sysop@hub:~/tools/dmarc-report-reader$

dmarc-report-reader

Once you publish a DMARC record, the big mail providers send you a report every day: an XML file nobody wants to read. Drop a day's or a month's worth here. You get the list of everyone who sends mail with your domain in the From line, what passed and what failed, which of your own services are not set up yet, and whether you can tighten the policy. The files are read by your browser and never uploaded.

Drop the reports here, or click to choose filesAs they arrive by mail: .xml, .zip or .xml.gz, as many as you like

getting the reports

Receivers send reports to the address in the rua tag of your DMARC record. If you have no record yet, this one changes nothing about how your mail is delivered and only asks for reports:

_dmarc.example.org.  TXT  "v=DMARC1; p=none; rua=mailto:dmarc-reports@example.org"

Use a mailbox of its own. A busy domain gets dozens of reports a day.
The first reports arrive after one to two days. Collect two weeks before you draw conclusions: some senders only run monthly.
Save the attachments into a folder and drop them all at once. Duplicates are recognised.
If the reports should go to an address in another domain, that domain has to publish a record that allows it, or receivers will not send them.

how to read it

You see	It means	Do
Passes	SPF or DKIM passed for a domain that matches your From address.	Nothing.
Passes on SPF only	No valid DKIM signature for your domain. Works until the mail is forwarded.	Switch on DKIM for that sender.
Fails: not set up for your domain	A service sends as you and authenticates as itself.	Set up a custom sending domain in that service.
Fails: DKIM signature broken	Signed for your domain, and the signature does not verify.	Check the key in DNS, and what changes mail after signing.
Fails: unknown sender	A forgotten system of yours, or someone forging your address.	Identify the address. Fix it if it is yours, and enforce the policy against the rest.
Fails: forwarded	Your mail, forwarded by the recipient to another mailbox.	Nothing, apart from signing everything with DKIM.

The page reads what receivers reported, and they only report on mail they received themselves. A sender that never mailed a reporting provider does not appear. The classification is a reading aid: whether an unknown address is a forger or your own scanner is something only you can find out. Aggregate reports contain no message content and no recipient addresses. Related: domain check for your SPF, DKIM and DMARC records, mail flow debugger, mail flow cheat sheet, phish analyzer.