What is a DMARC aggregate report?
A DMARC aggregate report is the XML file a mailbox provider sends to the address in your record's rua= tag, usually once a day. It lists each IP address that sent it mail with your domain in the From field, how many messages, and whether SPF and DKIM passed and aligned. Its format is in RFC 7489 and RFC 9990.
Reading the result
Choose the report file or paste its XML. The analyzer reads .xml as it is, inflates .gz with your browser's own decompression and opens .zip archives itself, then shows the reporter, the dates in UTC, the policy it found published, totals with the share passing DMARC, and every source IP with its count, disposition and results. Nothing is uploaded.
Common problems it finds
A source you do not recognise
An IP sending as you that fails both checks is either a service you forgot (a CRM, a helpdesk, an invoicing tool) or someone spoofing your domain. Find out which before you move to quarantine or reject.
SPF passes, and does not align
The raw result says SPF passed for the service's own domain while policy_evaluated says fail: its bounce domain is not yours. Set up a custom return path, or rely on aligned DKIM.
DKIM passes for the platform’s domain
The raw DKIM result is a pass for d= the platform's domain. Until the platform signs with your domain, that mail fails DMARC.
Forwarded mail failing
Mail forwarded by a list or a mailbox rule often fails SPF, and fails DKIM too if the content was changed. Reporters can mark it with a mailing_list or trusted_forwarder override; RFC 9990 dropped the older forwarded value.