How to Read a DMARC Report
A DMARC aggregate report is compressed XML summarizing how receivers authenticated mail claiming your domain—by IP, SPF/DKIM results, alignment, and applied policy.
Report structure
Reports typically include report metadata (org, date range), policy published, and one or more record rows with row/source_ip, count, and auth_results.
- source_ip — sending IP observed by the receiver
- count — message volume for that row
- policy_evaluated — disposition and aligned DKIM/SPF
- auth_results — raw SPF/DKIM outcomes
Practical reading order
Sort by volume of fails first. Map IPs to vendors. Confirm whether failures are alignment or outright auth fails. Decide authorize vs block.
Example mindset
A high-volume fail from a known ESP usually means alignment configuration—not an attacker. A random VPS IP failing may be spoofing or a forgotten server.
How QuickDMARC helps
Upload XML to the DMARC report analyzer or forward rua to QuickDMARC for continuous parsing.
Frequently asked questions
Why is the file .xml.gz?
Reporters compress aggregate XML. Decompress before viewing raw content.
Are all reporters identical?
Schema is standardized; field completeness varies slightly by reporter.
Can I ignore passes?
Still review large pass sources—they confirm authorized inventory.