---
title: "Free DMARC Report Analyzer - Parse XML Aggregate Reports | Phish Protection"
description: "Upload a DMARC aggregate report (RUA XML) and instantly see senders, pass rates, alignment, and per-record details. Files are parsed in your browser - nothing is uploaded."
image: "https://phishprotection.com/images/og-default.png"
canonical: "https://phishprotection.com/tools/dmarc-report-analyzer/"
---

## What is a DMARC Aggregate Report?

When you publish a DMARC record with a `rua=` address, receiving mail servers email you a daily summary of every message claiming to be from your domain. These XML files are how you find out who is sending mail as you - your own infrastructure, your authorized vendors, and anyone trying to spoof your domain.

For phishing prevention, DMARC reports are your visibility into outbound spoofing attempts. If attackers are sending phishing emails that claim to be from your domain, those attempts show up as failures here. Once you move from p=none to p=reject, those messages stop reaching recipients entirely.

## How to Read the Results

### Pass Rate

Percentage of messages that passed DMARC (SPF or DKIM aligned). Healthy domains sit at 99%+. Anything lower means real legitimate mail is failing - or someone is spoofing you.

### Failed Records

Messages where neither SPF nor DKIM aligned. These are your spoofing attempts (or misconfigured legitimate senders). Click into a failed record to see the source IP and where it claims to be from.

### Top Source IPs

Where your traffic comes from, with reverse-DNS hostnames. If you see IPs you don't recognize sending mail at scale, that is your spoofing problem.

### Per-Record Details

Expand any row to see DKIM signing domains, selectors, the SPF return-path domain, and the From header. This is how you trace a failure back to a specific service.

## One report at a time is fine. Hundreds per day is not.

For continuous DMARC monitoring across all your domains, our sister product DMARC Report ingests every aggregate and forensic report automatically, classifies senders by vendor, tracks pass rates over time, and alerts you on suspicious activity.

[Try DMARC Report Free](https://dmarcreport.com/?utm%5Fsource=phishprotection&utm%5Fmedium=tool&utm%5Fcampaign=report-analyzer&utm%5Fcontent=primary-cta) [Learn More](https://dmarcreport.com/features/?utm%5Fsource=phishprotection&utm%5Fmedium=tool&utm%5Fcampaign=report-analyzer&utm%5Fcontent=learn-more) 

## Frequently Asked Questions

What is a DMARC aggregate report? 

A DMARC aggregate report (RUA) is an XML file sent daily by receiving mail servers like Google, Microsoft, and Yahoo to the address listed in your DMARC record. It contains a summary of every authentication result for messages claiming to be from your domain - source IPs, message counts, SPF and DKIM results, alignment status, and the policy applied.

Is my report uploaded to a server? 

No. The DMARC Report Analyzer parses your XML file entirely in your browser using JavaScript. Nothing is sent to a server, stored, or logged. You can verify this by opening your browser DevTools and watching the Network tab while you upload a file.

What file formats are supported? 

You can upload uncompressed .xml files or gzipped .xml.gz files. Most mail providers email reports as .xml.gz attachments - drop them in directly without extracting. Encrypted .zip archives are not yet supported; please extract the .xml first.

How does this help me stop phishing? 

DMARC reports show every IP that's sending mail under your domain - including attackers spoofing you. If your report shows messages from IPs you don't recognize that pass DMARC, that means a sender is authenticated to use your domain (legitimate vendor or compromised infrastructure). If they fail DMARC at p=reject, recipients won't receive the spoofed mail.

What does "aligned" vs "not aligned" mean? 

DMARC alignment means the domain in the SPF or DKIM check matches the domain in the From header. SPF can pass on its own, but only "aligned" SPF helps DMARC. The same applies to DKIM. A message can pass DMARC if either SPF or DKIM passes AND aligns - so unaligned passes are not protective.

Why does an SPF result show "passed but unaligned"? 

This usually means a third-party sender (like Mailchimp, SendGrid, or Salesforce) is using their own return-path domain in the envelope. Their SPF passes for their domain, but it does not match your From header. Either configure them to use a custom return-path on your domain, or rely on DKIM signing for that sender.

How do I get my own DMARC reports? 

Add a DMARC record to your DNS with a rua= tag pointing to a mailbox you own (e.g., v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com). Mail providers will start sending daily aggregate reports to that address within 24-48 hours. For ongoing automated parsing, DMARC Report (dmarcreport.com) ingests them into a dashboard.

Is the source IP hostname information accurate? 

The hostname comes from the IP's reverse DNS (PTR) record, resolved live via Google's public DNS. PTR records are set by the network owner, so they are usually accurate for major senders (mail.google.com, outlook.com, sendgrid.net) but can be missing or misleading for shared hosting and consumer ISPs.

