--- title: "How to decipher DMARC reports? | DuoCircle" description: "DMARC aggregate reports arrive as dense XML. Learn how to read the metadata and records sections and interpret authentication results so you can act on them." image: "https://www.duocircle.com/images/og-default.png" canonical: "https://www.duocircle.com/blog/dmarc/how-to-decipher-dmarc-reports/" --- Quick Answer DMARC aggregate reports are XML and break into two sections: metadata (date range, reporting provider, your domain, published policy and SPF/DKIM alignment modes) and records (per-IP authentication results). To read one: identify the policy\_published section showing p (none/quarantine/reject), sp (subdomain policy), adkim (DKIM alignment mode), and aspf (SPF alignment mode). Review each row's source IP and message count to see who sent on your behalf. Check SPF and DKIM pass/fail per row; a message needs to pass at least one with alignment to pass DMARC. Verify alignment: SPF compares the SPF domain to the From domain, DKIM compares the d= value to the From domain. Read policy\_evaluated.disposition for the action taken: none, quarantine, or reject. Pay closest attention to failures, especially from unfamiliar IPs, since those signal either misconfigured legitimate senders or active spoofing. How to decipher DMARC reports? Your browser does not support the audio element. [ Download episode](https://media.mailhop.org/duocircle/images/2024/09/How-to-decipher-DMARC-reports.mp3) Share [ ](https://www.linkedin.com/sharing/share-offsite/?url=undefined%2Fblog%2Fdmarc%2Fhow-to-decipher-dmarc-reports%2F "Share on LinkedIn") [ ](https://twitter.com/intent/tweet?text=How%20to%20decipher%20DMARC%20reports%3F&url=undefined%2Fblog%2Fdmarc%2Fhow-to-decipher-dmarc-reports%2F "Share on X/Twitter") [ ](https://www.facebook.com/sharer/sharer.php?u=undefined%2Fblog%2Fdmarc%2Fhow-to-decipher-dmarc-reports%2F "Share on Facebook") [ ](https://reddit.com/submit?url=undefined%2Fblog%2Fdmarc%2Fhow-to-decipher-dmarc-reports%2F&title=How%20to%20decipher%20DMARC%20reports%3F "Share on Reddit") [ ](mailto:?subject=How%20to%20decipher%20DMARC%20reports%3F&body=Check out this article: undefined%2Fblog%2Fdmarc%2Fhow-to-decipher-dmarc-reports%2F "Share via Email") ![DMARC reports](https://media.mailhop.org/duocircle/images/2024/09/email-smtp-service-2849.jpg) Deciphering [DMARC reports](/content/dmarc-report) is complex as it requires understanding the **XML structure** and key components within the report. You have to analyze the IP address and understand the failures. Here’s a step-by-step guide on how you can go about it. ### Identify the report sections The report section includes **metadata and records**. Metadata contains the date range covered by the report, the email provider generating the report, and the domain being reported. It shows the DMARC policy (none, quarantine, or reject) and the alignment modes for SPF and [DKIM](/resources/what-is-dkim). The records include detailed information about the **authentication results** for each [IP address](https://www.fortinet.com/resources/cyberglossary/what-is-ip-address) that sent emails on your behalf, including both authorized and unauthorized ones. ### Review the DMARC policy applied Look for the policy published section, which states the domain’s [DMARC policy](/resources/dmarc-policy). This includes: - **p**: Policy (none, quarantine, reject) - **sp**: Subdomain policy - **adkim**: **DKIM alignment mode** (strict or relaxed) - **aspf**: SPF alignment mode (strict or relaxed) ### Check the source IP addresses _See the ‘row’ section to identify the IP addresses that were used to send emails from your domain_. The ‘count’ section tells the **number of emails sent** from the particular IP. [![Unauthorized Server or IP Address](https://media.mailhop.org/duocircle/images/2024/09/365-to-365-migration-2.jpg)](https://media.mailhop.org/duocircle/images/2024/09/365-to-365-migration-2.jpg) ### Analyze SPF and DKIM results Go through all the emails sent from your domain and see if they passed or failed [SPF](/resources/what-is-spf) and