Security & Crypto
Bulk DMARC Report Analyser
Analyse multiple DMARC XML, GZIP and ZIP reports privately in your browser. Compare source IPs, SPF and DKIM alignment across batches and export CSV.
Reports & batch comparison
Read aggregate reports privately, or compare two batches to find newly observed sources and changing authentication failures. No account, upload or DNS lookup.
Report evidence only: failures do not establish abuse, and a pass does not establish inbox delivery. Files stay in memory until you clear or leave this page.
Choose multiple XML, GZIP or ZIP files. This batch also works on its own.
Choose a later period for the same domains and receivers.
Up to 100 input files, 10 MB each; 200 ZIP entries; 20 MB expanded per XML, 60 MB per run; 50,000 rows per batch. ZIPs may contain XML files only. UTF-8 or BOM-marked UTF-16.
Choose reports, or try the synthetic sample.
Download the DMARC Before-and-After Test Pack (ZIP). Three synthetic scenarios cover a legitimate sender fix, an unexpected IP and misleading coverage changes. Includes source XML, expected findings and instructions. Extract it first, then select each scenario’s baseline and comparison XML separately.
Filter & export evidence
Search one IP, domain or change phrase at a time, for example 192.0.2.10 or new. Partial matches are supported.
Results
What the result means
Import one batch to see sources and alignment, or add a second batch to compare reporting periods. Totals use message counts rather than XML row counts. DMARC passes when the receiver reports aligned SPF or aligned DKIM as passing; underlying authentication results remain separate in the CSV. Sources are grouped by policy domain, visible From domain and source IP. New sources are new only relative to your supplied baseline. Exact duplicates within each batch are suppressed using reporter, policy domain and report ID; conflicting duplicates are excluded with a caution. Review receiver coverage, reporting gaps, overlapping periods and policy changes before interpreting percentage-point differences. Aggregate reports cannot identify sender ownership or prove successful delivery.
Related tools
Guides
Questions
Are my reports uploaded anywhere?
No. Parsing, decompression, comparison and CSV generation run locally in your browser. Report contents are not sent to analytics or stored by this tool.
Can I compare multiple DMARC reports?
Yes. Select multiple reports for the baseline and comparison batches. Use separate periods covering the same domains and receiving organisations for meaningful comparisons.
Does SPF failure mean DMARC failed?
No. DMARC passes if either SPF or DKIM passes with alignment. The tool uses the receiver’s policy_evaluated results, rather than treating raw authentication success as alignment.
Which compressed files are supported?
GZIP reports and ZIP archives containing XML reports are accepted within the displayed decompression limits. Nested archives are skipped and reported in the import cautions.
Can a new IP identify an attacker?
No. Newly observed sources can include legitimate providers, forwarding infrastructure or abuse. Verify sender inventory and representative message headers before making changes.