Free DMARC Analyzer

DMARC (Domain-based Message Authentication, Reporting & Conformance) builds on SPF and DKIM to give domain owners control over what happens when emails fail authentication. It also adds alignment checking — ensuring the From address domain aligns with the SPF or DKIM authenticated domain. Without DMARC, spammers can spoof your domain in the From header even if SPF and DKIM pass. DMARC is now required by Gmail and Yahoo Mail for bulk senders.

Start with p=none (monitor mode) to collect reports without affecting email delivery. Once you have verified that all legitimate email streams are passing SPF or DKIM and are DMARC-aligned, move to p=quarantine (suspect emails go to spam), then eventually p=reject (emails that fail are blocked outright). Use rua= to receive aggregate reports and ruf= for forensic failure reports to a designated monitoring email address.

DMARC alignment requires the domain in the From header to match the domain authenticated by SPF or DKIM. Strict alignment (aspf=s or adkim=s) requires an exact match. Relaxed alignment (the default, aspf=r) allows subdomain matches. If you send from mail.yourdomain.com but your From header says yourdomain.com, strict SPF alignment will fail even if SPF itself passes.

DMARC aggregate reports (RUA) are XML files sent daily from receiving mail servers summarizing authentication results. They show which IPs sent mail claiming to be your domain, whether SPF and DKIM passed, and whether the messages were aligned. Use our DMARC Analyzer tool to parse and visualize these XML reports in a readable format. Look for unknown sending IPs as potential spoofing attempts or undocumented sending services.