## Stop phishing before it reaches your inbox

DMARC stops attackers spoofing your domain. Phish Protection blocks phishing, ransomware, and BEC attacks targeting your inbox. 60-day free trial - no credit card required.

[Start Free Trial](https://portal.duocircle.com/cart.php?a=add&pid=101&brand=phishprotection)

```json
{"@context":"https://schema.org","@type":"Organization","name":"Phish Protection","url":"https://phishprotection.com","logo":{"@type":"ImageObject","url":"https://phishprotection.com/images/phishprotection-logo.png"},"description":"Advanced phishing protection and email security for businesses. Real-time threat defense, time-of-click protection, and seamless Office 365 integration.","parentOrganization":{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138883901","name":"DuoCircle LLC","url":"https://www.duocircle.com","sameAs":["https://www.wikidata.org/wiki/Q138883901","https://www.crunchbase.com/organization/duocircle-llc","https://www.linkedin.com/company/duocircle","https://github.com/duocircle"],"subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]},"sameAs":["https://www.linkedin.com/company/duocircle","https://x.com/duocirclellc","https://www.facebook.com/duocirclellc","https://github.com/duocircle"],"aggregateRating":{"@type":"AggregateRating","ratingValue":"4.8","reviewCount":"21","bestRating":"5","worstRating":"1","url":"https://www.g2.com/products/phish-protection/reviews"},"contactPoint":{"@type":"ContactPoint","contactType":"customer support","url":"https://phishprotection.com/contact/"},"knowsAbout":["Phishing Protection","Email Security","Anti-Phishing","Business Email Compromise","Ransomware Protection","Time of Click Protection","Office 365 Email Security","Advanced Threat Defense"]}
```

```json
{"@context":"https://schema.org","@type":"WebSite","name":"Phish Protection","url":"https://phishprotection.com","description":"Advanced phishing protection and email security for businesses. Real-time threat defense, time-of-click protection, and seamless Office 365 integration.","publisher":{"@type":"Organization","name":"Phish Protection","url":"https://phishprotection.com","logo":{"@type":"ImageObject","url":"https://phishprotection.com/images/phishprotection-logo.png"},"description":"Advanced phishing protection and email security for businesses. Real-time threat defense, time-of-click protection, and seamless Office 365 integration.","parentOrganization":{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138883901","name":"DuoCircle LLC","url":"https://www.duocircle.com","sameAs":["https://www.wikidata.org/wiki/Q138883901","https://www.crunchbase.com/organization/duocircle-llc","https://www.linkedin.com/company/duocircle","https://github.com/duocircle"],"subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]}}}
```

```json
[{"@context":"https://schema.org","@type":"WebApplication","name":"DMARC Report Analyzer","url":"https://phishprotection.com/tools/dmarc-report-analyzer/","description":"Free in-browser DMARC aggregate report parser. Upload an XML or .xml.gz file and instantly see senders, pass rates, alignment, and per-record details.","applicationCategory":"SecurityApplication","operatingSystem":"Web","offers":{"@type":"Offer","price":"0","priceCurrency":"USD"},"provider":{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://phishprotection.com","logo":{"@type":"ImageObject","url":"https://media.mailhop.org/phishprotection/images/phishprotection-logo.png"},"description":"Enterprise-grade email security that protects businesses from phishing, ransomware, and email fraud with real-time threat detection and multi-layered protection.","parentOrganization":{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138883901","name":"DuoCircle LLC","url":"https://www.duocircle.com","sameAs":["https://www.wikidata.org/wiki/Q138883901","https://www.crunchbase.com/organization/duocircle-llc","https://www.linkedin.com/company/duocircle","https://github.com/duocircle"],"subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://phishprotection.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"}]},"sameAs":["https://www.wikidata.org/wiki/Q138897912","https://www.linkedin.com/company/duocircle","https://x.com/duocirclellc","https://github.com/duocircle","https://www.crunchbase.com/organization/duocircle-llc"],"contactPoint":{"@type":"ContactPoint","contactType":"customer support","url":"https://phishprotection.com/contact/"},"knowsAbout":["Phishing Protection","Email Security","Anti-Phishing","Ransomware Protection","Business Email Compromise","Time of Click Protection","Advanced Threat Defense","Email Fraud Prevention","Phishing Awareness Training","Office 365 Email Security"]}},{"@context":"https://schema.org","@type":"FAQPage","mainEntity":[{"@type":"Question","name":"What is a DMARC aggregate report?","acceptedAnswer":{"@type":"Answer","text":"A DMARC aggregate report (RUA) is an XML file sent daily by receiving mail servers like Google, Microsoft, and Yahoo to the address listed in your DMARC record. It contains a summary of every authentication result for messages claiming to be from your domain - source IPs, message counts, SPF and DKIM results, alignment status, and the policy applied."