DMARC Report Analyzer

THE PRACTICAL GUIDE · NORMANDIN SYSTEMS

Get more from DMARC Report Analyzer

DMARC Report Analyzer: Read and display DMARC Xml Reports. Aggregate reports summarize observed message sources and authentication outcomes, helping reveal which senders use a domain and how alignment behaves. Parsing turns structured input into fields that are easier to inspect. It can reveal what a message or file says, but it does not automatically prove that the source is trustworthy or that an associated action succeeded. Preserve the original input while investigating and compare extracted values with the surrounding system’s expectations. Incomplete copies, altered line endings, and missing wrappers can prevent otherwise valid content from parsing. Start with a representative sample, inspect the fields most relevant to your question, and keep any validation result separate from the decoded content itself.

Guide updated October 13, 2026

How to use this tool

1. Begin with a representative input. For a practical test, use: A sample aggregate DMARC XML report. Replace demonstration values only after you understand the output.
2. Provide the complete supported input, including its structural headers or wrappers where required, rather than copying only a visible fragment.
3. Inspect the extracted fields and any parsing or validation errors, comparing them with the system that produced the source.
4. Save the relevant findings with their context and confirm operational conclusions using the authoritative application or service.

SEE IT IN PRACTICE

A worked example

<?xml version="1.0"?><feedback><report_metadata><org_name>Example Receiver</org_name><email>reports@example.net</email><report_id>demo-1</report_id><date_range><begin>1700000000</begin><end>1700086400</end></date_range></report_metadata><policy_published><domain>example.com</domain><adkim>r</adkim><aspf>r</aspf><p>none</p><sp>none</sp><pct>100</pct></policy_published><record><row><source_ip>192.0.2.10</source_ip><count>2</count><policy_evaluated><disposition>none</disposition><dkim>pass</dkim><spf>pass</spf></policy_evaluated></row><identifiers><header_from>example.com</header_from></identifiers><auth_results><dkim><domain>example.com</domain><selector>demo</selector><result>pass</result></dkim><spf><domain>example.com</domain><scope>mfrom</scope><result>pass</result></spf></auth_results></record></feedback>

Report demo-1 for example.com
Source 192.0.2.10: 2 messages
Evaluated DKIM: pass
Evaluated SPF: pass
Disposition: none

The synthetic XML has one source row and a two-message count. The report describes a particular receiver and period, not every message sent by the domain.

Build an email-authentication picture

A domain may send through several services, each with its own configuration. Inventory those sources before tightening policy. SPF authorization, DKIM selector publication, and DMARC alignment are related but separate tasks. A message can pass an individual authentication mechanism without satisfying DMARC alignment. BIMI adds brand-indicator information under its own requirements and does not replace the authentication foundation.

Use observations to guide a rollout

Publish records in the correct owner names, then verify authoritative DNS and actual message results. Aggregate DMARC reports provide a receiver-specific view over a time window, useful for identifying legitimate and unexpected sources. Interpret counts and failures in context before moving from monitoring to enforcement. A syntactically valid record or a clean report from one receiver is not proof that every legitimate sender is correctly configured.

When this tool is useful

• Review reported sending sources
• Investigate alignment failures
• Compare report periods

Tips for a better result

• A report is an observation from a particular receiver and period, not a complete inventory of every sent message.
• A parsed value is a representation of supplied data; it does not by itself establish identity, authenticity, or successful delivery.
• Keep an original copy for troubleshooting because removing headers or reformatting a payload can change what the parser sees.

Frequently asked questions