DMARC aggregate (RUA) reports are XML files that mailbox providers such as Google, Microsoft, and Yahoo email to the rua= address in your DMARC record. They tell you exactly which servers are sending mail as your domain and whether that mail passed SPF, DKIM, and DMARC alignment. This tool turns that raw XML into a plain-English summary so you can spot spoofing, misconfigured senders, and delivery problems.
DMARC aggregate reports (also called RUA reports) are XML files that mailbox providers such as Google, Microsoft, and Yahoo send to the rua= address in your DMARC record, usually once a day. Each report lists every server that sent mail using your domain during the reporting window, along with how much mail each sent and whether it passed SPF, DKIM, and DMARC alignment. The data is invaluable, since it is the only way to see who is sending email as your domain, but the raw XML is designed for machines, not people. This tool parses a single aggregate report and turns it into a readable summary: the reporting organization, the published policy, pass and fail totals, and a per-source-IP table showing message counts, DMARC disposition, and DKIM/SPF results so you can quickly separate legitimate senders from spoofers.
Open the DMARC report you received (often a .xml, .xml.gz, or .zip attachment) and either paste its XML into the text box or upload the file directly, since the tool decompresses gzip and zip automatically. Click "Analyze Report." You get a summary card (reporting org, domain, date range, published policy), message totals broken down into pass, fail, quarantined, and rejected, and a table of every sending source sorted by volume with reverse-DNS lookups. Reports are processed in memory only; nothing is stored, and results are private (not shareable by URL) because they contain your mail-flow data.
Read reports in date order and watch the failing (red) sources. A failing source is either a legitimate sender you have not authenticated yet, so fix its SPF include or add a DKIM signature for it, or someone spoofing your domain, in which case tightening to p=quarantine or p=reject shuts them out. Do not jump to enforcement until the pass rate for your known senders is at or near 100%. Aggregate reports show volume and alignment, not message content, so pair them with your DMARC record lookup to confirm the policy and reporting addresses are set correctly. If a source shows SPF pass but DMARC fail, the problem is usually alignment (the envelope domain does not match your From domain).
Need reliable hosting? These free tools are brought to you by Ultra Web Hosting. Fast, secure shared and reseller hosting with 24/7 expert support. View hosting plans →