DMARC report analyzer
Drop the reports Google, Microsoft and Yahoo email to your rua address. In a few seconds you'll see who sends as your domain and which of them fail, with no sign-up and no upload.
The .zip, .gz or .xml files receivers email to your rua address. They are opened in this tab and never uploaded.
The short version
- You get the DMARC pass rate for the reporting period, the policy you published, and one row per sending IP.
- Open several reports at once and the sources are merged, so a week of reports reads as one table.
- Move from p=none to quarantine once every sender you recognize passes. Any IP still failing is a sender to authorize or a spoofer to block.
- The files are parsed in your browser. Nothing is sent to ZapBounce or anyone else.
What the analyzer reads from each report
An aggregate report follows RFC 7489. It opens with the receiver's name and the time window, then repeats the policy you published at _dmarc on your domain. After that come the records, one per sending IP and result, each with a message count.
For every record the analyzer takes the receiver's own verdict from policy_evaluated. A message passes DMARC when DKIM passed with alignment or SPF passed with alignment, and that's the rule the pass rate uses. It also keeps the raw DKIM and SPF domains, because a failing row usually says which one broke.
Your pass rate is passing messages divided by all messages in the reports you opened. The source table groups the rows by IP, so one server reported by three receivers shows up once with its total.
| Field in the XML | Shown as | Why it matters |
|---|---|---|
| org_name, date_range | Reporter and period | Tells you whose view of your mail this is |
| policy_published | Published policy | Confirms the p=, sp= and pct= receivers actually saw |
| source_ip, count | Source IP, messages | Every server that sent as your domain |
| policy_evaluated dkim, spf | DKIM failed, SPF failed | Which check failed alignment for that source |
| header_from | From | The domain in the From line, useful when you run subdomains |
Field names from RFC 7489, Appendix C.
From the report to a stricter policy
Sort by messages and work down the list. Your main mail platform should sit at or near 100%. A marketing tool or helpdesk at 0% usually needs its DKIM key published or its include added to SPF. Our DKIM checker and SPF checker confirm the fix before the next report lands.
An IP you don't recognize, sending a handful of messages and failing both checks, is often spoofing. That's the traffic a stronger policy stops. Once your known senders pass, move from p=none to quarantine, watch a few weeks of reports, then go to reject. The DMARC generator writes the record for each step.
Authentication decides whether receivers trust the sender. The list decides whether the mail has anyone to reach. A domain at 100% DMARC still hurts its reputation mailing dead addresses, which is where bulk list verification comes in.
Questions people ask
How do I read a DMARC aggregate report?
Each record in the XML is one sending IP with a message count and two results, DKIM and SPF, as the receiver judged them against your domain. A record passes DMARC when either one passed and aligned. Group the records by IP and the sources that fail stand out.
Why are DMARC reports sent as zip files?
Receivers compress the XML to keep the email small, usually as .zip or .gz. This analyzer opens both in your browser, so you can drop the attachment exactly as it arrived.
What does a failing IP in my DMARC report mean?
It means mail used your domain in the From line and neither DKIM nor SPF passed with alignment. It's either a real service you haven't authorized yet, such as a new CRM or helpdesk, or someone spoofing your domain. Look the IP up before you tighten your policy.
Is it safe to upload DMARC reports to an online tool?
With this one nothing is uploaded. The files are opened and parsed in your tab with the browser's own decompression, so the report never leaves your machine.
Authenticated mail still needs live addresses
ZapBounce checks every address on your list over SMTP and closes before DATA, so nothing is sent. Unknowns are never billed.