Load your reports
How it works
Decompress locally
Gzip and zip archives are unpacked in the browser using native decompression. No server sees the file.
Merge every report
Load a week of reports from several receivers at once and they are combined into one picture.
Group by source
Each sending IP and From domain pair is totalled, with SPF, DKIM and DMARC results per source.
Separate the failures
Sources that failed outright are distinguished from those that authenticated against a domain that does not align.
Why nobody reads these
DMARC aggregate reports were designed for machines. Every receiver that handles your mail sends one per day, gzipped or zipped, containing XML that describes each sending source it saw claiming to be you. The format is fine. The delivery method — an email attachment, daily, from a dozen different senders — means almost everyone publishes a rua address, receives thousands of reports, and never opens one.
That is a shame, because these reports are the only place you can see who is sending as your domain from the receiver's point of view. Not what you configured. What arrived.
The three things they tell you
Every source sending as you. Legitimate ones you forgot about — the invoicing tool, the CRM, the helpdesk, the marketing platform someone connected last quarter. And illegitimate ones, which is the entire reason DMARC exists.
Whether each one authenticates. A source at 100% is signed and authorised correctly. A source at 0% is either spoofing you or is a real service that was never set up properly, and until you look you cannot tell which.
Whether authentication actually aligns. This is the subtle one. A service can pass SPF perfectly — for its own domain, not yours. DMARC requires the domain that passed to match the domain in your From header. Passing SPF and passing DMARC are different questions, and the gap between them is the most common reason people insist their setup is correct while their mail keeps failing.
What to do with the output
Work down the source table by volume. For each source at less than 100%, decide whether it is yours. If it is, fix its authentication — usually by adding it to SPF or enabling DKIM signing in that service. If it is not, you have found spoofing, and the answer is to move your policy to enforcement so it stops being delivered.
Only once every legitimate source is at 100% should you move from p=none to quarantine and then reject. Enforcing before that point blocks your own mail, which is how most people end up rolling DMARC back and deciding it does not work.
Privacy
These reports name your sending infrastructure and your correspondents' mail servers. This tool decompresses and parses them entirely in your browser using native APIs — no upload, no server, no logging. You can disconnect from the network after loading the page and it will still work.
Frequently asked questions
Where do I get these report files?
From the mailbox in your DMARC record's rua tag. Search it for attachments ending in .zip or .gz. Google sends one report per day per domain, Microsoft and Yahoo similar. Download a week's worth and load them all at once.
Which file formats work?
Raw .xml, gzip .xml.gz, and .zip archives containing XML. Google sends gzip, Microsoft sends zip. You can mix formats and drop several files in together.
Is my data uploaded anywhere?
No. Decompression uses the browser's native DecompressionStream and parsing uses its built-in XML parser. There is no network request involved in reading your reports at all.
What does a source with 0% pass rate mean?
Either an unauthorised sender spoofing your domain, or a legitimate service you use that was never added to SPF and does not DKIM sign. Check the IP against the blacklist checker and look up who owns it before assuming malice — misconfigured legitimate services are far more common.
SPF passes but DMARC fails. Why?
Alignment. DMARC only counts an SPF pass if the domain that passed matches your From domain. A relay that passes SPF for its own domain gives you an SPF pass and a DMARC failure at the same time. This tool flags those sources separately for exactly that reason.
Do aggregate reports contain message content?
No. They contain counts, source IPs, authentication results and disposition only — never subjects, recipients or bodies. Forensic reports (ruf) are a separate thing and are barely supported by receivers.
Last reviewed
What to run next
The checks that most often follow this one.
More in this category
Guides that go deeper
When the tools tell you something is wrong
The diagnostics here are free and always will be. When the fix is bigger than a DNS record, this is the work I do.
Deliverability rescue
Mail landing in spam, replies gone quiet, or a domain suddenly blocked. I find the actual cause rather than guessing, and fix it.
- Authentication and alignment failures
- Blocklist delistings and reputation repair
- Gateway and filter-level blocks
- A written report on what broke and why
Email & sending infrastructure
Sending domains, inboxes, authentication and warmup, built to survive volume instead of burning down in a month.
- Domain and inbox fleets at any scale
- SPF, DKIM, DMARC and tracking domains
- Google Workspace and Microsoft 365 inboxes
- Handover documentation you actually own
Domain, DNS & migration
Changing registrar, mail provider or host without a day of downtime or a week of mail silently failing.
- Registrar and nameserver moves
- Workspace and Microsoft 365 migrations
- MX, SSL and subdomain cutover
- Staged rollout with rollback at every step
Monitoring & retainer
Infrastructure drifts. Records get edited, certificates expire, domains get listed. Ongoing eyes on the fleet.
- Scheduled checks across every domain
- Alerts before your clients notice
- Monthly reporting
- Priority response when something breaks
Start with a call
Bring a domain and the symptom. I will tell you what is actually wrong and whether you need me at all — plenty of people leave that call able to fix it themselves.
Thirty minutes, no pitch
We will run the checks together on your actual domains, and you will leave knowing what is broken, what it takes to fix, and what it should cost. If that is a job you can do in-house, I will say so.