PulsarProtect

DMARC report analyzer

See who sends email as your domain and whether you can safely switch DMARC to reject.

See a sample report

Reports are kept until you delete them. Only you can see them unless you create a share link.

How to read DMARC reports

When you publish a DMARC record with an rua address, mailbox providers such as Google, Microsoft and Yahoo send you a daily XML file. It lists, for every server that sent mail using your domain in the From address, how many messages it sent and whether they passed. The files are made for machines, so this tool turns them into a list of sending sources and a verdict. You can generate a DMARC record with reporting if you do not have one yet.

What the columns mean

  • SPF: the share of messages where SPF passed for a domain that matches your From domain. A pass for the sending service's own domain does not count.
  • DKIM: the share of messages signed with a DKIM signature from your domain. A signature from the service's domain does not count.
  • DMARC: a message passes when SPF or DKIM passes and matches your domain. This is the number that decides whether mail is blocked under p=reject.

What to do with the verdicts

  • Legitimate: a service you use, passing. Nothing to do.
  • Yours, misconfigured: a service you use that fails. Set up its domain authentication, then check again next week.
  • Forwarding: mail relayed by a mailing list or a forwarding address. It can fail SPF; passing DKIM is what keeps it alive.
  • Likely spoofing: mail you do not recognize that fails. This is what p=reject stops.

Move step by step: fix your own sources, switch from p=none to p=quarantine, watch a few more weeks of reports, then go to p=reject. Reports describe the past, so a service that only sends monthly can be missing from a single week.