Features How it works Pricing Tools About Contact
Sign in Start now
Free Tool

DMARC Report Analyzer

Upload your DMARC aggregate reports to see who is sending email as your domain, what is passing, and what to fix.

Reports are processed in your browser. Nothing is uploaded to our servers.

DMARC Report Analysis
MailIntelby CloudNow Solutions
Total Emails
messages reported
DMARC Pass Rate
aligned SPF or DKIM
Reporting Sources
organizations that sent reports
Findings

Want this every week, automatically?

MailIntel watches your DMARC reports continuously and alerts you when something needs attention.

Apply for monitoring
Analytics
Email Volume
DMARC Policy Outcome
Policy enforcement breakdown
DMARC Pass
Fail - Policy Applied
Fail - Policy Not Applied
Fail - Policy Overridden
Alignment Outcome
pass rate (SPF and DKIM aligned)
SuccessPartial SuccessComplete Failure
Authentication Outcome
pass rate (raw SPF and DKIM results)
SuccessPartial FailureComplete Failure
Top Reporting Organizations
top organizations
Top Source IPs
unique IPs
Detailed Reports
DMARC Policy Enforcement Outcome
Showentries
Provider names are identified from a built-in list of known sending ranges and may not cover every service.
MailIntel is a product of CloudNow Solutions. Report data was processed locally in the browser and was not uploaded. Generated with MailIntel DMARC Analyzer ().
Guide

Understanding your DMARC aggregate reports

DMARC reports are the only first-hand record of who is sending email using your domain. Here is what they contain, how to start receiving them, and how to read the results above.

What is a DMARC aggregate report?

When your domain publishes a DMARC record, mailbox providers such as Google, Microsoft and Yahoo send you a daily summary of the mail they received that claimed to come from your domain. These aggregate (RUA) reports are XML files, usually compressed as .gz or .zip.

Each report lists the sending IP addresses, how many messages each one sent, whether those messages passed SPF and DKIM, and what the receiver did with them. Reports contain authentication results only, never the content of your emails.

How do I start receiving reports?

Add a rua tag to your DMARC record, a DNS TXT record at _dmarc.yourdomain.com. For example:

v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com

Reports usually start arriving within 24 to 48 hours. If the reporting address is on a different domain than the one being monitored, that domain must also publish a record authorizing it to receive your reports.

How do I read the results?

  • DMARC pass: the message passed SPF or DKIM, and the passing domain matched (aligned with) the domain in the visible From address.
  • Alignment: SPF can pass for a third-party sender's own domain and still fail DMARC. Alignment is what proves the message was sent for your domain.
  • Disposition: what the receiver did with failing mail: delivered it (none), sent it to spam (quarantine), or refused it (reject).
  • Unknown sources: an IP that isn't one of your services may be spoofing, or a legitimate tool that hasn't been set up for SPF and DKIM yet.

Common questions

Is it safe to upload my reports here?
Yes. The analyzer runs entirely in your browser, and your files are never uploaded to our servers.
Which file formats are supported?
Raw .xml reports and compressed .xml.gz and .zip files, as sent by mailbox providers. You can analyze several at once.
How many reports should I analyze?
One to two weeks of reports gives a reliable picture of all the services sending as your domain.
When can I move to p=quarantine or p=reject?
Once all your legitimate senders consistently pass with aligned SPF or DKIM. The analyzer's findings tell you when your results look ready.
Learn how DMARC works → Monitor your reports automatically →