Back to Free Tools
DMARC XML Report Preview
Paste or upload a DMARC aggregate (RUA) XML report to view it in a readable format.
Parse a DMARC XML report
What is a DMARC aggregate report?
DMARC aggregate (RUA) reports are daily XML summaries from mailbox providers that show how mail claiming to be from your domain authenticated. Each report lists the source IPs, message counts, and SPF/DKIM alignment results so you can see which senders are passing and which are failing. They're the feedback loop you need to safely tighten DMARC policy.
What this preview tool does
- Parses the
<feedback>envelope of a DMARC aggregate report - Extracts the reporter, date range, and published policy
- Renders each
<record>as a row with source IP, count, SPF, DKIM, and disposition - Reverse-DNS resolves source IPs so you can spot the sending platform
- Calculates aligned vs failed message totals
Field reference
| Field | XML path | Meaning |
|---|---|---|
| Reporter | report_metadata/org_name | The mailbox provider that produced the report. |
| Date range | date_range/begin..end | Unix-epoch window the report covers. |
| Policy | policy_published | The DMARC policy that was in effect at report time. |
| Source IP | record/row/source_ip | The IP that sent this batch of messages. |
| Count | record/row/count | Number of messages in this batch. |
| SPF / DKIM result | policy_evaluated/spf,dkim | Whether each mechanism aligned with the From: domain. |
| Disposition | policy_evaluated/disposition | What the receiver actually did (none / quarantine / reject). |
How to fix failing rows
- Look up the source IP — the reverse-DNS hostname usually tells you the platform (ESP, on-prem MTA, vendor)
- For ESP rows: enable DKIM via the CNAME the vendor publishes so DKIM aligns with your domain
- For on-prem rows: add the IP to your SPF record and confirm DKIM is signing
- For rows you don't recognize: investigate — could be spoofing, or a legitimate sender you forgot about
Frequently asked questions
Related free tools
References
Go beyond one-off checks
Safer Sender continuously monitors your domain's DMARC, SPF and DKIM, classifies every sender, and guides you safely from p=none to p=reject.