Email Security Tool

DMARC Report (RUA) Analyzer

Aggregate Report Summary

Summarize DMARC aggregate (RUA) reports

Open the .xml file from a rua= report email in a text editor, copy its full contents, and paste them here.
DMARC aggregate XML report

Drag & drop your report.xml here

or click to browse — accepts the .xml file attached to your rua= report emails

Aggregate (RUA) reports are the XML attachments your mailbox provider sends to the address in your DMARC rua= tag — usually daily or weekly, sometimes zipped/gzipped. Unzip first, then drop the .xml file here.

Tool features

Read your DMARC aggregate reports without the XML noise
4 features

Alignment Summary

See what share of your mail volume passes full DMARC alignment

Spoofing Signals

Flags sources failing both SPF and DKIM while sending as your domain

Per-Source Breakdown

Volume, SPF, DKIM and disposition for every sending IP

Export Ready

Download the summary as PDF, CSV, or JSON

What is a DMARC aggregate report & how it works

What mailbox providers tell you about mail sent as your domain

When your DMARC record includes a rua= address, mailbox providers such as Google, Microsoft and Yahoo send you a daily aggregate report: an XML file listing every IP that sent mail using your domain, how many messages it sent, and whether each passed SPF, DKIM and DMARC alignment.

Those reports are how you find legitimate services you forgot to authenticate before tightening your policy, and how you spot spoofing. This tool parses one report and groups the rows into aligned senders, sources that need attention and unverified sources, so you can see what to fix without reading raw XML.

rua
The DMARC tag holding the address that receives aggregate reports.
Alignment
The SPF or DKIM domain matches the visible From domain, as DMARC requires.
Disposition
What the receiver did with the mail: none, quarantine or reject.

How to use this tool

Analyse a DMARC report in four steps
1
Get a report
Open an aggregate report from your rua mailbox; they arrive as .zip or .gz attachments.
2
Unzip it
Extract the .xml file inside the archive; the analyzer reads the uncompressed XML.
3
Upload or paste
Drop the XML file in or paste its contents, then run the analysis.
4
Fix the gaps
Authenticate legitimate sources that fail alignment, and investigate unknown IPs before moving to quarantine or reject.

Related tools

Keep debugging with tools from the same suite
5 tools
DMARC Lookup
Check DMARC policy records for email authentication, reporting, and policy enforcement
DMARC Generator
Generate DMARC policy records for email authentication with policy configuration options
SPF Lookup
Check Sender Policy Framework (SPF) records for email authentication and mail server authorization
DKIM Lookup
Find DomainKeys Identified Mail (DKIM) records for email message signing and verification
Email Health Checker
Comprehensive email deliverability check including SPF, DKIM, DMARC, and MX records

Frequently asked questions

Common questions about DMARC aggregate reports
5 Q&A

A daily XML summary sent by a mailbox provider to the rua address in your DMARC record. It lists each sending IP, message count, SPF and DKIM results, alignment, and the disposition the provider applied.

The analyzer reads the XML itself. Unzip the attachment first (double-click it on most systems, or run gunzip report.xml.gz) and upload the .xml file inside.

Add a rua tag to your DMARC record, e.g. v=DMARC1; p=none; rua=mailto:dmarc@example.com. Reports start arriving within a day or two from providers that send them.

Often, but check first: it may be a legitimate service (newsletter platform, CRM, ticketing system) that you have not yet added to SPF or set up DKIM for. If you do not recognise the IP or its owner, treat it as spoofing.

When your reports show all legitimate mail passing aligned SPF or DKIM over a few weeks. Step through p=quarantine first, optionally with a lower pct, and keep reading reports as you tighten.