What is a DMARC aggregate report?

Mailbox providers send periodic XML summaries to the rua address in your DMARC record. They show sending IPs, message counts, alignment results, and the action receivers applied.

Do you upload or store my reports?

No. XML and ZIP files are parsed locally by your browser. This version does not send report contents to Moletools.

Does a DMARC failure always mean spoofing?

No. It may be an unauthorized sender, but it can also be a legitimate service with missing DKIM or SPF alignment. Confirm each source before blocking it.

DMARC Aggregate Report Analyzer

Turn DMARC XML or ZIP reports into a clear overview of sending sources, authentication alignment, and policy actions.

Report overview

Reports: 0
Messages: 0
DMARC pass: 0
DMARC fail: 0

Alignment breakdown

Receiver disposition

Published policies

Domain	Reporting organization	Date range	Policy	Alignment mode

Sending sources

Rows are grouped by source IP, Header From domain, alignment results, and receiver disposition, then sorted by message volume.

Source IP	Header From	Volume	Share	DKIM alignment	SPF alignment	Disposition

Frequently asked questions

What is a DMARC aggregate report?: Mailbox providers send periodic XML summaries to the rua address in your DMARC record. They show sending IPs, message counts, alignment results, and the action receivers applied.
Do you upload or store my reports?: No. XML and ZIP files are parsed locally by your browser. This version does not send report contents to Moletools.
Does a DMARC failure always mean spoofing?: No. It may be an unauthorized sender, but it can also be a legitimate service with missing DKIM or SPF alignment. Confirm each source before blocking it.