DKIM checks. Failed SPF results indicate that an unauthorized server or IP address was used to send an **email from your domain**. The DKIM results show if the signature was valid. An email needs to pass at least one of these protocols to pass DMARC. ### Review alignment DMARC requires alignment between the domain used in SPF/DKIM and the domain in the ‘From’ address. **SPF alignment ensures** that the domain in the SPF record matches the ‘From’ address, whereas DKIM alignment checks whether the domain in the [DKIM signature](https://docs.mapp.com/docs/dkim-signature) matches the ‘From’ address. ### Interpret actions taken Go to the **policy\_evaluated section** and check the ‘disposition’ field to see what action was taken on the email based on your DMARC policy: - **None**, no action was taken. - **Quarantine**, the message was placed in the [spam folder](https://cybernews.com/news/microsofts-breach-notification-emails-end-up-in-spam-folder/). - **Reject**, the message was rejected. ### Look for failures Any email that didn’t pass the DMARC check is [potentially fraudulent](https://www.bleepingcomputer.com/news/security/fake-it-support-sites-push-malicious-powershell-scripts-as-windows-fixes/), so **pay extra attention** to it. Ill-intended people send such messages to your customers, prospects, employees, shareholders, media, etc., to tarnish your [business reputation](https://www.linkedin.com/pulse/what-business-reputation-why-important-paul-swarnapandian-maicd--snnuc), dupe them out of money, manipulate them into sharing [sensitive details](https://www.darkreading.com/remote-workforce/microsoft-copilot-studio-exploit-leaks-sensitive-cloud-data), etc. ### Aggregate information Please review the **number of messages passed**, the number of failed messages, and whether the failures are due to legitimate misconfigurations or [malicious activity](https://www.bleepingcomputer.com/news/security/construction-firms-breached-in-brute-force-attacks-on-accounting-software/). [![ email authentication ](https://media.mailhop.org/duocircle/images/2024/09/email-smtp-service-2810.jpg)](https://media.mailhop.org/duocircle/images/2024/09/email-smtp-service-2810.jpg) ## Final words By analyzing these elements, you can detect misconfigurations and unauthorized senders and fine-tune your [email authentication](/resources/email-authentication) policies. However, we understand how all this can become **overwhelming and resource-consuming**. So, please feel free to [reach out to us](/contact) at [DuoCircle](/) for DMARC implementation, monitoring, and reporting-related services. ## Topics DKIMDMARCspfUpdates ![Brad Slavin](https://media.mailhop.org/dmarcreport/images/team/brad-slavin.jpg) Brad Slavin General Manager General Manager at DuoCircle. Product strategy and commercial lead across the email security portfolio. ## Secure your email infrastructure Protect, authenticate, and deliver. Contact our team to find the right solution. [Contact Sales](/contact/) [Explore Products](/products/) Share this article [ ](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fwww.duocircle.com%2Fblog%2Fdmarc%2Fhow-to-decipher-dmarc-reports%2F) [ ](https://twitter.com/intent/tweet?text=How%20to%20decipher%20DMARC%20reports%3F&url=https%3A%2F%2Fwww.duocircle.com%2Fblog%2Fdmarc%2Fhow-to-decipher-dmarc-reports%2F) [ ](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fwww.duocircle.com%2Fblog%2Fdmarc%2Fhow-to-decipher-dmarc-reports%2F) Copy Related Articles - [ ![DMARC problems](https://media.mailhop.org/duocircle/images/2024/10/email-migration-service-8520.jpg) A guide to detecting DMARC problems using the pentesting techniques DMARC ](/blog/dmarc/a-guide-to-detecting-dmarc-problems-using-the-pentesting-techniques/) - [ ![DMARC policy](https://media.mailhop.org/duocircle/images/2024/11/spf-validator-7326.jpg) DMARC policy explained: p=none, quarantine, reject DMARC ](/blog/dmarc/dmarc-policy-guide-for-beginners/) - [ ![DMARC reporting](https://media.mailhop.org/duocircle/images/2024/12/hosted-email-server-0505.jpg) How are DMARC enforcement and DMARC reporting