DMARC Aggregate Report Analyzer
Paste a DMARC aggregate (rua) XML report — the daily feedback receivers like Google and Microsoft send to your rua address — and SysGlass makes it readable: how many messages passed DMARC, how many failed, and the exact source IPs that failed alignment. Those failing sources are either spoofers (which DMARC will block) or your own legitimate senders that aren't set up correctly (which you must fix before enforcing).
Reviewed by the SysGlass team · Updated July 21, 2026
What it checks
- The reporting organization and the domain the report covers
- The published policy (p=) at the time of the report
- Total messages, and the DMARC pass vs fail split (with percentages)
- Each sending source IP: message count, DKIM/SPF aligned result, disposition, pass/fail
- The list of source IPs that failed DMARC — your action list
How to read the result
- OK = every message passed DMARC; it's safe to move toward p=reject.
- Fail/Warn = some messages failed alignment from specific IPs — investigate each.
- A failing IP that's YOUR sender (ESP/app/marketing) = add it to SPF + enable aligned DKIM.
- A failing IP you don't recognize = likely spoofing; keep advancing DMARC to block it.
Frequently asked questions
Where do I get a DMARC report?
Publish a DMARC record with a rua= address (e.g. rua=mailto:dmarc@yourdomain.com). Receivers then send you daily aggregate XML reports. Paste the XML (decompress .gz/.zip first) here.
What does a failing source mean?
It's a sending IP whose mail didn't align with your From domain via SPF or DKIM. It's either an unauthorized sender spoofing you (DMARC at p=reject blocks it) or a legitimate service of yours that isn't configured to align (fix its SPF/DKIM).
How do I safely get to p=reject?
Start at p=none and read these reports until every legitimate sender passes. Then move to p=quarantine (optionally with pct<100), and finally p=reject. Don't enforce while your own senders still fail.
Is my report data stored?
No — the XML you paste is parsed in memory to produce the summary and isn't retained.