Read your DMARC reports
If your domain has a DMARC record, the large mail providers send you a daily report (a compressed XML file) listing every server that sent mail in your domain’s name. It is the only list you will ever get of everything that sends as you — including the parts of your own company you had forgotten about.
- Runs entirely in your browser
- Works offline
- No upload
- No sign-up
- No watermark
Loading the tool…
How it works
- Save the report attachments from the mailbox your DMARC record names (the rua= address), or drag them straight out of the message.
- Drop them all here at once — .xml, .xml.gz and .zip are all understood.
- Look at the failing sources first: each one is either something of yours that needs fixing, or someone forging your domain.
Why nothing is uploaded
Every operation on this page is done by code running inside your browser tab, using the same engine that renders web pages. The file is read from disk into your tab’s memory, transformed there, and written back out as a download. It is never sent anywhere — not to us, not to a third party.
Verify it yourself
- Open your browser’s developer tools (F12) and select the Network tab.
- Load your file and run the tool.
- The only requests you will see fetch the tool’s own code — and, for a few heavy tools, their open-source engine from a public CDN — plus one small page-view ping to loreatec.jp (page address and title, nothing more). None of them carry your file.
Frequently asked questions
Why do my reports arrive as .gz and .zip?
The standard lets each reporting organisation choose. Google sends .zip, Microsoft and most others send .xml.gz. This viewer opens all three in the browser — gzip through the browser’s own decompression, zip through a bundled open-source library.
A source shows SPF pass but DMARC fail. How?
That is what DMARC calls “alignment”. SPF passing means some domain authorised that server — but the domain checked is the hidden return address, not the From line your recipients see. DMARC also requires the two to match. A mailing service that sends with its own return address passes SPF for itself and fails alignment for you. The fix is to set up a custom return address (return-path) with the service — or to rely on DKIM signed with your own domain.
What should I do before moving to p=reject?
Every failing source in this table has to be identified. Some will be legitimate — an old server, a CRM, a payment provider, a scanner. Each needs SPF or DKIM set up properly. What remains after that is forgery, and rejecting it is the whole point. If you switch to reject while unidentified sources are still in the list, real mail will be lost without warning.
Do these files leave my browser?
No. They are decompressed and parsed here. That matters more than usual with DMARC reports: they contain the IP addresses of everything that sends on your behalf, which is a map of your infrastructure.
What about forensic (ruf) reports?
Those are not summaries — each one is a single failed message, sent to you as an ordinary e-mail. Open one with the .eml viewer or the header analyser. Most large receivers do not send them at all, for privacy reasons.