DMARC Report Analyzer
Analyze DMARC aggregate reports to understand email authentication performance
Ready to Analyze DMARC Reports
Paste DMARC aggregate report XML content above to analyze authentication performance.
What you'll get:
- Authentication pass/fail rates
- Top sending IP addresses
- Message disposition analysis
- Policy compliance insights
This page provides original, human-reviewed information about DMARC aggregate report analysis, explaining row-level fields such as source IP, disposition, and SPF/DKIM alignment results so you can act on real sending data.
Aggregate reports summarize how receivers authenticated mail claiming to be from your domain. Focus on the alignment results and the sending sources, not just the totals.
The share of messages that passed each mechanism. A sudden drop for one mechanism often points to a broken record or a new sender that was never configured.
DMARC passes only when SPF or DKIM passes with an aligned domain. Messages can show SPF pass yet still fail DMARC when the domains do not align.
IPs or reverse DNS names you do not recognize may be legitimate third-party senders that need authentication records, or they may be spoofing attempts. Investigate before tightening policy.
Shows what receivers actually did, none, quarantine, or reject. With policy at none, failing mail is still delivered, which is by design during the monitoring phase.
DMARC (Domain-based Message Authentication, Reporting & Conformance) is an email authentication protocol that builds upon SPF and DKIM to provide domain owners with the ability to protect their domain from unauthorized use, commonly known as email spoofing.
Key Components:
- Policy (p):Defines what action to take when emails fail authentication (none, quarantine, reject)
- Subdomain Policy (sp):Policy for subdomains if different from main domain
- Alignment (adkim/aspf):How strictly DKIM and SPF alignment is enforced (relaxed or strict)
- Percentage (pct):Percentage of emails to which the policy applies
How DMARC Works:
- Email is sent and received by the recipient's mail server
- The server checks SPF and DKIM authentication
- DMARC policy is evaluated based on authentication results
- Action is taken according to the policy (none, quarantine, or reject)
- Reports are generated and sent to the domain owner
Step 1: Prerequisites
Before implementing DMARC, ensure you have SPF and DKIM properly configured for your domain.
Step 2: Create DMARC Record
Add a TXT record to your DNS with the name _dmarc.yourdomain.com
Step 3: Gradual Implementation
Phase 1: Monitor (p=none)
Start with monitoring to understand your email ecosystem
Phase 2: Quarantine (p=quarantine)
Gradually increase enforcement starting with 25% of emails
Phase 3: Reject (p=reject)
Full protection - reject all unauthenticated emails
High Failure Rate
Many legitimate emails are failing DMARC authentication.
Solution: Review SPF and DKIM configuration, check for missing authorized senders.
Third-party Services Failing
Marketing platforms, CRMs, or other services are not passing authentication.
Solution: Configure DKIM for third-party services or add their IPs to SPF record.
No DMARC Reports
Not receiving DMARC reports despite having the record configured.
Solution: Verify rua/ruf email addresses are correct and can receive emails.
Alignment Issues
SPF or DKIM passing but DMARC still failing due to alignment issues.
Solution: Ensure From domain aligns with SPF/DKIM domains, or use relaxed alignment.
How do I get DMARC reports?
DMARC reports are automatically sent by receiving mail servers to the email addresses specified in your DMARC record's rua (aggregate) and ruf (forensic) tags. Set up a dedicated email address like dmarc@yourdomain.com to receive these reports.
How often are DMARC reports sent?
Aggregate reports (rua) are typically sent daily by most email providers. Forensic reports (ruf) are sent immediately when authentication failures occur, but many providers don't send them due to privacy concerns.
What's the difference between rua and ruf?
RUA (aggregate reports) provide statistical summaries of authentication results over a period. RUF (forensic reports) contain individual email samples that failed authentication, but are rarely sent by major providers.
Can DMARC break legitimate email?
Yes, if not properly configured. Always start with p=none to monitor your email ecosystem before moving to quarantine or reject policies. Gradually increase enforcement while monitoring reports.
How long does DMARC take to work?
DMARC records propagate within 24-48 hours like other DNS changes. However, you may not see reports immediately as they depend on email volume and receiving server policies.
What should my DMARC policy be?
Start with p=none for monitoring, then gradually move to p=quarantine with a low percentage (pct=25), and finally to p=reject once you're confident all legitimate email is properly authenticated.
Related Tools
Need Help?
Our tools are designed to be intuitive, but if you need assistance, we're here to help.
About Our Tools
Professional-grade email and DNS diagnostic tools trusted by IT professionals worldwide.