks receivers to gzip the file. Its name follows the pattern receiver!your-domain!start!end.xml.gz. Many receivers still send the older RFC 7489 format, and some send .zip files — this analyzer reads all of them.
Not getting reports yet? Add a rua=mailto: address to your record with the DMARC Record Generator, then check it with the DMARC Record Checker.
How to read the results
- Passing — SPF or DKIM passed for a domain that matches your From address. That’s all DMARC needs.
- Not aligned — the mail authenticated, but as someone else’s domain, typically an email service such as SendGrid or Mailchimp signing with its own name. DMARC counts that as a fail. The fix is in that service’s settings: set it up to sign DKIM with your domain, or use a custom return-path so SPF aligns.
- Failing — nothing authenticated for your domain. Either it’s a service you use that was never set up, or someone is sending mail pretending to be you.
- Partly failing — usually forwarding or mailing lists, which can change a message so its signatures no longer verify. Receivers sometimes note this as mailing list or trusted forwarder.
Moving from p=none to quarantine and reject
With p=none, receivers only report — they don’t act on failures. Before tightening it:
- Collect reports for a few weeks, so every service that sends for you shows up — including monthly newsletters and invoicing systems.
- Make every source you recognise show as Passing.
- Move to
p=quarantine, keep reading reports, then top=reject. RFC 9989’s test mode,t=y, lets receivers apply one level less while you check.
A sender that isn’t aligned when you switch will have its mail filtered along with the spoofers — which is why the analyzer lists problems first.
Questions
Are my DMARC reports uploaded anywhere?
No. The files are opened, unpacked and read by JavaScript in your browser. Nothing is sent to Emails.help or anyone else.
Can I analyze several DMARC reports at once?
Yes. Choose or drop as many .xml, .xml.gz or .zip files as you like; the results combine every report and list each reporter.
Why does SendGrid or Mailchimp mail fail DMARC when SPF and DKIM pass?
Because they pass for the service’s own domain, not yours. DMARC needs SPF or DKIM to pass for a domain that matches your From address — set up DKIM with your domain in that service.
What does disposition mean in a DMARC report?
What the receiver did with the mail: none (delivered normally), quarantine (usually spam folder) or reject. With p=none it is almost always none.
Does the analyzer read the new RFC 9990 format?
Yes, and the older RFC 7489 format that many providers still send.
Sources
More free tools