Email security
How do I read DMARC reports?
Short answer: DMARC reports are XML files listing every server that sent mail as your domain, how many messages it sent, and whether each passed SPF and DKIM.
The full answer
Each report comes from one mail provider (like Google or Microsoft) and covers about one day. Look at the source IP address, the message count, and the SPF and DKIM results.
Rows that fail but come from a service you use mean that service needs to be set up properly. Rows from servers you do not recognise are usually forgery — exactly what DMARC blocks.
Because the files are hard to read by eye, many people use a free report viewer to turn them into charts.
Want step-by-step help? Read What Is DMARC? A Beginner’s Guide to DMARC Policies.