different? DMARC ](/blog/dmarc/how-are-dmarc-enforcement-and-dmarc-reporting-different/) - [ ![DMARC expert](https://media.mailhop.org/duocircle/images/2024/09/dmarc-report-5.jpg) How to become a DMARC expert: a 6-step learning path DMARC ](/blog/dmarc/a-detailed-guide-on-becoming-a-dmarc-expert/) ## Related Articles [ DMARC 6m A guide to detecting DMARC problems using the pentesting techniques Oct 3, 2024 ](/blog/dmarc/a-guide-to-detecting-dmarc-problems-using-the-pentesting-techniques/)[ DMARC 6m DMARC policy explained: p=none, quarantine, reject Nov 22, 2024 ](/blog/dmarc/dmarc-policy-guide-for-beginners/)[ DMARC 6m How are DMARC enforcement and DMARC reporting different? Dec 5, 2024 ](/blog/dmarc/how-are-dmarc-enforcement-and-dmarc-reporting-different/)[ DMARC 6m How to become a DMARC expert: a 6-step learning path Sep 24, 2024 ](/blog/dmarc/a-detailed-guide-on-becoming-a-dmarc-expert/) ```json {"@context":"https://schema.org","@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com","logo":{"@type":"ImageObject","url":"https://www.duocircle.com/images/duocircle-logo.png"},"description":"DuoCircle is a portfolio of specialized email products covering protection, authentication, delivery, and routing. We deliver about 90% of category-leader capability at roughly half the price, backed by experts who own the outcome. Trusted by 50,000+ organizations since 2014.","subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}],"sameAs":["https://www.linkedin.com/company/duocircle","https://x.com/duocirclellc","https://www.facebook.com/duocirclellc","https://www.g2.com/products/phish-protection-by-duocircle/reviews","https://github.com/duocircle","https://www.crunchbase.com/organization/duocircle-llc"],"contactPoint":{"@type":"ContactPoint","contactType":"customer support","url":"https://support.duocircle.com"},"knowsAbout":["Email Security","Email Authentication","SPF","DKIM","DMARC","Phishing Protection","Spam Filtering","SMTP Relay","Email Deliverability","Email Forwarding"]} ``` ```json {"@context":"https://schema.org","@type":"WebSite","name":"DuoCircle LLC","url":"https://www.duocircle.com","description":"DuoCircle is a portfolio of specialized email products covering protection, authentication, delivery, and routing. We deliver about 90% of category-leader capability at roughly half the price, backed by experts who own the outcome. Trusted by 50,000+ organizations since 2014.","publisher":{"@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com","logo":{"@type":"ImageObject","url":"https://www.duocircle.com/images/duocircle-logo.png"},"description":"DuoCircle is a portfolio of specialized email products covering protection, authentication, delivery, and routing. We deliver about 90% of category-leader capability at roughly half the price, backed by experts who own the outcome. Trusted by 50,000+ organizations since 2014.","subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]}} ``` ```json [{"@context":"https://schema.org","@type":"BlogPosting","headline":"How to decipher DMARC reports?","description":"DMARC aggregate reports arrive as dense XML. Learn how to read the metadata and records sections and interpret authentication results so you can act on them.","url":"https://www.duocircle.com/blog/dmarc/how-to-decipher-dmarc-reports/","datePublished":"2024-09-27T19:03:13.000Z","dateModified":"2025-08-25T12:15:30.000Z","dateCreated":"2024-09-27T19:03:13.000Z","author":{"@type":"Person","@id":"https://www.duocircle.com/authors/brad-slavin/#person","name":"Brad Slavin","url":"https://www.duocircle.com/authors/brad-slavin/","jobTitle":"General Manager","description":"Brad Slavin runs DuoCircle, the company behind DMARC Report, AutoSPF, Phish Protection, and Mailhop. His focus is product strategy, customer relationships, and the commercial and compliance side of email authentication (DPAs, SLAs, enterprise procurement).","image":"https://media.mailhop.org/dmarcreport/images/team/brad-slavin.jpg","knowsAbout":["Email Security Strategy","SaaS Product Management","Enterprise Compliance","Customer Success","Email Deliverability