Skip to content
TextArray1.41.0
100% local

DMARC report analyzer

Turn a DMARC aggregate report XML into a readable table of senders, results and policy.

Input
Output
Related tools
SPF and DMARC checkernewDeveloper tools
SPF and DMARC record generatornewDeveloper tools
Email header analyzernewDeveloper tools
i18n key diffDeveloper tools
TOML to JSON converterDeveloper tools
SQL to JSONDeveloper tools
DMARC report analyzer
Mailbox providers that support DMARC send back an aggregate report (RUA) once a day: an XML file listing every server that sent mail claiming to be from your domain, how many messages it sent, and whether SPF and DKIM lined up. The raw XML isn't meant to be read by a person — this tool turns it into a table you actually can. Paste the report and it lists each sending IP with its message count, SPF result, DKIM result and the policy applied (none, quarantine or reject).
Sort by message volume or by IP address to spot the biggest senders first. "Show only failures" cuts straight to the rows worth investigating. The pass-rate summary reports what share of your mail volume passed, so you can track a new sending source before tightening your policy toward reject. "Flag likely forwarded mail" marks messages where DKIM passed but SPF didn't — the classic signature of a forwarder or mailing list rewriting the envelope sender, not an actual spoofing attempt. "Group by sending domain" helps once you publish DMARC for several domains through one report stream.
The parser accepts the XML exactly as generated, Windows or Unix line endings included, and handles reports with thousands of records without slowing the page down. Choose table output for reading on screen, or CSV to drop into a spreadsheet for a longer investigation. The live tally above the output always shows sending IPs, messages and pass rate at a glance.
Everything runs locally in your browser — the report is never uploaded anywhere, which matters since it lists every server sending mail as your domain. Copy the result, download it as a .txt file, or send it to another tool's input to keep working.
FAQ
Where do I get a DMARC aggregate report?
Mailbox providers email it as a compressed XML attachment (usually .xml.gz or .zip) to the address in the "rua=" tag of your DMARC DNS record. Decompress it first, then paste the plain XML here.
What does the "Policy applied" column actually show?
It's the per-message disposition the receiving server applied: none, quarantine or reject. It reflects the policy your DMARC record requested at the time that message arrived, which can differ from your record's current setting.
Why does a forwarded message show as a DMARC failure?
Forwarding rewrites the envelope sender, which breaks SPF alignment even though the message is legitimate. If DKIM still passes, the "Flag likely forwarded mail" option marks that row instead of leaving it looking like spoofing.
Can I analyze more than one report at once?
Paste one report's XML per run. To compare several days, run each report through separately — the CSV export makes it easy to combine them afterward in a spreadsheet.
Is the report XML uploaded anywhere?
No. Parsing happens entirely in your browser — the file, which lists every server sending mail as your domain, never leaves your device.