The Email Stack Scan a domain
← Tools and reports

DMARC Report Reader

/dmarc/reports

Drag in DMARC aggregate reports and read them like a person, not a parser.

Files are parsed in your browser and never uploaded. Only IP addresses are looked up in public DNS to name the senders.

What DMARC reports tell you

  1. What it is

    Receivers like Google and Microsoft mail you a daily XML digest of every server that sent as your domain, and whether each one passed.

  2. Why it matters

    It is the only way to see spoofing and forgotten tools: the newsletter platform nobody set up properly, the IP that was never yours.

  3. Without it

    Without reading them, you turned DMARC on and are flying blind. Enforce too early and real mail vanishes; too late and spoofed mail keeps landing.

What the reader shows

  • Every sending source named as a tool, from its reverse DNS and the domains it authenticated with: "7,198 emails from Klaviyo, all passing"
  • Unknown sources listed one IP at a time, so you can decide whether each is spoofing or a tool someone forgot to mention
  • Your DMARC pass rate, what receivers did with failing mail, and the pass share per day across every report you drop in
  • A path to enforcement worked out from your published policy, with the exact record to publish at each step

Common questions

Where do these reports come from?

From the mailbox providers that receive your mail. When your DMARC record includes rua=mailto:you@yourdomain.com, Google, Microsoft, Yahoo and others send that address one XML report a day, listing every IP that sent mail as your domain and whether it passed. They arrive as .xml.gz or .zip attachments; drop them here as they are.

Why do some senders fail SPF but pass DKIM?

SPF is checked against the bounce address, not the From header. Many tools (Mailchimp, SendGrid on a default setup) bounce to their own domain, so SPF passes for their domain but does not align with yours, and DMARC counts it as an SPF fail. DKIM signs with your domain, so it aligns. DMARC passes on either one, so this is fine for delivery, but it means that sender has no backup if its DKIM key ever breaks.

What does a "none" disposition mean?

The receiver took no action: the message was delivered as normal, whether it passed or not. That is what p=none asks for. Under p=quarantine failing mail shows as "quarantine" (filed to spam), and under p=reject as "reject" (bounced). Some receivers also report "none" for mail they let through on a local override, such as a known mailing list.

Is anything uploaded?

No. The files are unzipped and read in your browser. The only network requests are reverse-DNS lookups for the source IP addresses, made to public DNS-over-HTTPS resolvers to name the senders.