DMARC Report Viewer
🔒 In your browserTurn a DMARC aggregate XML report into a readable table.
How it works
DMARC aggregate reports arrive as XML (often zipped) and are unreadable by hand. Upload one to see, in a plain table, which servers sent mail as your domain, how many messages each sent, and whether they passed SPF and DKIM.
🔒 The report is parsed entirely in your browser — nothing is uploaded.
🔒 Runs in your browser: records, keys and headers are processed locally and never uploaded — including DKIM private keys, which never leave this device.
About the DMARC Report Viewer
Once DMARC is published, mailbox providers send you daily aggregate reports — as XML, usually zipped, and effectively unreadable by hand. This free DMARC report viewer turns one into a clear table: which servers sent mail as your domain, how many messages each sent, and whether they passed SPF and DKIM.
Reports are parsed entirely in your browser, so your reporting data is never uploaded.
How to use it
- Take the report attachment from a DMARC report email (.xml, .xml.gz or .zip).
- Upload it here — compressed files are extracted automatically.
- Review the sending sources; rows that failed DMARC are highlighted.
What to look for
Failing rows are either a legitimate service you forgot to authorise — an invoicing tool, a CRM, a marketing platform — or genuine spoofing. Work through them until every legitimate sender passes, and only then tighten your policy from none to quarantine to reject.
Frequently asked questions
What is a DMARC aggregate report?
A daily XML summary from a mailbox provider listing the servers that sent mail claiming to be your domain, with pass/fail results for SPF and DKIM. It's how you discover who is sending as you.
Why are the reports XML and zipped?
The DMARC standard specifies XML, and providers compress them to keep attachments small. This viewer handles .xml, .xml.gz and .zip directly.
What do I do about failing sources?
Identify each one. If it's a legitimate service, authorise it in SPF or set up DKIM signing for it. If it's not, that's spoofing — which is exactly what moving to p=reject stops.
Is my report uploaded?
No. It's decompressed and parsed entirely in your browser.