DMARC Report Viewer Online
Turn DMARC aggregate reports (XML, .zip, .gz from Google, Microsoft, Yahoo) into JSON: senders by IP, SPF / DKIM alignment, pass rates and advice.
Result
Press “Run” to see the result.
Mailbox providers send DMARC aggregate (RUA) reports as XML files, usually zipped or gzipped. Upload one or more (file, file2…, up to 50 files or 200 reports, ZIPs may contain several) or paste the XML. The API reads both the RFC 7489 format and the newer DMARCbis aggregate format (namespace dmarc-2.0, with np, testing and discovery_method) and returns the reporter, report id, date range, the published policy and every record: source IP, message count, disposition, the DKIM and SPF results as evaluated by the receiver, override reasons, header / envelope from and the raw DKIM / SPF results with our own alignment check.
All reports are then aggregated: total messages, DMARC pass / fail and pass rates, aligned DKIM and SPF rates, dispositions, totals per From domain, and a list of sending sources sorted by volume with their pass rate, DKIM domains and selectors and SPF domains. failing_sources shows the IPs whose mail failed, and advice gives plain next steps (authorise a legitimate sender, add DKIM because SPF breaks on forwarding, move from p=none to quarantine when more than 98% passes).
With enrich=true the top 50 sources also get their reverse DNS (PTR) and, where available, ASN / network owner. Set include_records=false for a compact answer. Reports are parsed in memory and not stored.
Use this in your code
curl -X POST "https://apibox.io.vn/v1/dmarc-report" \
-H "Authorization: Bearer YOUR_API_KEY" \
-H "Content-Type: application/xml" \
--data-binary '<feedback>…<policy_published><domain>example.vn</domain><p>none</p>…</policy_published><record>…</record></feedback>'const res = await fetch('https://apibox.io.vn/v1/dmarc-report', {
method: 'POST',
headers: {
Authorization: 'Bearer YOUR_API_KEY',
'Content-Type': 'application/xml',
},
body: "<feedback>…<policy_published><domain>example.vn</domain><p>none</p>…</policy_published><record>…</record></feedback>",
});
const data = await res.json();
console.log(data);import requests
res = requests.post(
"https://apibox.io.vn/v1/dmarc-report",
headers={"Authorization": "Bearer YOUR_API_KEY", "Content-Type": "application/xml"},
data="<feedback>…<policy_published><domain>example.vn</domain><p>none</p>…</policy_published><record>…</record></feedback>".encode(),
timeout=30,
)
print(res.json())<?php
$ch = curl_init('https://apibox.io.vn/v1/dmarc-report');
curl_setopt_array($ch, [
CURLOPT_RETURNTRANSFER => true,
CURLOPT_CUSTOMREQUEST => 'POST',
CURLOPT_HTTPHEADER => ['Authorization: Bearer YOUR_API_KEY', 'Content-Type: application/xml'],
CURLOPT_POSTFIELDS => '<feedback>…<policy_published><domain>example.vn</domain><p>none</p>…</policy_published><record>…</record></feedback>',
]);
$response = curl_exec($ch);
print_r(json_decode($response, true));API documentation → Get a free API key
FAQ
Which files can I upload?
The XML report as sent by the provider, gzip (.xml.gz, .gz) or .zip archives, several at once. Forensic (RUF) reports and whole e-mails (.eml) are not parsed: extract the attachment first, for example with our e-mail parser.
What does dmarc: pass mean here?
A record passes DMARC when the receiver evaluated DKIM or SPF as pass and aligned with the From domain (policy_evaluated). The raw auth results and our alignment check are shown next to it.
When should I move to p=quarantine?
When all your legitimate senders pass, typically more than 98% of the volume over a few weeks. The advice field says so when the reports show it.