Read the report your inbox provider sends you

A DMARC aggregate report is a machine-to-machine document. Providers batch up everything that claimed to be your domain over roughly the last day, compress it, and send it to wherever your DNS record points. The format is efficient, not readable: counts against source IPs, pass and fail flags, a policy summary, all in nested XML.

This viewer puts the interpretation ahead of the data. The verdict line comes first — what your policy is set to, roughly what share of sampled messages passed, whether enforcement acted on anything — because those are the questions you actually brought the report here to answer. The table beneath it carries the detail, sorted by volume, with each source's authentication results spelled out clearly. When the envelope-from and the From: your recipients saw disagree, both are kept in view, because that disagreement is itself a finding.

One habit worth forming: run reports from more than one provider if you receive them. Sampling differs between reporters, so a Google report and a Microsoft report over the same period are two pictures of the same traffic, and the differences between them are informative — the DMARC report reading checklist covers which fields to compare first.

Reading one report by hand is the manual version of a job that repeats daily. DMarcus does it automatically — every report your providers send, read, summarised, and delivered to your inbox weekly. Once you understand what the reports say, the email authentication checker shows the DNS records behind those results, and the SPF record generator rebuilds the record most reports end up prompting — the generator walkthrough follows the same reasoning step by step.