DMARC report reader and analyzer
Open DMARC aggregate and failure reports and see who sends mail as your domain, what passes, and what fails. Files are read in your browser and never uploaded.
By using these tools you accept the Terms and the Privacy page.
How the DMARC report reader works
The DMARC report reader turns the XML that mailbox providers send to your rua address into tables you can sort, filter and export, and lays out failure reports field by field. It is for domain owners on the way to p=quarantine or p=reject who need to know which servers send mail as their domain before they enforce.
What the summary shows
- Totals across every report you open: messages, the share that passed DMARC, the aligned SPF and DKIM rates, failed messages and the number of source IPs.
- Findings in plain words, most serious first. A failure rate above 10% is marked as a failure and anything lower as a warning, and errors that reporters include in their reports are listed too.
- The published policy each reporter saw, with a note when reporters saw different versions.
- Top failing sources, a breakdown by reporter, and a records table you can filter to failing, passing or passed-but-not-aligned rows, or search by IP, domain or hostname.
- A CSV of the record rows, with hostnames once you have looked them up.
How files are opened
The reader decides what a file is from its content, not its name: a ZIP or gzip signature, XML that starts with <, or an email with headers. Only stored and deflate ZIP entries are supported; password-protected entries and ZIP64 archives are reported rather than guessed at. A file that can’t be read is listed with the reason, and the rest still load.
Dates are shown in UTC. Some reporters send timestamps in milliseconds, which the reader detects and converts. A record with an invalid message count is counted as 0 and flagged.
Limits that keep your browser responsive
- Up to 500 files and archive entries, and 256 MB, in one go. Files are read one at a time, and archive entries are unpacked only when their turn comes.
- Each compressed file or archive entry can expand to 64 MB, archives inside archives are opened up to four levels deep, and entries that overlap inside a ZIP (a zip bomb trick) are skipped.
- Entities declared in a DOCTYPE are never expanded, so a hostile XML file can’t inflate itself. Parsing time grows in step with file size, and an XML file may nest 64 levels and hold 1,000,000 elements at once.
- Up to 1,000,000 records are held in one go; the records table keeps the first 200,000, and the totals count every record read.
- Tables show the first 500 rows; the CSV has the rest.
- Look up hostnames resolves up to 200 source IPs, and up to 50 failure reports are shown.
Reading the numbers
A message counts as passing when the receiver’s own verdict shows aligned SPF or aligned DKIM passing, so the totals follow what receivers decided rather than a fresh check. If the record used pct below 100 or t=y, a note explains that receivers applied a weaker policy to some or all of the mail. No reports yet? The sample buttons load a made-up aggregate or failure report so you can see the layout first.
Fix what the reports show with the SPF checker and the DKIM checker, then confirm the record with the DMARC checker.
Updated · Maintained by Liviu Tanase
Questions
What’s the difference between aggregate (rua) and failure (ruf) reports?
Aggregate reports are daily XML summaries from mailbox providers: which IP addresses sent mail with your domain in the From header, how many messages, and whether SPF and DKIM passed and aligned. They arrive as .zip or .gz attachments at the rua address in your DMARC record. Failure reports describe single messages that failed, in the ARF format (RFC 5965 and RFC 6591), and go to the ruf address. Few providers send them.
Is my report data uploaded anywhere?
No. Unzipping, decompressing, parsing and the tables all run in your browser. Nothing is sent to zerobounce.ai. The only optional network requests are reverse DNS lookups of source IP addresses, sent to Cloudflare’s public DNS resolver when you choose Look up hostnames, and only the IP addresses are sent.
Which files can I open?
Aggregate report XML, the .zip or .gz attachment it came in (including ZIPs with several reports), the whole report email saved as .eml (its attachments are found and opened), and failure report emails. Drop many files at once to merge them; duplicate reports with the same reporter and report ID are counted once.
How do I open a DMARC report ZIP or GZ file?
Drop the attachment as it arrived, or the whole report email (.eml). The reader tells ZIP, gzip, XML and email apart by their content, unpacks them in your browser and opens archives inside archives up to four levels deep. Password-protected entries and ZIP64 archives are listed with the reason. No reports arriving? Check the rua address with the DMARC checker.
How large a report can it read?
Up to 500 files and 256 MB in one go. Each file or archive entry can expand to 64 MB, and up to 1,000,000 records are held at once; files and records over a limit are listed with a note. A 64 MB report takes a few seconds, and the page shows which file it is reading and, after three seconds, for how long.
What does aligned mean?
DMARC passes when SPF or DKIM passes for a domain that matches the From header domain. SPF can pass for a sending service’s own bounce domain and still not count, because it isn’t aligned. The reader shows these cases separately with the domains involved, so you can set a custom return-path or DKIM signing domain at that service.
Why was failing mail delivered even though my policy is reject?
Receivers may override the policy and say why in the report: forwarded, mailing_list, trusted_forwarder, local_policy, sampled_out (when pct is below 100) or policy_override. The reader lists these reasons and the disposition each receiver applied.
Some IP addresses fail DMARC. Is that a problem?
It depends on who they are. Look up hostnames to see the sending service. Unknown hosts sending small volumes that fail both SPF and DKIM are usually spoofing, which your policy is meant to stop. A known service of yours that fails needs SPF or DKIM set up for your domain before you move to quarantine or reject.