DMARC report analyzer: how do you read a DMARC aggregate (RUA) report?
How does this check work, and what does the result tell you?
AdminKit's DMARC report analyzer reads the aggregate XML report a mailbox provider sent to your rua= address, entirely in your browser: who reported and when, then per source IP the message volume, SPF and DKIM alignment, and the policy the receiver applied. It reads the file you give it; it never uploads it or contacts any server.
Part of the Email authentication cluster — more tools, guides and terms on email authentication.
The report is read in your browser — nothing you paste or choose is uploaded to AdminKit or anywhere else, and this tool never contacts any server or queries DNS.
What the result means
This reads the aggregate report a mailbox provider already compiled about mail it received claiming to be from
your domain — it is a transcript of what that receiver saw, not a live re-check, and one report covers one
receiver for one time window. "SPF aligned" and "DKIM aligned" are the receiver's DMARC-evaluated results; a
disposition of "none" under p=none only means nothing was done to the message. To check the DMARC
record itself against live DNS, use AdminKit's
DMARC check.
Next step
If a source IP you recognise is failing alignment, fix its SPF or DKIM setup (see the SPF generator and DKIM generator); once everything legitimate passes, tighten the policy with the DMARC generator and read how to roll out to p=reject safely.
Keep this result
Copy a link to this check so you can share it or run it again later. Want a heads-up if something changes? That's early access, not a live feature yet — tell us and we'll set it up by hand.
How it works and limits
Once your DMARC record has a rua= address, receivers such as mailbox providers email you an XML file roughly once a
day, per receiver. Paste that XML here, or choose the .xml or .xml.gz file, and the tool reads it in your browser —
nothing is uploaded to AdminKit or anywhere else, and it never contacts a server or queries DNS. It only reads what the
reporter wrote; to check the record itself against live DNS, use AdminKit’s DMARC check.
What is inside a DMARC aggregate report?
The format is defined in RFC 7489 Appendix C, and the values a report may carry are listed in the IANA DMARC parameters registry. A report has three parts, and this tool surfaces each:
- report_metadata — the reporting organisation, a contact address, a report ID, and the time window (as Unix timestamps) the report covers. The tool shows the window in UTC.
- policy_published — the DMARC policy (
p,sp,pct, alignment modes) the reporter found in your DNS when it processed the mail. - record rows — one per distinct combination of source IP, evaluated result and identifiers, each with a message
count. The tool groups these by source IP so you can see at a glance which servers send as your domain and how much.
What do “SPF aligned”, “DKIM aligned” and “disposition” mean?
In each row, policy_evaluated holds the DMARC verdict: SPF and DKIM are each pass or fail after checking that
the authenticated domain aligns with the visible From domain. DMARC passes when at least one of them passes. The
disposition is the action the receiver took — none, quarantine or reject. The tool also lists the raw
auth_results (the SPF and DKIM outcomes for the domains actually authenticated) and any receiver override reason, so
you can see why an apparently good SPF result still failed alignment. Read
DMARC alignment: relaxed vs strict for the rules behind
alignment.
What should you do with the result?
Look for source IPs you do not recognise, and for IPs you do recognise that fail alignment. A legitimate sender that fails needs its SPF or DKIM fixed before you tighten policy; an unknown source sending a lot of mail as your domain is what a stricter policy is for. The guide on reading DMARC aggregate reports and rolling out to p=reject safely covers the process, and AdminKit’s DMARC generator builds the next record in the rollout.
Limits
- This is a reader, not a verifier: it never queries DNS, never contacts a server, and never re-runs SPF, DKIM or DMARC.
- One report is one receiver’s view of one time window; it is not a complete picture of all mail sent as your domain.
- The tool does not identify who owns a source IP; it shows the address exactly as the reporter wrote it.
- Only the standard RFC 7489 elements are read; extra vendor elements are ignored, and unusual or truncated files may parse only partially — the tool says so rather than guessing.
- Very large files are refused to keep your browser responsive, and
.ziparchives must be extracted first.
To see how a single message was authenticated, paste its headers into the email header analyzer, and for how SPF, DKIM and DMARC fit together see SPF, DKIM and DMARC explained.
Frequently asked questions
Is the DMARC report I paste or upload sent anywhere?
No. The XML is parsed by JavaScript running in your browser tab; the page makes no request with your report and the tool never contacts a mail server or DNS. Aggregate reports contain your sending IP addresses and message counts, so keeping the analysis local is deliberate — closing the tab discards it.
What is the difference between SPF/DKIM "aligned" results and the raw auth results in a DMARC report?
Each record has two views. The policy_evaluated block holds the DMARC verdict for that row: SPF and DKIM each marked pass or fail after identifier alignment against the visible From domain, which is what DMARC actually decides on. The auth_results block holds the raw SPF and DKIM outcomes for whatever domains were authenticated, aligned or not. A message can have spf=pass in auth_results yet fail DMARC if that SPF domain does not align with the From domain. DMARC passes when at least one of SPF or DKIM passes with alignment (RFC 7489 §3.1).
Why does a report say disposition "none" for messages that failed DMARC?
Disposition is the action the receiver took, not whether the message passed. With a published policy of p=none you are asking receivers only to report, so even failing mail is delivered normally and shows disposition none. Quarantine and reject appear once you publish those policies — and receivers may also override your policy, which a report records as a reason such as forwarded or mailing_list.
My report arrived as a .zip or .gz file — can I open it here?
Mailbox providers usually compress aggregate reports. This tool reads a plain .xml file or a gzip-compressed .xml.gz directly in browsers that support it, and you can always paste the XML text instead. For a .zip, extract the XML file with your operating system first, then paste or choose that file.
Does this tool check whether my DMARC record is correct today?
No. A report is a record of what one receiver saw during one window, and this tool only reads that file. It does not query DNS or re-test anything. To check the DMARC record currently published for your domain, use AdminKit's DMARC check, which does look it up live.