Free DMARC Report Analyzer (+ Guide)

What is a DMARC report analyzer?

A DMARC report analyzer turns DMARC aggregate reports, the XML files Gmail, Yahoo, Outlook and others send about once a day, into a readable list of who sent email as your domain and whether it passed.

What's in a DMARC report

Each report covers about a day, from 1 provider. Each row is a sending IP, how many emails it sent as you, what the receiver did with them, and the SPF and DKIM results behind it.

Why email fails DMARC

SPF passed, but for another domain. A service sent with its own bounce address. Turn on its custom domain setting, often called custom return path or custom MAIL FROM.

Signed by another domain. DKIM passed for the service's domain, not yours. Set up DKIM on your domain in that service.

No DKIM at all. The service doesn't sign, or you haven't set it up.

Forwarded. A forward changes the path, which breaks SPF. DKIM usually survives it.

Email from IPs you don't recognize, with no service behind them, may be someone else sending as you: exactly what DMARC stops once your policy is quarantine or reject.

Your reports stay on your device

Reports list your servers and how much you send. The analyzer reads them in your browser: nothing is uploaded or kept.

Final thoughts on DMARC reports

Reports are the reason to publish DMARC before you enforce it. Read a week of them, fix what's yours, and move your policy up.

Change the policy with the DMARC record generator, and check the record with the DMARC checker.