A DMARC aggregate report is an XML file, usually gzip-compressed, that a receiving mail system sends by email to the address a domain owner lists in the rua tag of its DMARC record. Most people never open one because the file is built for software to total up, not for people to skim. You do not need to read all of it. A few fields per row, read in a fixed order, answer the practical questions: who is sending mail as your domain, whether your legitimate senders pass authentication, and what receivers did with the mail.
Where the report comes from
The rua setting in a domain’s DMARC record designates where aggregate feedback is sent. RFC 7489 requires receivers to support a mailto: reporting URI and says they must not generate aggregate feedback reports when rua is absent. If you expect reports and none arrive, check the published record before anything else. The reporting specification is at RFC 7489.
As an Amazon Associate I earn from qualifying purchases.
Why the report is XML, gzipped, and emailed
RFC 7489 specifies that the aggregate report travels as a MIME part in an email. The aggregate data must be XML and should be GZIP-compressed. The section on email states it this way:
“The aggregate data MUST be an XML file that SHOULD be subjected to GZIP compression.” (RFC 7489, Section 7.2.1.1, “Email”)
RFC 9990 is the current aggregate reporting specification and keeps XML and GZIP as the recommended format. It also defines a filename pattern and requires a .xml or .xml.gz extension depending on whether the file is compressed. See RFC 9990.
The format is the reason a raw attachment is awkward. Receivers generate these files at scale so that a platform can aggregate many reports from many sources. The output is closer to a data export than a message, so the job is to extract a small set of fields, not to read prose.
What is inside a report
The report metadata identifies the reporting organization, a report ID, and the date range covered. The body then lists rows. Each row groups traffic from one source IP address and carries a message count, the disposition the receiver applied, and the policy-evaluated SPF and DKIM results. Authentication-result elements record the domains involved and the raw SPF and DKIM outcomes, which help explain a mismatch. Details are defined in RFC 9990.
Recommended Free Tools
A report is not a list of spam complaints. It summarizes how mail claiming your domain was authenticated and handled. Mail that never reached a receiver can still appear through the sources that did send it, which is why the source IP column matters more than any single row.
Rank #3
Opening the attachment
- Save the attachment without opening it in a mail client’s preview pane.
- If the file ends in
.xml.gz, decompress it. On Linux or macOS, rungunzip -k report.xml.gz. On Windows, use an archiver that supports gzip, such as 7-Zip. - Open the resulting
.xmlfile in a plain-text editor. A browser also displays the XML structure, which makes nested elements easier to follow.
How to read a report
- Confirm the reporter and date range. Check the reporting organization and the covered period before drawing any conclusion from the counts.
- Group rows by source IP and sum the counts. This shows which systems sent mail claiming your domain and how much each one sent.
- Check the disposition. The values
none,quarantine, andrejectdescribe the action the receiver reported. Compare that with your published policy and investigate unexpected results. - Check the policy-evaluated SPF and DKIM results. These show whether each mechanism aligned with the From domain for DMARC purposes.
- Check the authentication-result details. Use the domains and raw outcomes to diagnose why alignment failed.
Interpreting what you find
Recognized senders versus unknown sources
Start with the source IPs you already know: your email platform, marketing service, transactional sender, and any forwarding path you use on purpose. Microsoft’s DMARC configuration guidance recommends deciding whether each IP is a legitimate sender or an unauthorized one, and treats high volume from an unknown IP as a possible spoofing signal. The guidance is at Microsoft Learn.
Authentication passing is not the same as alignment
A message can pass SPF or DKIM and still fail DMARC if the domain that passed does not align with the From domain. The policy-evaluated values answer the DMARC question. The raw SPF or DKIM result only tells you whether that mechanism authenticated its own identifier. When a legitimate sender shows failures, the mismatch is often in the sending domain or the envelope and signing setup, not in the mail itself.
Rank #4
A failed row is a lead, not a verdict
An unexpected source is a reason to investigate. It is not proof of an attacker. Forwarding, mailing lists, and third-party services can all produce rows that look wrong until you match them to a known path. Confirm the path before changing policy, and avoid treating a single row as conclusive attribution.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallHow often reports arrive
RFC 7489 says implementations must be able to provide daily reports and should be able to provide hourly reports when requested. Non-daily delivery is handled on a best-effort basis. This is a capability statement in the standard, not a guarantee that every receiver sends a report at a given hour, so expect irregular timing and plan around daily data.
Best Value
What the evidence does not establish
The official sources cited here do not provide a current statistic about how many domains read their reports or how much unauthorized mail exists. Any headline percentage you see online should be traced to its own study before you rely on it. The standards also do not give a size figure you can apply to attachments today. RFC 7489 mentions a commonly observed receiver limit in its discussion of compression, but describes it as historical and not universal, so do not use it as present-day guidance.
Questions a report can answer
- Which IP addresses are sending mail that claims to be from my domain?
- Are my legitimate senders passing SPF and DKIM in a way that aligns with DMARC?
- Is anyone sending unauthorized mail from my domain?
- Is my sending volume consistent with what I expect, or are there anomalies?
These are the questions Microsoft’s guidance and the DDMARC explainer on aggregate reports raise as the practical uses of the data. Answering the last one requires a baseline, which means knowing your normal volume by source before an anomaly shows up.
Reading the XML by hand or with an analyzer
Manual reading works for a single domain with a few sources and a low report volume. Once several domains or a steady stream of reports arrive, a DMARC report analyzer or aggregate-report monitoring service becomes the practical option. When you compare tools, these are the criteria that matter:
- Whether it ingests the attachment directly, including
.xml.gzfiles, without manual decompression. - How clearly it shows source IP, count, disposition, and policy-evaluated SPF and DKIM for each row.
- Whether it keeps history, so you can compare this week with last month.
- Whether it supports alerts when a new source appears or a volume spike occurs.
- How it helps you separate authorized senders from possible spoofing, rather than listing every row with equal weight.
The standards and Microsoft guidance cited here do not rank products or state prices, so judge any tool against these criteria rather than against a generic claim of accuracy.
The Bottom Line
The XML, the gzip, and the email are not the real barrier. The barrier is reading rows without an inventory of your own senders. Build that list first, and the aggregate report becomes a short check of source IPs, counts, dispositions, and alignment.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
