DMARC Report Parser
Parse DMARC aggregate report XML files and get a clear breakdown of SPF, DKIM and DMARC pass/fail results by source IP.
About DMARC Report Parsing
DMARC aggregate reports are XML files sent daily by major email providers (Gmail, Yahoo, Microsoft, Apple, etc.) to the address specified in your domain's rua DMARC tag. Each report covers all messages received during a 24-hour period that claimed to be from your domain, showing whether they passed SPF and DKIM checks. This tool parses those XML files into a readable format.
What DMARC reports contain
- Source IP — The IP address of the server that sent the message
- Message count — How many messages were received from that IP
- SPF result — Whether SPF passed for those messages
- DKIM result — Whether DKIM passed for those messages
- Disposition — What the receiving server did with the message (none, quarantine, reject) based on your DMARC policy
Reading the reports
During initial DMARC deployment (p=none), reports help you identify all legitimate sources of email from your domain — your primary mail server, marketing platforms, CRMs, ticketing systems, etc. Any source that appears with SPF or DKIM failing needs to be configured correctly before you move to enforcement (quarantine or reject).
How to receive DMARC reports
Set the rua tag in your DMARC record to a monitored email address: rua=mailto:dmarc-reports@yourdomain.com. Reports arrive as email attachments, either plain XML or zipped XML. Download and unzip them, then paste the XML into this parser. Use the DMARC Generator to create or update your DMARC record.