}},{"@type":"Question","name":"Is my report uploaded to a server?","acceptedAnswer":{"@type":"Answer","text":"No. The DMARC Report Analyzer parses your XML file entirely in your browser using JavaScript. Nothing is sent to a server, stored, or logged. You can verify this by opening your browser DevTools and watching the Network tab while you upload a file."}},{"@type":"Question","name":"What file formats are supported?","acceptedAnswer":{"@type":"Answer","text":"You can upload uncompressed .xml files or gzipped .xml.gz files. Most mail providers email reports as .xml.gz attachments - drop them in directly without extracting. Encrypted .zip archives are not yet supported; please extract the .xml first."}},{"@type":"Question","name":"How does this help me stop phishing?","acceptedAnswer":{"@type":"Answer","text":"DMARC reports show every IP that's sending mail under your domain - including attackers spoofing you. If your report shows messages from IPs you don't recognize that pass DMARC, that means a sender is authenticated to use your domain (legitimate vendor or compromised infrastructure). If they fail DMARC at p=reject, recipients won't receive the spoofed mail."}},{"@type":"Question","name":"What does \"aligned\" vs \"not aligned\" mean?","acceptedAnswer":{"@type":"Answer","text":"DMARC alignment means the domain in the SPF or DKIM check matches the domain in the From header. SPF can pass on its own, but only \"aligned\" SPF helps DMARC. The same applies to DKIM. A message can pass DMARC if either SPF or DKIM passes AND aligns - so unaligned passes are not protective."}},{"@type":"Question","name":"Why does an SPF result show \"passed but unaligned\"?","acceptedAnswer":{"@type":"Answer","text":"This usually means a third-party sender (like Mailchimp, SendGrid, or Salesforce) is using their own return-path domain in the envelope. Their SPF passes for their domain, but it does not match your From header. Either configure them to use a custom return-path on your domain, or rely on DKIM signing for that sender."}},{"@type":"Question","name":"How do I get my own DMARC reports?","acceptedAnswer":{"@type":"Answer","text":"Add a DMARC record to your DNS with a rua= tag pointing to a mailbox you own (e.g., v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com). Mail providers will start sending daily aggregate reports to that address within 24-48 hours. For ongoing automated parsing, DMARC Report (dmarcreport.com) ingests them into a dashboard."}},{"@type":"Question","name":"Is the source IP hostname information accurate?","acceptedAnswer":{"@type":"Answer","text":"The hostname comes from the IP's reverse DNS (PTR) record, resolved live via Google's public DNS. PTR records are set by the network owner, so they are usually accurate for major senders (mail.google.com, outlook.com, sendgrid.net) but can be missing or misleading for shared hosting and consumer ISPs."}}]},{"@context":"https://schema.org","@type":"SoftwareApplication","name":"DMARC Report Analyzer","url":"https://phishprotection.com/tools/dmarc-report-analyzer/","applicationCategory":"SecurityApplication","operatingSystem":"Web","description":"Free in-browser DMARC aggregate report parser - identifies senders, pass rates, and alignment failures in any RUA XML file.","offers":{"@type":"Offer","price":"0","priceCurrency":"USD"},"provider":{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://phishprotection.com","logo":{"@type":"ImageObject","url":"https://media.mailhop.org/phishprotection/images/phishprotection-logo.png"},"description":"Enterprise-grade email security that protects businesses from phishing, ransomware, and email fraud with real-time threat detection and multi-layered protection.","parentOrganization":{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138883901","name":"DuoCircle LLC","url":"https://www.duocircle.com","sameAs":["https://www.wikidata.org/wiki/Q138883901","https://www.crunchbase.com/organization/duocircle-llc","https://www.linkedin.com/company/duocircle","https://github.com/duocircle"],"subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://phishprotection.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"}]},"sameAs":["https://www.wikidata.org/wiki/Q138897912","https://www.linkedin.com/company/duocircle","https://x.com/duocirclellc","https://github.com/duocircle","https://www.crunchbase.com/organization/duocircle-llc"],"contactPoint":{"@type":"ContactPoint","contactType":"customer support","url":"https://phishprotection.com/contact/"},"knowsAbout":["Phishing Protection","Email Security","Anti-Phishing","Ransomware Protection","Business Email Compromise","Time of Click Protection","Advanced Threat Defense","Email Fraud Prevention","Phishing Awareness Training","Office 365 Email Security"]}}]
```

```json
{"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://phishprotection.com/"},{"@type":"ListItem","position":2,"name":"Tools","item":"https://phishprotection.com/tools/"},{"@type":"ListItem","position":3,"name":"DMARC Report Analyzer","item":"https://phishprotection.com/tools/dmarc-report-analyzer/"}]}
```