DMARC Report Analyzer

How to read a DMARC aggregate report

Each row is a source IP that sent mail claiming to be your domain during the report window. For each source you see message volume and whether SPF and DKIM aligned — i.e. passed and matched your From domain.

• Your ESPs should show pass/pass. A legitimate sender failing alignment means a configuration problem eating your deliverability.
• Unknown IPs failing both are usually spoofers — the reason to move to p=quarantine.
• Forwarders often break SPF but keep DKIM — that's normal and why DKIM matters.

Where do these reports come from?

Any domain with a rua= tag in its DMARC record receives daily aggregate reports from Gmail, Microsoft, Yahoo and others. No rua tag? Check your record with the DMARC checker.