Analyzer · RFC 7489 · nothing stored
DMARC report analyzer
Upload the aggregate reports mail servers send to your rua address. See, in plain words, who sends in your domain's name, what passes DMARC, what fails and what to do.
How to get the reports
Publish DMARC with
rua=mailto:…(with the DMARC generator, for example): receiving mail servers send reports to that address.The reports come as attachments: XML, usually compressed (
.xml.gzor.zip). Save them as they are; there is no need to unpack them.Upload them here, as many as you like at once: you get the sources, what passes, what fails and what to do.
DMARC reports in short
- What they hold
An aggregate report (RFC 7489 Appendix C) tells, for a period, which IP addresses sent mail with your domain in From, how many messages and with what SPF and DKIM results.
- When a message passes
A message passes DMARC when SPF or DKIM passes and is aligned with the From domain; the reporter writes this in
policy_evaluated, and the analyzer counts from there. - What a failure means
Either a legitimate service not configured yet (SPF or DKIM for the domain), or someone using the domain without the right. The source's reverse DNS name helps tell them apart.
- What happens to the files
They are read in memory only, for this answer, then dropped: nothing is written to disk and nothing appears in logs. Reverse DNS names are asked of the local DNS server.
Sources: RFC 7489 · RFC 7208 §10.3