Fix alignment
DMARC alignment failure — why SPF and DKIM can both pass and DMARC still fails
If this report shows a source failing alignment despite a passing SPF or DKIM result individually, this is the exact mechanic why.
Read moreFree tool · No account
DMARC Report Analyzer — XML to human, in your browser.
Mailbox providers email you a DMARC aggregate report as unreadable XML, sometimes gzipped or zipped. Drop it in below and see who's actually sending as your domain — pass/fail, source, and alignment, in a table instead of a wall of tags.
- XML, .gz or .zip accepted
- Runs entirely in your browser
- Free, no account
Drop DMARC aggregate report(s) here
or click to browse — .xml, .xml.gz, or .zip, multiple files at once. Nothing uploads anywhere; parsing happens entirely in this browser tab.
How this works
DMARC reports, in plain English.
What is a DMARC aggregate report, and where do I get one?
Once your domain publishes a DMARC record with an "rua=" reporting address, mailbox providers you send to (Gmail, Yahoo, Microsoft, and others) start emailing a gzipped XML report to that address roughly once a day, summarizing every message they saw claiming to be from your domain over that window.
Why is an IP address I don't recognize sending as my domain?
Usually it's a legitimate service you forgot was sending on your behalf — a help desk tool, a marketing platform, a transactional email API, a CRM. Occasionally it's spoofing: someone sending mail with your domain in the From header without your authorization, which is exactly what DMARC is designed to surface. Check the SPF/DKIM result for that IP — a legitimate but unauthorized sender usually fails both.
What does "aligned" mean in this table?
DMARC passes for a message if either its SPF result or its DKIM result is aligned — meaning the authenticated domain matches (or is a subdomain of, under relaxed mode) the domain in the visible From header. A source can fail SPF outright and still be DMARC-aligned via a passing, aligned DKIM signature, or vice versa.
My policy is p=none — does anything actually get blocked?
No. p=none is monitor-only: every message is delivered regardless of DMARC result, and this report is purely visibility into who's sending. That's the intended first step — see who's actually out there and whether legitimate senders would break under a stricter policy — before moving to p=quarantine or p=reject.
Manual XML uploads don't scale
See every DMARC report as it lands, automatically.
Brain ingests aggregate reports from every mailbox provider continuously, tracks alignment trends over time, and flags a new unauthorized sending source the moment it shows up.