Domain-based Message Authentication, Reporting, and Conformance (DMARC) is one of the most critical security records you can configure for your domain. It helps prevent domain spoofing, phishing campaigns, and unauthorized email delivery by telling receiving servers how to handle messages that fail SPF or DKIM checks.

However, once you turn on DMARC reporting by adding a rua tag (e.g., mailto:support@nexatools.in) to your DNS record, you will start receiving daily XML aggregate reports from mailbox providers like Google, Microsoft, and Yahoo. These raw XML files are hard to read and analyze manually.

In this guide, we will walk you through how DMARC aggregate reports work, what alignment failures mean, and how to analyze them securely using the offline DMARC XML Report Analyzer.

What is a DMARC Aggregate Report?§

A DMARC aggregate report is an XML document containing statistics about emails sent on behalf of your domain. The report includes:

  • The Reporting Organization (e.g., google.com or yahoo.com).
  • The Date Range of the compiled logs.
  • The Published DMARC Policy (e.g., p=none, p=quarantine, or p=reject).
  • A list of Records showing sending IP addresses, email volumes, SPF/DKIM authentication results, and policy evaluation decisions.

Here is a simplified example of a single record entry inside a DMARC XML report:

<record>
 <row>
 <source_ip>209.85.220.41</source_ip>
 <count>15</count>
 <policy_evaluated>
 <disposition>none</disposition>
 <dkim>pass</dkim>
 <spf>fail</spf>
 </policy_evaluated>
 </row>
 <identifiers>
 <header_from>nexatools.in</header_from>
 </identifiers>
 <auth_results>
 <dkim>
 <domain>nexatools.in</domain>
 <result>pass</result>
 <selector>google</selector>
 </dkim>
 <spf>
 <domain>mail-sor-f41.google.com</domain>
 <result>pass</result>
 </spf>
 </auth_results>
</record>

In this record:

  • 15 emails were sent from IP 209.85.220.41.
  • DKIM authentication passed and aligned with the header domain.
  • SPF authentication passed at the system level, but the domain (mail-sor-f41.google.com) did not match the header From domain (nexatools.in), causing an SPF alignment failure.
  • Because DKIM passed alignment, the overall DMARC status is a Pass.

Understanding SPF and DKIM Alignment§

For DMARC to consider an email authentic, the message must pass alignment for either SPF or DKIM:

  1. SPF Alignment: The domain in the envelope sender (the Return-Path address where bounce emails go) must match the domain in the visible From header. If your domain is example.com but the Return-Path domain is sendgrid.net, SPF fails alignment even if the email passes raw SPF verification.
  2. DKIM Alignment: The domain name associated with the DKIM signature (found in the d= tag of the mail header) must match the domain in the From header.

If your email setup uses third-party marketing services (like Mailchimp or HubSpot) or custom forwarding (like Cloudflare Email Routing), these services may send mail using their own Return-Path domain. To pass DMARC, you must configure a custom Return-Path (CNAME record) or DKIM signature with the service provider to align their headers with your domain.

How to Analyze DMARC XML Reports Securely§

Many online DMARC parsers require you to upload your XML files to their servers. Because these reports contain sender IPs, volumes, and authentication settings, uploading them exposes internal email infrastructure data to third parties.

To solve this, NexaTools has built an offline DMARC XML Report Analyzer that runs 100% locally in your browser. Your reports are never uploaded to any backend.

Step-by-Step Guide to Parse Your XML Reports:§

  1. Locate the .xml report file. If you received a .zip or .xml.gz attachment from a mailbox provider, extract it to get the raw XML file.
  2. Open the DMARC XML Report Analyzer.
  3. Drag and drop the .xml file into the upload zone or click Browse Files to select it.
  4. The dashboard will instantly display:
  • Compliance Summary: Your overall DMARC pass rate percentage.
  • Published Policy Metrics: Target domain, reporting organization, and active policy parameters.
  • Diagnostic Advisories: Specific recommendations based on failing IPs to fix your SPF/DKIM DNS settings.
  • Detailed Logs: A list of sending IPs, counts, DKIM selector keys, and SPF domains.

By analyzing these reports weekly, you can detect phishing attacks targeting your brand, identify legitimate sending systems that need DNS authorization, and safely transition your DMARC policy from p=none to p=quarantine and eventually p=reject to lock down your email security.