Skip to content
MtrX Tools

DMARC report analyser

Drop the DMARC aggregate reports mailbox providers send you (.xml, .gz or .zip) to see every server sending as your domain, which pass or fail SPF and DKIM alignment, and whether you are ready for quarantine or reject. Reports are read in your browser and never uploaded.

Making sense of DMARC reports

With a rua address in your DMARC record, Google, Microsoft, Yahoo and others send a daily XML report of every IP that sent mail as your domain and whether it passed. They are unreadable by hand; drop them here (several at once, compressed or not) to get one summary.

  • Pass rate overall and per sending source.
  • Which sources fail SPF or DKIM alignment, and what receivers did with their mail.
  • Forwarded mail, which often fails SPF but passes DKIM, flagged so you don't chase it.
  • Advice on whether it is safe to move to quarantine or reject.

Private by design

Reports list every server that sends as your domain, so they stay in your browser and are never uploaded. "Identify senders" sends only the IP addresses to MtrX, and only when you press it, to show which provider each one belongs to.

Questions

Where do I get the reports?
Add rua=mailto:you@example.com to your DMARC record. Reports arrive as email attachments, usually daily, from each large mailbox provider that received your mail.
A source I don't recognise is failing. Is it spoofing?
Use "Identify senders" to see its provider. Unknown IPs failing both SPF and DKIM are usually spoofing, which an enforced DMARC policy blocks. A service you use that fails needs SPF or DKIM set up for your domain.

Related tools

Privacy policy

Open as page

Effective 17 October 2026

Who we are

MtrX Tools (“MtrX”, “we”, “us”) runs the network diagnostic tools at mtrxtools.com. This policy explains what information is processed when you use the site, why, and the choices you have. Questions or requests: privacy@mtrxtools.com.

The short version

  • You don't need an account, and we don't ask for your name or email address.
  • What you type into a tool is used to run that check and is not saved in a database.
  • Your recent runs, theme and cookie choice stay in your own browser.
  • Google Analytics runs only if you accept analytics cookies, and never receives what you typed.
  • We don't sell your information or use it for advertising.

Information we process

What you enter into a tool. Domains, IP addresses, URLs, ports and email addresses (for the SPF/DKIM/DMARC check) are sent to our servers so we can run the check. We connect to the target and to the services listed below, show you the result, and don't keep it. Shareable result links contain the target in the address, so anyone you share a link with can see it.

Technical data. Like any website, our hosting provider receives your IP address, browser type and the time and address of each request. It is used to deliver the site, keep it secure and investigate errors, and is kept only briefly in the provider's logs. We also count requests per IP address (IPv6 addresses grouped by network) for about two minutes to apply rate limits that stop abuse.

What's my IP. This tool shows the address you connect from. Your browser asks ipify (api4.ipify.org and api6.ipify.org) for your IPv4 and IPv6 addresses, and our server looks up the network and approximate location of those addresses.

Tools that run only in your browser. The email header analyser, subnet calculator, network planner, error explainer and DMARC report analyser never send what you paste or upload to us or anyone else. In the DMARC analyser, “Identify senders” sends only the sending IP addresses to our server, and only when you press it.

Status badges and calendar feeds. Badge and calendar addresses contain the domains you chose. Anyone you share them with, and the services that fetch them for you (such as GitHub's image proxy or your calendar app), see those addresses. We check the domains when the badge or feed is requested and don't store them.

Storage in your browser. We keep your recent runs, theme and cookie choice in your browser's local storage. They are not sent to us; use “Clear” under Recent runs or your browser settings to remove them.

Analytics cookies (only with your consent). If you accept, we load Google Analytics 4, which sets cookies (_ga, _ga_*, kept for up to two years) to count visits and see which pages are used. We send page addresses without their query string, so the domains, addresses and emails you enter are not shared with Google. Google Analytics 4 doesn't log or store IP addresses; Google may use them briefly to estimate a country or city. Advertising features are turned off.

Advertising. We don't show ads today. If we add them, we will ask for any consent needed first and update this policy.

Services involved in running the tools

To produce results we, or your browser, contact the following. They receive what is needed for the check, usually the domain or IP address being looked up; services your browser contacts directly also see your IP address.

  • The hosts you ask us to test (we connect to them from our servers, never from your device).
  • Public DNS resolvers: Cloudflare, Google, Quad9 and OpenDNS.
  • IANA and the domain and IP registries and registrars that publish RDAP and WHOIS records.
  • Team Cymru, for the network (ASN) an IP address belongs to.
  • ipwho.is, for the approximate location of an IP address being looked up.
  • ipify, contacted by your browser on What's my IP.
  • The published IP range lists of cloud and CDN providers (AWS, Microsoft, Google, Cloudflare, Fastly, GitHub, Oracle, DigitalOcean, Linode), which our server downloads; nothing about you is sent to them.
  • Vercel, which hosts the site, and a rate-limiting store when one is configured.
  • Google, for Google Analytics, only if you consent.

Why we process it (legal bases)

Where data protection laws such as the GDPR and UK GDPR apply, we rely on our legitimate interests to provide the tools you request, keep the service secure and prevent abuse, and on your consent for analytics cookies. You can withdraw consent at any time with “Cookie settings” at the bottom of every page; this doesn't affect processing that happened before.

How long we keep it

Tool results are not stored. Rate-limit counters expire within about two minutes. Hosting logs are kept only as long as our provider retains them for operations and security. Analytics data is kept for the period set in Google Analytics (no longer than 14 months). Browser storage stays until you clear it.

International transfers

Our providers may process data in the United States and other countries. Where required, transfers rely on safeguards such as the EU Standard Contractual Clauses or the EU–US Data Privacy Framework.

Your rights

Depending on where you live, you may have the right to access, correct or delete personal information, to object to or restrict processing, to data portability, and to complain to your data protection authority. Because we don't ask who you are, we usually hold nothing we can link to you, but contact us at privacy@mtrxtools.com and we will help.

We don't sell personal information or share it for cross-context behavioural advertising (as defined in California law). If your browser sends a Global Privacy Control signal, we treat it as a refusal of analytics cookies.

Children

MtrX is not directed at children under 16, and we don't knowingly collect their personal information.

Security

The site is served only over HTTPS. Our servers refuse to probe private or internal networks, limit how fast tools can be used, and keep as little data as possible. No method of transmission or storage is completely secure, but we work to protect the information we handle.

Third-party content

Results include data from registries, DNS operators and other public sources. That data, third-party trademarks, and the open-source software MtrX is built with belong to their respective owners and are used under their terms.

Changes to this policy

We may update this policy as the tools change. The effective date above shows the latest version; significant changes will be highlighted on the site.

Contact

Email privacy@mtrxtools.com with any privacy question or request.