Business"],"worksFor":{"@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com"},"sameAs":["https://www.linkedin.com/in/bradslavin"]},"publisher":{"@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com","logo":{"@type":"ImageObject","url":"https://www.duocircle.com/images/duocircle-logo.png"},"description":"DuoCircle is a portfolio of specialized email products covering protection, authentication, delivery, and routing. We deliver about 90% of category-leader capability at roughly half the price, backed by experts who own the outcome. Trusted by 50,000+ organizations since 2014.","subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]},"mainEntityOfPage":{"@type":"WebPage","@id":"https://www.duocircle.com/blog/dmarc/how-to-decipher-dmarc-reports/"},"articleSection":"dmarc","keywords":"DKIM, DMARC, spf, Updates","wordCount":483,"image":{"@type":"ImageObject","url":"https://media.mailhop.org/duocircle/images/2024/09/email-smtp-service-2849.jpg","caption":"DMARC reports","width":900,"height":600},"speakable":{"@type":"SpeakableSpecification","cssSelector":[".answer-block","h1"]}},{"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Blog","item":"https://www.duocircle.com/blog/"},{"@type":"ListItem","position":2,"name":"DMARC"},{"@type":"ListItem","position":3,"name":"How to decipher DMARC reports?","item":"https://www.duocircle.com/blog/dmarc/how-to-decipher-dmarc-reports/"}]}] ``` ```json {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://www.duocircle.com/"},{"@type":"ListItem","position":2,"name":"Blog","item":"https://www.duocircle.com/blog/"},{"@type":"ListItem","position":3,"name":"DMARC","item":"https://www.duocircle.comundefined"},{"@type":"ListItem","position":4,"name":"How to decipher DMARC reports?","item":"https://www.duocircle.com/blog/dmarc/how-to-decipher-dmarc-reports/"}]} ``` ```json {"@context":"https://schema.org","@type":"BlogPosting","headline":"How to decipher DMARC reports?","description":"DMARC aggregate reports arrive as dense XML. Learn how to read the metadata and records sections and interpret authentication results so you can act on them.","url":"https://www.duocircle.com/blog/dmarc/how-to-decipher-dmarc-reports/","datePublished":"2024-09-27T19:03:13.000Z","dateModified":"2025-08-25T12:15:30.000Z","dateCreated":"2024-09-27T19:03:13.000Z","author":{"@type":"Person","@id":"https://www.duocircle.com/authors/brad-slavin/#person","name":"Brad Slavin","url":"https://www.duocircle.com/authors/brad-slavin/","jobTitle":"General Manager","description":"Brad Slavin runs DuoCircle, the company behind DMARC Report, AutoSPF, Phish Protection, and Mailhop. His focus is product strategy, customer relationships, and the commercial and compliance side of email authentication (DPAs, SLAs, enterprise procurement).","image":"https://media.mailhop.org/dmarcreport/images/team/brad-slavin.jpg","knowsAbout":["Email Security Strategy","SaaS Product Management","Enterprise Compliance","Customer Success","Email Deliverability Business"],"worksFor":{"@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com"},"sameAs":["https://www.linkedin.com/in/bradslavin"]},"publisher":{"@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com","logo":{"@type":"ImageObject","url":"https://www.duocircle.com/images/duocircle-logo.png"},"description":"DuoCircle is a portfolio of specialized email products covering protection, authentication, delivery, and routing. We deliver about 90% of category-leader capability at roughly half the price, backed by experts who own the outcome. Trusted by 50,000+ organizations since 2014.","subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]},"mainEntityOfPage":{"@type":"WebPage","@id":"https://www.duocircle.com/blog/dmarc/how-to-decipher-dmarc-reports/"},"articleSection":"dmarc","keywords":"DKIM, DMARC, spf, Updates","wordCount":483,"image":{"@type":"ImageObject","url":"https://media.mailhop.org/duocircle/images/2024/09/email-smtp-service-2849.jpg","caption":"DMARC reports","width":900,"height":600},"speakable":{"@type":"SpeakableSpecification","cssSelector":[".answer-block","h1"]}} ```