By Ahmet Karaca · Updated · Checked against RFC 9990 (DMARC aggregate reports) and RFC 9989 (DMARC, May 2026) on
What an aggregate report tells you
When your domain publishes a DMARC record with an rua= address, the large mailbox providers send you a daily summary of every message that claimed to come from your domain. The summary is an XML file. For each server that sent mail as you, it lists how many messages arrived, whether SPF and DKIM passed, whether either of them aligned with your From domain, and what the receiver did with the mail: delivered it, sent it to spam, or rejected it.
That file is the only place you see your whole sending picture: the newsletter tool someone signed up for, the help desk that sends replies, the old server nobody remembers, and anyone spoofing your domain. Raw XML is hard to read, so this tool turns one report into a short summary and a list of sources sorted by volume.
How to use it
- Open a DMARC report email that arrived at the address in your
rua=tag. - Save the attachment. It is usually a
.xml.gzor.zipfile; you don't need to unpack it. - Drop the file on the form above or choose it, then select Analyze report. Files up to 10 MB are accepted.
- Start with the sources that fail DMARC. A known service that fails usually needs DKIM set up with your domain; an unknown one needs a closer look.
Reading the result
The summary shows how many messages the report covers, the share that passed DMARC, and how many the receiver quarantined or rejected. Under it is the policy you had published when the report was written, read the same way our DMARC checker reads it: a testing flag (t=y) or an old pct= value changes what receivers actually do, and the note says how.
Each source row shows the sending IP, the service we recognized (by its DKIM signature or by reverse DNS), the number of messages and the receiver's DMARC verdict. One sentence explains the verdict from the report's own fields, for example that SPF passed for a bounce domain that doesn't align with yours. Open "Raw results" to see the exact SPF and DKIM results the receiver recorded.
What this tool checks
- Reads
.xml,.xml.gzand.zipreports by their content, not their file name. - Totals the messages, the DMARC pass rate and what receivers did with the mail (none, quarantine, reject).
- Groups records by source IP and result and orders them by volume, showing up to the 500 largest sources.
- Names known services by their DKIM signature first and by reverse DNS second, and says which one matched.
- Explains in one sentence why each source passed or failed DMARC, using the receiver's own results.
- Reads the published policy, including testing mode and a legacy
pct=value, as RFC 9989 defines them.
What it doesn't check
- It doesn't re-run SPF or DKIM. These results are what the receiver recorded; Patchkit doesn't re-run the checks.
- It reads one report at a time. Trends across days and receivers are what the monitoring account is for.
- It doesn't check that the report is about a domain you own; any domain's report can be read.
- Reverse DNS can name a mailbox provider's servers, but it can't tell your own mail from mail forwarded through that provider.
- Files over 10 MB and archives with more than one report are refused rather than partly read.
New to these reports? How to read DMARC aggregate reports walks through every field, and DMARC fails even though SPF passes explains the most common failing row.