Free DMARC Report Analyzer | Parse & Analyze XML Reports

Understanding DMARC Reports

What are DMARC Reports?

DMARC reports are XML files sent by email receivers (Google, Microsoft, Yahoo, Zoho, etc.) to domain owners, showing how your domain is being used to send emails and whether those emails pass authentication checks.

Key Point: When google.com sends you a report, it means Gmail users received emails claiming to be FROM your domain. The report shows authentication results for those emails.

Who Sends Reports & What It Means

google.com - Gmail users received emails from your domain
zoho.com - Zoho Mail users received emails from your domain
outlook.com - Microsoft users received emails from your domain
yahoo.com - Yahoo Mail users received emails from your domain

What This Tool Reveals

Who is sending emails using your domain (IP addresses and servers)
Authentication success rates - SPF and DKIM configuration status
Unauthorized senders - Potential spoofing or phishing attempts
Email handling - How receiving servers process your emails

How to Get DMARC Reports

Add a DMARC record to your DNS with an RUA tag. Email providers will then send daily XML reports to your specified email address.

v=DMARC1; p=quarantine; rua=mailto:dmarc-reports@yourdomain.com

Download the XML attachments from your email and upload them here for analysis.

Verifying Source IPs from Email Service Providers

When you use email service providers (ESPs) like AWS SES, SendGrid, Mailgun, or Postmark, your DMARC reports will show their IP addresses as the source, not your server's IP. This is normal and expected. Here's how to verify if these IPs are legitimate:

Common Email Service Providers

AWS SES - Check AWS SES IP ranges in your region
SendGrid - Verify IPs in your SendGrid IP Access Management
Mailgun - Check your Mailgun domain settings for assigned IPs
Postmark - View IPs in Postmark server settings
SparkPost - Check SparkPost IP pools

How to Verify Source IPs

Check your ESP dashboard - Most providers list the IP addresses they use to send your emails
Review your SPF record - Ensure it includes your ESP's IP ranges or include mechanism (e.g., include:_spf.google.com)
Perform reverse DNS lookup - Use tools like dig or nslookup to verify IP ownership
Contact your ESP support - If uncertain, ask your provider to confirm their sending IPs

Important: Unknown or unexpected IPs could indicate unauthorized email sending, spoofing attempts, or misconfigured email systems. Investigate immediately if you see IPs you don't recognize.

Upload DMARC Reports

Drop DMARC XML files here or click to browse

Supports multiple file uploads (XML format only)