Trust beats tactics™

DMARC

DMARC Aggregate Report Parser

Mailbox providers send a daily XML report to the address in your rua= tag, almost always as a gzipped or zipped file. Drop that file here (or paste the XML) and we turn it into a plain-English summary: who is sending as your domain, and what share of your mail actually passes DMARC.

Just need to read the DMARC record itself? Use the DMARC Record Parser.

Upload the report a mailbox provider sent you

Reports are almost always gzipped (.xml.gz) or zipped.

We decompress and parse the report on our server. XML is read with a safe parser (no DTDs, no external entities). Nothing you upload is stored beyond the time it takes to render this summary.

How this tool works

What the parser is actually doing

An aggregate report is one XML document, wrapped in a <feedback> element, listing every source IP that sent mail claiming to be your domain during the window, with a message count and the SPF, DKIM, and DMARC verdicts for each. The parser decompresses the file, reads that structure, and rolls it up into a pass rate plus a per-source table so you can see at a glance which senders are legitimate and which are failing.

Everything runs on our server. The XML is read with a deliberately small parser that ignores document type definitions and never expands external or custom entities, so a malformed or hostile report cannot do anything but fail cleanly. We do not keep the report after the summary is rendered.

When to use it

Reach for it in these moments

You published a DMARC record at p=none and the reports have started arriving, but they are unreadable XML. This tool tells you what they say. Before you move to quarantine or reject, you need to know every legitimate service that sends as you is already passing. The failing-sources list is where you check.

It is also how you catch spoofing early. If an IP you do not recognise is sending as your domain and failing DMARC, the report shows it. Run each daily report through the parser while you are tightening a policy, and keep the ones with failures until you have explained every source.

Email Almanac

Related questions to read next

The parser surfaces what a single report says. The Almanac explains how DMARC reporting works so the next policy change you make is the right one.

Want a full deliverability audit?

DMARC reports are one signal. We read every signal that affects whether your mail lands in the inbox and write you a plain-English report.

Try it deeper with RME