A practical guide to DMARC aggregate reports
Read DMARC reports without getting lost in XML.
Aggregate reports show which IP addresses use your domain, how much mail they send, and whether SPF or DKIM passed with alignment. The real task is mapping those signals to actual senders.
Reviewed: July 19, 2026 · Primary sources below
Confirm the reporter and time window
Start with the reporting organization, report ID, and date range. Each receiving system creates its own summary, so multiple providers may report separately for the same day.
Prioritize source IP and volume
Sort by message count first. An unknown source sending thousands of messages deserves attention before a single event. An IP alone is not proof of abuse because legitimate services often share infrastructure.
Read SPF and DKIM separately
The report includes authentication results for both mechanisms. A technical pass only helps DMARC when the authenticated domain aligns with the visible From domain.
Treat alignment as the key question
A newsletter may pass SPF for the provider's envelope domain while using your domain in From. Aligned DKIM or a properly configured return path can solve that mismatch.
Interpret disposition and overrides
none, quarantine, or reject records the reported handling. Receivers can apply local policy, so an override is not automatically a configuration failure.
Assign every source an action
Classify senders as legitimate and correct, legitimate but broken, unknown, or abusive. Fix high-volume legitimate failures before increasing enforcement.
Free browser tool · 0 uploads
Go from reading reports to analysing them now.
Open XML, GZIP, or ZIP aggregate reports locally in your browser. MX Audit groups sources, exposes failing volume and observed SPF/DKIM domains, and conservatively estimates what quarantine or reject could affect.
Important
Aggregate reports are operational data, not full emails.
The current IETF format summarizes IP, domain, authentication, and volume data. Do not post reports in public tickets or forums: they can expose internal services and sending infrastructure. Failure reports are a separate, potentially more sensitive class.
If you need continuous monitoring
See who really sends in your name.
DMARCTrust is an external platform for DMARC reports, alerts, and sender inventory. Its free evaluation tier is limited to one domain; paid business plans start at $19/month for two domains. The MX Audit score remains independent.
Why do reports arrive as ZIP or GZIP files?
Aggregate reports are commonly delivered as compressed XML attachments so large daily summaries remain manageable.
Is every unknown IP an attacker?
No. It may belong to a forgotten CRM, billing, newsletter, or support service. Identify the platform using volume, service ownership, and real headers before blocking it.
Why can SPF pass while DMARC fails?
SPF may pass for the provider's technical envelope domain without aligning to the visible From domain. DMARC requires authentication plus alignment.
Must I read every report manually?
No. A parser can be enough for one small domain. With several senders or daily volume, a monitoring platform reduces manual mapping and shows trends.