📧 DMARC Report Viewer

Drop files anywhere on the page  ·  .xml, .zip, .gz  ·  Everything processed locally in your browser  ·  No data leaves your device

⚠️ Third-party library security notice — read before uploading sensitive reports

This tool loads two open-source libraries (pako and JSZip) from the Cloudflare CDN to decompress .gz and .zip files in your browser. Subresource Integrity (SRI) hashes are set, so your browser will refuse to run the files if they have been tampered with.

Residual risk: if the CDN served a malicious file before the hash was known (i.e. before your browser cached it), or the hash itself was compromised, a malicious library could access the files you upload. This is a very low-probability scenario, but it is real.

  • If this concerns you, only drag .xml files directly — this bypasses both libraries entirely (pure browser XML parsing).
  • Or host your own copy of this page with the libraries bundled inline.

Reverse DNS lookups are performed via the Google Public DNS API (dns.google) — only IP addresses are sent, never report content.

📁
Drop DMARC report files here
or click to browse  ·  .xml .zip .gz  ·  10 MB max per file  ·  drop more files anytime to add to current results

Frequently asked questions

Do my DMARC reports get uploaded anywhere?

No. All parsing happens locally in your browser using built-in browser APIs. The only external request made after the page loads is a reverse DNS lookup for sending IPs, via the Google Public DNS API — only the IP address is sent, never any report content.

What file formats does this tool support?

Raw .xml DMARC aggregate reports, .zip archives containing one or more XML reports, and .gz-compressed XML reports. You can mix formats and drop multiple files at once.

What does "pass" mean in the dashboard?

A message counts as passed when its disposition is "none" (delivered) and at least one of DKIM or SPF passed and aligned with your policy. Quarantine and reject dispositions are counted separately regardless of authentication results.

Does this tool read DMARC forensic (RUF) reports?

No, only aggregate reports (RUA) — the daily/periodic summary reports mail providers send to the address in your DMARC record. Forensic/failure (RUF) reports aren't supported.

Is it safe to upload sensitive DMARC reports?

Uploading .xml files directly is the lowest-risk option, since it uses only the browser's built-in XML parsing with zero third-party dependencies. Uploading .zip or .gz files loads two open-source libraries (pako and JSZip) from a CDN, verified with Subresource Integrity hashes so the browser refuses any tampered file; residual CDN-compromise risk is very low but non-zero.