DMARC RUA Report Viewer
Who is sending in my name, and who is failing SPF and DKIM? An aggregate report answers that - but not as raw text. This tool reads it and shows the verdict per source, entirely in the browser.
What an aggregate report actually says
A DMARC aggregate report (RUA) is XML, often delivered as a .zip or .xml.gz, and barely readable in raw form. For every source IP that sent on behalf of the domain, it holds the message count, the SPF and DKIM results, whether alignment passed, and what the receiver did with the message.
This tool reads the file and answers exactly that question: which sources are sending in the domain’s name, and which of them fail the aligned check? Reports arrive in different containers depending on the recipient - .xml, .xml.gz, or .zip - all three are detected by the file’s content, not by its name or extension.
Multiple reports are not merged. Each report stands on its own, no timeline is built - dropping several files at once produces several independent evaluations side by side.
What is shown
Summary per report: reporter, reporting period, evaluated domain, and the published policy (p, sp, pct, adkim, aspf), plus the total message count split into pass and fail.
Source table: for each source IP the message count, the DMARC verdict, SPF and DKIM in their aligned evaluation, the disposition, and any overrides. A detail row opens the raw values behind it.
Findings: deviations from the schema, elements the tool does not understand, and contradictions in the numbers - named instead of silently ignored.
What deliberately does not happen
Source IP addresses are shown as they appear in the report and are not resolved. No rDNS, no WHOIS, no ASN lookup - each of those would be a network call, and this tool’s offline promise is enforced by Content Security Policy, not merely stated.
The well-known providers of the DMARC reporting business accept the report on their own infrastructure. Anyone who does not want to hand it over, or is evaluating an internal domain without a publicly reachable host, needs a different path.
Runs entirely in your browser
The tool itself loads nothing and sends nothing. Your data is processed in the browser and never leaves the device - verifiable in your browser's network tab.