What a DMARC report shows
An aggregate report arrives as XML: one row per IP that sent mail as your domain during the day, with a message count and SPF and DKIM results. Reading it by eye is hard, especially with dozens of reports.
The analyzer merges every uploaded report into one table by IP and labels addresses with server names from PTR. You see at once where your own mail comes from, which mailing service lacks DKIM and who sends mail in your name.
A message passes DMARC when SPF or DKIM passes for the domain in the From header. A mailing service signature on its own domain passes DKIM but does not count for DMARC.
When it helps
- You turned on DMARC with p=none and decide whether to move to quarantine.
- Mail from your domain lands in spam, and you need to find the server without DKIM.
- You check whether someone sends mail in your name.
- You connected a new mailing service and wait for its mail to start passing.