Free tool
DMARC report analyser
Open the DMARC reports Google, Microsoft and others send you, and see in plain English who is sending email as your domain — and what is failing.
Runs entirely in your browser. Your reports are never uploaded.
What DMARC reports tell you
Once your domain publishes a DMARC record with a reporting address, the big mailbox providers send a daily summary of every message they received claiming to come from you: which server sent it, how many messages, and whether it passed SPF, DKIM and DMARC. It is the only way to see every service sending as your domain — including the ones nobody remembered, and the ones that are not yours at all.
Most DMARC report analyzers are paid services that ask you to send your reports to them. This one simply reads the files you already have, and groups them into one table:
- Sending service — taken from the domains that signed or authorised the mail, which usually names the service (your own domain, a newsletter platform, a CRM).
- DMARC — pass if SPF or DKIM passed and was aligned with your From domain.
- What happened — whether the receiver delivered, quarantined or rejected the mail under your policy.
Turning failures into fixes
- Recognise your services. For each failing source, ask whether it is something you use. The sending service column is the best clue.
- Fix the genuine ones. Usually that means publishing the DKIM record the service gives you, or adding it to SPF. Check the result with the DKIM checker and SPF checker.
- Leave the rest to DMARC. Sources you do not recognise are what an enforced policy is for. Once your genuine mail passes, move to quarantine, then reject.
Not receiving reports yet? Check your record with the DMARC checker, and add a reporting address with the DMARC record generator. Our guide to SPF, DKIM and DMARC explains how the three fit together.
Questions
About DMARC reports
Where do DMARC reports come from?
Your DMARC record’s rua= tag tells receiving providers such as Google, Microsoft and Yahoo where to send daily aggregate reports. Each one summarises the mail they received claiming to be from your domain, and whether it passed. Our DMARC record generator can add a reporting address for you.
Why are the reports zipped?
Providers compress them to save space, usually as .zip or .gz files. The analyser opens both, as well as plain .xml, so there is no need to extract them first.
Is it safe to use? Do you see my reports?
Nothing is uploaded. The files are opened and read by your own browser, and the results are shown only to you. Reports list the IP addresses that sent mail as your domain and how many messages each sent; they do not contain message content.
What does “not aligned” mean?
DMARC needs SPF or DKIM to pass for the same domain as the From address. A service can pass SPF for its own domain and still be “not aligned” for yours. One aligned pass is enough for DMARC to pass.
A source is failing. Is it an attack?
Not necessarily. The commonest failures are genuine services you use — an invoicing system, a CRM, a website form — that were never set up to send as your domain. If the sending service is one you recognise, set up DKIM with it. If it is not, and the volume is small, it is probably someone trying to spoof you, which an enforced DMARC policy will block.
When can I move from p=none to quarantine or reject?
When a few weeks of reports show every service you use passing DMARC. Move to quarantine first, keep reading the reports, then move to reject. Our DMARC checker shows the policy you currently publish.
Related tools
Rather someone else read the reports?
SPF, DKIM and DMARC are set up and monitored for every MyExchangeServer customer. Or send us a summary of your reports for a second opinion from an engineer.
- Free assisted migration
- No set-up fee, no minimum term
- UK data centres, UK engineers