Free DMARC XML Report Analyzer

What is a DMARC XML Report?

DMARC (Domain-based Message Authentication, Reporting, and Conformance) is an email authentication policy that builds on SPF and DKIM. When enabled, mail receivers send aggregate reports (RUA) as XML files — either directly to your inbox or to a reporting service. These reports list every IP address that sent email claiming to be from your domain, how many messages were sent, and whether they passed SPF and DKIM checks.

How to Use This Tool

1. Download the DMARC report attached to an email (usually a .zip or .gz file containing an .xml file).
2. Drag and drop the file above, or click Select File.
3. The tool parses the XML entirely in your browser and shows you a clear breakdown of the results.

You can also upload the inner .xml file directly if you have already extracted it.

Understanding the Results

• DMARC Pass — the message passed SPF or DKIM alignment with your domain policy.
• DMARC Fail — neither SPF nor DKIM was aligned; the disposition field shows what the receiving server did (none / quarantine / reject).
• Source IP — the IP address that delivered the message. Unknown IPs sending on your behalf may indicate spoofing or a misconfigured sending service.
• Disposition — the action taken by the receiver: none (delivered), quarantine (spam), or reject (blocked).

Security and Privacy

All processing happens entirely in your browser — no files or data are sent to our servers. Read our privacy policy for more details.

Frequently Asked Questions

Where do I get a DMARC XML report?

If your domain has a DMARC record with an rua= reporting address, mail receivers like Google and Microsoft email a .zip or .gz attachment containing the aggregate XML report — usually once a day. If you don't have a DMARC record yet, set one up first with our DNS checker .

How do I open a DMARC report without Excel or an XML viewer?

Drop the .xml, .zip, or .gz file into this tool — it parses the report entirely in your browser and shows a readable breakdown of every sending source and its authentication results, no software installation needed.

What does "DMARC fail" mean in a report?

A DMARC fail means neither SPF nor DKIM was aligned with your domain for that message. The report's disposition field shows what the receiving server did about it: none (delivered anyway), quarantine (sent to spam), or reject (blocked).

Can I open a .gz or .zip DMARC report directly?

Yes. This tool accepts .zip and .gz files exactly as they arrive by email, and extracts the inner XML report automatically — you don't need to unzip anything yourself first.

Why does a legitimate email service show up as failing DMARC?

This usually means the service (a marketing platform, CRM, or ticketing tool) is sending on your behalf without being included in your SPF record or set up with its own DKIM signature. Add it to your SPF record or enable DKIM signing in that service's settings to fix the failure.