Free DMARC XML Report Analyzer
Turn DMARC Reports Into Readable Data
Upload your DMARC XML, ZIP, GZ, or even EML files to analyze sending sources, message volumes, and SPF, DKIM, and DMARC results without digging through raw XML.
Need Ongoing DMARC Monitoring?
This DMARC XML Report Analyzer scans the reports you already have. If you'd rather not collect and upload XML files manually, the DMARKOFF platform automatically ingests DMARC reports, lets you manage multiple domains in one place, and alerts you when important changes are detected.
About the DMARC XML Report Analyzer by DMARKOFF
DMARC aggregate reports (RUA) arrive as raw XML from mailbox providers that process mail claiming to be from your domain. A report can contain records for many sending IPs, message volumes, and authentication results, with hundreds of lines of nested XML that quickly become difficult to review manually.
Drop your files in, and the DMARC XML Report Analyzer by DMARKOFF handles the parsing. Archives are unpacked automatically, reports are grouped by domain, and the raw data is turned into a plain-language summary, with sending sources sorted into Known, Unknown, and Forward, SPF/DKIM/DMARC results, and drill-down views by provider, IP, host, or reporter.
What the DMARC XML Report Analyzer Shows
✓ Multiple reports upload at once (.xml, .zip, .gz, .eml), auto-unpacked and grouped by domain
✓ Sorts every sending source into a readable table, grouped as Known, Unknown, and Forward, with message volumes and pass/fail rates
✓ SPF, DKIM, and DMARC results shown in plain terms
✓ Drill-down views by Provider, Sending IP, Host, or Reporter
✓ Filters by SPF, DKIM, and DMARC pass/fail and by disposition
✓ Calculates an overall domain Email Security Score (0-100) and a Spoofability Level
✓ Gives a clear breakdown of the issues affecting your domain protection
✓ Reopens your results automatically for 30 days, your browser remembers them for you
Why Choose Free DMARC XML Report Analyzer
Zero friction – no signup, no credit card, instant results.
Server-side processing – files and results are stored for 30 days, then automatically deleted.
Access by visitor ID – reopen anytime, your browser remembers it for you
FAQ
It's the raw aggregate report (RUA) that mailbox providers like Google, Microsoft, and Yahoo send to a domain's DMARC reporting address. It contains aggregate records for mail claiming to be from your domain during a reporting period, including sending IPs, message counts, SPF/DKIM results, DMARC alignment, and the reported disposition.
File types: DMARC aggregate reports as .xml, .zip, .gz, or the original .eml message from your reporting mailbox — the attachment is extracted for you.
Size: up to 10 MB per upload (all files in one request combined). A ZIP may contain up to 10 reports and up to 50 MB uncompressed in total; a .gz may expand to 50 MB.
Files: upload one file or several at once; reports are grouped by domain automatically.
Domains: up to 10 domains per upload. Reports for additional domains in the same upload are skipped, not queued — upload them separately.
Uploads: 10 uploads per day and 100 per month from one browser. When you hit the limit, the response tells you when it resets.
Retention: uploaded reports and results are kept for 30 days, then deleted.
Start by looking at the sending IP, message count, disposition, and SPF/DKIM results for each record. Then check whether SPF and DKIM pass under DMARC alignment. If you're wondering how to read DMARC XML reports, an XML-to-human converter can parse and organize this information for you, so you don't have to trace each record manually.
Known sources are sending IPs that pass authentication and match infrastructure you'd expect (your mail provider, marketing tools, etc.). Unknown sources are IPs sending mail as your domain that don't clearly match a known sender. Forwards are legitimate mail that's been forwarded through another server, which can fail SPF by design even though the message is genuine.
A CRM, helpdesk, marketing platform, forwarding service, or other mail provider may appear as a separate source, by IP address, hostname, or provider name, even if you haven't documented it. Our DMARC viewer surfaces every source sending as your domain, not just the ones you already expect. If it passes authentication, it could be a legitimate sender you haven't documented. If it fails authentication and you don't recognize it, it's worth investigating further.
No. You can upload the file, and our free DMARC XML analyzer handles the parsing for you. Instead of raw XML tag names, you'll see plain labels like Pass, Fail, and Forward, so the output reads like a human-friendly report with clear data.
No. You don't need an account to use the DMARC XML reader. Your browser remembers your visitor ID automatically, so you can close the tab and come back later without logging in. The ID isn't included in shareable links or visible to you directly, so there's nothing to copy or keep track of.
Your DMARC reports are kept for 30 days from upload, after which the reports and their converted output are automatically deleted.
DMARC XML reports are sent automatically to the address specified in your domain's DMARC record (the rua= tag), usually as a .zip or .gz attachment. You'll need a published DMARC record with a valid rua= address before providers start sending reports.
These metrics show the current state of your domain’s email security setup.
The Email Security Score summarizes your setup across Authentication, Transport, Delivery, Reputation, Identity, and Hygiene. The overall score (0–100) is converted into a grade from A+ to F. The higher, the better your domain is protected against threats.
The Spoofability level shows how easily attackers could impersonate your domain based on its SPF, DKIM, and DMARC configuration and can be Low, Medium, High, or Unknown, depending on the authentication records and policies detected.