Who sends as you
Each report lists the servers that sent email with your domain in the From line. We group them by the email service they belong to, using the domains in the report, so you see names you know instead of server numbers.
What do my DMARC reports say?
DMARC Report Analyzer
Open the DMARC aggregate reports that Google, Microsoft and others email you. See who sends email as your domain, which of them fail, why, and the one fix to make first.
Pick one or many at once, straight from the emails the reports came in. They are read on this device and never uploaded.
Or paste the XML of one report
- Free, no sign-up
- Read on your device, never uploaded
- Every rule shows its source
What the analyzer reads
Every count comes from your own reports. Each rule rests on the DMARC, SPF and DKIM standards or on Gmail’s published rules for senders. No scores and no made-up rates.
What passed and what failed
An email passes DMARC when SPF or DKIM passes for a domain that matches your From line. We count the emails each sender got through, and the ones receivers sent to spam or refused.
Why it failed, and the fix
The most common reason is a service that signs with its own domain instead of yours. We name the setting to change in that service. Mail with no signature and no SPF pass may be someone pretending to be you.
Your safe next step
Once every service you use passes, p=none can move to p=quarantine and then p=reject, so fakes are sent to spam or refused. Gmail asks bulk senders to have a DMARC record.
Questions
What is a DMARC aggregate report?
It is a daily summary that mailbox providers like Google, Microsoft and Yahoo email to the address in your DMARC record's rua= tag. It lists every server that sent email using your domain, how many emails each sent, and whether they passed SPF, DKIM and DMARC. It comes as an XML file, often zipped, which is hard to read by hand. This analyzer reads it for you.
How do I start getting DMARC reports?
Add rua=mailto: and an email address to your DMARC record, for example v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com. Reports start arriving within a day or two from the bigger providers. The DMARC Checker on this site shows your record and the exact line to paste.
Are my DMARC reports uploaded anywhere?
No. The files are opened and read by your own browser on this page. Nothing in them is sent to our server or stored. You can turn off your internet after the page loads and it still works.
Why does a service I use fail DMARC when SPF and DKIM pass?
DMARC needs SPF or DKIM to pass for your own domain, the one in the From line. Many email services sign with their own domain until you turn on their domain authentication (sometimes called custom DKIM). The report shows the pass, but for their domain, so DMARC does not count it. The analyzer names the setting to change.
When can I move my DMARC policy from p=none to p=quarantine?
When the reports show every service you use passing DMARC for a couple of weeks. The failing mail left over should be senders you do not recognize, which is what quarantine is for. After quarantine runs cleanly, p=reject is the last step.
No reports yet? The DMARC Checker shows your record and the line that turns reports on.
Want to test one email? The Email Spam Test checks a real email as it arrives.
Setup passes? Check the words
The Free Sales Email Grader grades your subject and body against published sales research and suggests a rewrite.
Try the Free Sales Email Grader